Question

Can individual triggers for potential information security incidents be configured?

Answer

Yes. You can set up separate automation rules for events that your team considers indicators of a potential information security incident. For example, for changing a user's role or for a signal received from a monitoring or security system.

The rule sets the trigger conditions and the necessary actions: notifying those responsible, creating or updating a request, transferring data to an external system. If you need to correlate multiple events or perform a complex check, a script is used.

This is a setup tailored to your scenario. It does not replace a ready-made set of threat detection rules or a full-fledged security event analysis system.

Details: Event codes in Swarmica · Automation based on runtime-scripts · Can Swarmica be integrated with Zabbix or a security event management system? · Swarmica Automation