Adding an External Action

Use an external action to run an Enforcement Action when a rule creates an alert. For example, send a notification or create an incident or ticket in your ticketing system.

Required Permissions

• Action Center > View and Action Center > Add and import to add an external action. Without the Action Center permissions, Add External Action doesn't appear.
• Findings > Modify to save the rule.

Adding an External Action to a Rule

To add an external action to a rule

1. Go to Monitoring.
2. To create a rule, click Create Rule. To change a rule, click the rule in the Monitoring Rules table, and then open the Rule Configuration tab.
3. Configure the rule. See Creating a Rule.
4. At the bottom of the rule, under Add Mute Conditions, click Add External Action.
5. In Select Action, select an Enforcement Action. For example, select a Create Incident or Create Ticket action of your ticketing system.
6. If the action uses an adapter connection, in Select Adapter Connection, select the connection.
7. Fill in the required and additional fields of the action.
8. Click Apply. Apply is enabled only after you fill in the required fields.
9. Click Create (new rule) or Save Changes (existing rule).

To leave the external action without saving it, click Back to Rule Configuration before you click Apply.

Selecting the Action

Select Action lists the Enforcement Actions of the following Action Center categories:

• Notify – Actions that send a notification, for example by email or to Slack.
• Create Incident or Ticket – Actions that create incidents, tickets, issues, or tasks. This category also includes some update actions, for example ServiceNow - Update Tickets and Jira Software - Update Tickets.

The list depends on the adapters that you installed.

How the External Action Runs

• A rule has one external action.
• When the rule creates an alert, the action runs on the assets in the query results of the rule.
• A muted alert doesn't run the action.
• When Alert only when the result changes is enabled, the action runs only when the rule creates an alert, not on each run of the rule.
• Axonius saves the external action as an Enforcement Set in the Findings Notification Enforcements folder of the Action Center. See Managing Enforcement Sets.

To change or remove an external action, see Managing Rules.

Example: A rule creates an alert when more than 10 servers have no EDR agent. Add the external action ServiceNow - Create Incident. Each new alert of the rule now runs the action on the servers in the query results of the rule.