Table of Contents
Advertisement
An Action can be executed on its own, or it can make use of an Integrator instance, configured from
an Integrator plugin. Integrators provide the ability to connect to an external system, such as an
LDAP, SMTP, or SOAP server, to execute an action.
16.2 Action Manager
The Action Manager allows you to configure repeatable actions that can be executed in various
contexts throughout the Sentinel system. The Action Manager allows you to configure the following
types of actions:
Configure a Correlated Event
Add to Dynamic List
Remove from Dynamic List
Execute a Command
Send an Email
Create an Incident
Execute JavaScript Action Plugins
NOTE: Except for JavaScript Actions, the Actions above can only be used in the context of a
correlation rule deployment. For more information about correlation-only actions, see the
Correlation section. This section focuses exclusively on JavaScript Action plugins and Actions.
Using the Action Manager you can import, create, and manage Action plugins (.zip files) and
configure specific Action instances.
16.2.1 Permissions for Using Action Plugins
To use Action Plugins, a user must be assigned the necessary permissions in the User Manager. By
default these permissions are assigned to esecadm.
To grant permissions for the Action Plugins:
1 Log into the Sentinel Control Center as a user with permissions to use the User Manager.
2 Go to the Admin tab.
3 Open the User Configuration folder.
4 Open the User Manager window. Double-click the desired user. The User Details window
displays.
5 Click the Permissions tab.
366 Sentinel 6.1 User Guide
Advertisement
Table of Contents
