Ready to Try?
View Categories

Overview of Actions

What Are Actions? #

Lucidum includes a feature called Actions. Actions are automations that are triggered by query results.

Actions include sending email messages, posting a message to slack, creating tickets, isolating infected devices, or making changes to Active Directory, among other options.

For example, you can define an action that sends an email to the IT team if Lucidum discovers one or more assets without endpoint protection.

Lucidum also includes a type of action for webhooks. For details on webhooks, see the manual Running Headless with Webhooks.

Structure of Actions #

Actions include two pieces

  • A configuration that provides the connection and authorization information to communicate with the external solution.

  • An action that specifies the task to execute, the data to include in the action, and how frequently to execute the action.

Viewing the Actions page #

The Actions page lists all the Action integrations and displays information about the configured actions.

actions_new_ui_numbers.png

  1. Errors pane. If an action type has one or more actions with an error, the action type appears in the Errors.
  2. Red icon that displays the number of actions that are enabled and have errors.
  3. Disabled pane. If an action type has one or more actions that are disabled, and no actions with errors, the action type appears in the Disabled
  4. Gray icon that displays the number of actions that are disabled.
  5. Enabled pane. If an action type has only actions that are enabled, and no actions have errors, the connector appears in the Enabled
  6. Green icon that displays the number of actions that are enabled and do not have errors.
  7. Available pane. These action types have not been configured for use.
  8. Filter Actions by Category. View action types by category, like Asset Management, Identity Access Management, Risk Management..
  9. Search. Search for action types by name.

Viewing the Configured Actions page #

The Configure Actions page displays information about configured actions for an integration.

actions_configured_actions_callouts_edited_15.0.png

  • Name and Description of the connector.
  • Page Click this icon to view documentation about the action type. The documentation appears on a new page.
  • Plus-sign icon. Add a new action.
  • Pencil Edits the selected action.
  • Trashcan Click this icon to delete a profile. If action is disabled, you can delete it.
  • Two pages Clones the action.
  • Page of text View logs for the action.
  • Airplane icon. Executes the action on-demand (now).
  • Red toggle icon. Action is enabled and has errors.
  • Green toggle icon. Action is enabled and does not have errors.
  • Gray toggle icon. Action is disabled.
  • Orange toggle icon. Action is currently running.
  • Calendar icon. Actions executes after ingestion.
  • Two arrows Recurring action that executes on a schedule.
  • 1X icon. Actions executes once, upon saving.
  • Red Last Run Time. Action had errors during last run.
  • Blue Next Run Time. Action is scheduled to run in the future.
  • Green Last Run Time. Action executed successfully during last run.
  • Orange Last Run Time. Action is currently running.

List of Actions #

Actions for Active Directory #

Lucidum includes the following Actions for Active Directory:

  • Change Computer Group. Changes the AD group membership for one or more assets.

  • Disable Computer. Disables one or more computer objects in AD. When a computer object is disabled in AD, domain accounts cannot log in to the computer.

  • Enable Computer. Enables one or more computer objects in AD. When a computer object is enabled in AD, domain accounts can log in to the computer.

  • Change Computer OU. Changes the AD OU (organizational unit) for one or more computers.

  • Change User Group. Changes the AD group membership for one or more users.

  • Disable User. Disables one or more user objects in AD. When a user object is disabled in AD, the user cannot log in to the domain.

  • Enable User. Enables one or more user objects in AD. When a user object is enabled in AD, the user can log in to the domain.

  • Change User OU. Changes the AD OU (organizational unit) for one or more users.

Actions for AWS EC2 #

Lucidum includes the following Actions for AWS EC2:

Actions for Automox #

Lucidum includes the following Actions for Automox:

  • Patch Device. Applies all available software patches to one or more devices.

  • Reboot Device. Reboots one or more devices.

Actions for CrowdStrike Falcon LogScale #

Lucidum includes the following Actions for Crowdstrike Falcon LogScale:

  • Send Data to LogScale. Sends a custom set of Lucidum data to LogScale.

Actions for Elastic Cloud #

Lucidum includes the following Actions for Elastic Cloud:

  • Send to Elastic Cloud Index. Sends a custom set of Lucidum data to Elastic Cloud.

Actions for Email #

Lucidum includes the following Actions for Email:

  • Send Email. Sends data about one or more assets or users to one or more recipients.

Actions for Google Chronicle #

Lucidum includes the following Actions for Google Chronicle:

  • Send Data. Sends a custom set of Lucidum data to Google Chronicle.

Actions for HappyFox Help Desk #

Lucidum includes the following Actions for HappyFox Help Desk:

  • Create HappyFox Ticket. Create or update a ticket in HappyFox. The HappyFox action can customize the category, subject, message, and other fields.

  • Create HappyFox Asset. Map Lucidum data to asset data in HappyFox Help Desk.

Actions for Hunters #

Lucidum includes the following Actions for Hunters:

  • Send Data. Sends a custom set of Lucidum data to Hunters.

Actions for Jira Cloud Platform #

Lucidum includes the following Actions for Jira Cloud:

  • Create Jira Issue. Creates a Jira issue. For each record that matches the base query, the output fields are attached to the Jira ticket.

  • Creates a Jira Asset. Creates a Jira asset in Jira Service Management.

Actions for Microsoft Defender #

Lucidum includes the following Actions for Microsoft Defender:

  • Isolate Machine. Disconnects one or more devices from the network while retaining connectivity to the Defender for Endpoint service, which continues to monitor the device.

  • Unisolate Machine. Reconnects one or more devices to the network.

