# Can individual triggers for potential information security incidents be configured?
# Question

Can individual triggers for potential information security incidents be configured?

# Answer

Yes. You can set up separate automation rules for events that your team considers indicators of a potential information security incident. For example, for changing a user's role or for a signal received from a monitoring or security system.

The rule sets the trigger conditions and the necessary actions: notifying those responsible, creating or updating a request, transferring data to an external system. If you need to correlate multiple events or perform a complex check, a script is used.

This is a setup tailored to your scenario. It does not replace a ready-made set of threat detection rules or a full-fledged security event analysis system.

**Details:** [Event codes in Swarmica](https://support.swarmica.com/article/ru/913-коды-событий-в-swarmica.html) · [Automation based on runtime-scripts](https://support.swarmica.com/article/ru/949-автоматизация-на-базе-runtime-scripts.html) · [Can Swarmica be integrated with Zabbix or a security event management system?](https://support.swarmica.com/article/ru/1996-можно-ли-интегрировать-swarmica-с-zabbix-или-системой-управления-событиями-безопасности.html) · [Swarmica Automation](https://swarmica.ru/automation)