Actions (Admin Settings)

The functionality described in this article is available in XRay versions 1.5 and greater. 

By setting up a Slack action, you lay the framework for messages to be sent to users or channels (groups of users). Slack actions send Slack messages; email actions send emails. A Log action saves data to a log for future reference.

Slack Actions

For information about setting up Slack actions, see step 3 of Social Integration: Slack. In Step 4 of that article, you’ll associate Slack actions with alerts so that messages are sent in certain cases.

Email actions

Before creating an email action, you must set up an email provider. See Providers.

You can send an email to any email address (individual or group).  Messages can include text, variables, or both.

1. From Main Menu > Admin Settings > Actions, select Email.
2. Click Create.
3. Enter an Action Name.
4. Select the Provider Name that will send emails for this action.
5. Select the MIME type: Text/plain or text/html.
6. Enter “from” and “to” email addresses in the Mail From and Mail To An optional Mail CC field is available to copy the message to additional addresses.
7. Enter the Subject of the message to be sent.
8. Enter the Message text and variables, if desired. For more information about creating and formatting messages, see Templates and Message Formatting.
9. To verify that messages can be sent through the email provider, click Test. A confirmation message is displayed to inform you that the test email was sent successfully.
10. Click OK.
    

Log Actions

Instead of sending a message through Slack or email, a Log action saves data to a log for future reference.

1. From  Main Menu > Admin Settings  >  Actions, select  Logs.
   
2. Click  Create. The Editing Provider console opens.
   
3. Enter the Provider Name; this name must match the Provider Name as set up in Set up a Log Provider.
4. The Line is filled in automatically, as set in the Editing Provider console.
5. Click Save.

To test the log action:

1. In the jKQL Workbench, open any repository.
2. Type “invoke action ‘<action name’>” and run the query.
   
3. To check the log file, go to AutopilotM6/localhost. The log file can be found there.