How to create automation rules

Log in to your Defense.com account and click Automations in the navigation on the left-hand side.

Select + Create Automation on the top right.

Give your automation a name.

Select the runbook(s) you would like to use for the integration. Clicking on the runbook title will provide you with detailed information for the runbook.

When you're happy with your selections, click Next.

Select one or more of the available actions:

Scan Assets

Any assets associated with threat detections that are not excluded will be scanned.

Isolate Assets

Any assets associated with threat detections that are not excluded will be isolated.

Disable Users

Any users associated with threat detections that are not excluded will be disabled, and any current sessions invalidated.

Isolate Users Assets

Any assets for users associated with threat detections that are not excluded will be isolated.

Click Next.

Select any days/times (UTC) when you do not want the automation to run.

Click Next.

Review your automation rules, if you need to make any changes you can do so by clicking Back.

If you're happy with your automation, select Enable this Automation, and click Create.

And that's it! You've successfully created an automation rule. 🎉