Response Triggers

Overview

Response Triggers start an automation after an incident response activity finishes on an asset. Use them to chain follow-up work, such as notifying the team, collecting more evidence, or containing the asset, as soon as AIR finishes a task.

Trigger	Starts when…
Hunt/Triage Completed	A Hunt/Triage task finishes on an asset.
Evidence Acquisition Completed	An evidence acquisition finishes successfully on an asset.
Baseline Acquisition Completed	A baseline acquisition finishes successfully on an asset.
Isolation Status Changed	An asset becomes isolated or unisolated.

All Response Triggers are event triggers: each event concerns one asset, and the automation runs once for that asset if it matches the trigger’s target scope.

Note

By default, tasks created by the Start Hunt/Triage, Start Evidence Acquisition, and Start Baseline Acquisition actions do not start other automations, to prevent automation loops. See Task-based actions and other automations.