Loading

Alert triggers

Alert triggers run workflows automatically when detection or alerting rules generate an alert. Use alert triggers for alert enrichment, automated incident response, case creation, or notification routing.

When an alert triggers your workflow, it provides rich context data through the event field.

To set up an alert trigger, follow these steps:

  1. Define an alert trigger

    Create a workflow with an alert trigger:

    name: Security Alert Response
description: Enriches and triages security alerts
enabled: true
triggers:
  - type: alert
steps:
  ....

  2. Configure the alert rule

    After creating your workflow, configure your alert rule to trigger it.

    1. Find Rules in Stack Management or by using the global search field.
    2. Find or create the alerting rule you want to trigger the workflow.
    3. Edit the rule settings and in the Actions section, click Add action.
    4. Select Workflows.
    5. Select your workflow from the dropdown or create a new one. You can only select enabled workflows.
    6. Choose whether to run separate workflows for each generated alert.
    7. Optionally, click Add action to configure multiple workflows.
    8. Create or save the rule.
    1. Find Detection rules (SIEM) in the navigation menu or by using the global search field.
    2. Find or create the detection rule you want to trigger the workflow.
    3. Edit the rule settings and in the Actions section, select Workflows.
    4. Select your workflow from the dropdown or create a new one. You can only select enabled workflows.
    5. Choose whether to run separate workflows for each generated alert.
    6. Optionally, click Add action to configure multiple workflows.
    7. Create or save the rule.

When the configured rule generates an alert, your workflow automatically executes with the alert context.