Devices that are behind a full VPN tunnel won’t be able to reach the Microsoft Defender for Endpoint cloud service after the device is isolated. Microsoft recommends using a split-tunneling VPN for Microsoft Defender for Endpoint traffic.

Actions for Microsoft Sentinel #

Lucidum includes the following Actions for Microsoft Sentinel:

  • Send Data. Sends a custom set of Lucidum data to Microsoft Sentinel.

Actions for Microsoft Teams #

Lucidum includes the following Actions for Microsoft Teams:

  • Post on Teams. Sends a custom set of Lucidum data to Microsoft Teams.

Actions for Opsgenie #

Lucidum includes the following Actions for Opsgenie:

  • Create Alert. Send an alert from Lucidum to Opsgenie. Opsgenie will deliver the alert according to its policies.

Actions for Rapid7 #

Lucidum includes the following Actions for Rapid7:

  • Create a New List of IPs/Hosts for Scanning. Send a list of IPs/host names to Rapid7 for scanning.

Actions for ServiceNow #

Lucidum includes the following Actions for ServiceNow:

  • Create ServiceNow Assets (IRE API). Creates one or more new configuration items (CIs) in ServiceNow.

  • Create/Update ServiceNow Assets (IRE API). Creates one or more new configuration items (CIs) in ServiceNow. If the one or more of the CIs already exist, this action updates the existing CIs.

Actions for Slack #

Lucidum includes the following Actions for Slack:

  • Post on Slack. Sends data (outputfields) from the specified records (from the base query) to a slack channel.

Actions for Snowflake #

Lucidum includes the following Actions for Snowflake:

  • Send Data. Sends a custom set of Lucidum data to SnowFlake.

Actions for Splunk #

Lucidum includes the following Actions for Splunk:

  • Send Data. Sends a custom set of Lucidum data to Splunk.

Actions for Sumo Logic #

Lucidum includes the following Actions for Sumo Logic:

  • Send Data. Sends a custom set of Lucidum data to Sumo Logic.

Actions for Tenable Vulnerability Management #

Lucidum includes the following Actions for Tenable Vulnerability Management:

  • Send to Tenable Vulnerability Management Assets. Sends a custom set of Lucidum data to Tenable Vulnerability Management to import as assets.

  • Launch Tenable Vulnerability Management Scan. Launches a scan in Tenable Vulnerability Management with a specified list of assets.

  • Add to Tenable Vulnerability Management Target Group. Adds a list of assets to a target group in Tenable Vulnerability Management . A target group includes a list of targets to scan.

Webhooks #

Lucidum allows you to create custom actions using webhooks.

Workflow for Creating Configurations and Actions in Lucidum #

Create a New Configuration #

To create a new configuration:

  1. Choose Actions from the left pane.

  2. In the Actions page, click on an icon in the right pane.

  3. To create a configuration for the action, click the Configuration (gear) icon in the upper left. A configuration provides the connection and authorization information to communicate with the external solution.

  4. In the Manage Action Configurations page, you can either click the Add Configuration icon (plus sign) or edit the Default configuration by clicking the Edit icon (pencil).

  5. In the Manage Action Configurations page, supply values in the fields.

  6. Save the configuration.

  7. Click the Configuration (gear) icon.

  8. In the Manage Action Configurations page, find your new configuration. Click its Test icon (page with checkmark) to test authentication and the connection.

Create a New Action #

To create a new action:

  1. Choose Actions from the left pane.

  2. In the Actions page, click an icon in the right pane.

  3. To create an action, click the Create New Action (+) icon in the Configure Actions pane. An action specifies the task to execute, the data to include in the action, and how frequently to execute the action.

  4. Lucidum displays the Add a New Action page.

  5. Provide values in each page and click the Next (>) icon.

  6. Save the action.

  7. Lucidum automatically sets the action the Enabled. You can disable the action using the enable/disable toggle in the Configured Actions pane.

  8. Lucidum automatically tests the action when you save it and automatically executes the action at the time and recurrence you defined in the action.

You can apply an existing configuration to more than one action. If a configuration already exists, you might be able to re-use the existing configuration and might not need to create a new one.

Workflow Using Clone to Create a New Action #

  1. Choose Actions from the left pane.

  2. In the Actions page, choose from the action types in the Categories pane or click on an icon in the right pane.

  3. To clone an action, in the Configured Actions pane, find the action you want to clone and click the clone icon (two pages). An action specifies the task to execute, the data to include in the action, and how frequently to execute the action.

  4. Lucidum displays the Clone Action page.

  5. Provide a new name in the Action Name field.

  6. Edit one or more values in one or more pages and click the Next (>) icon.

  7. Save the action.

NOTE: Save is not enabled until you provide a new name for the action.

  1. Lucidum automatically sets the action the Enabled. You can disable the action using the enable/disable toggle in the Configured Actions pane.

  2. Lucidum automatically tests the action when you save it and automatically executes the action at the time and recurrence you defined in the action.

NOTE: You can apply an existing configuration to more than one action. If a configuration already exists, you might be able to re-use the existing configuration and might not need to create a new one.

Alternative Workflow for Creating an Action #

You can also create an action when viewing the results of a query. To do this:

  1. Create a query from the Query button. For details, see the chapter on Creating Queries.

  2. Click the Show Results (checklist) icon to open the Query Result page

  3. The Query Results page displays a the results of query.

    query_results_updated.png

  4. In the Query Results page, click the Create a recurring action (arrows) icon.

  5. In the Send to Actions page, select an action type.

    query_to_action_updated.png

  6. Lucidum displays the Create a New Action page, with the query already loaded in the Filters page.

    query_to_action2_updated.png
  7. Follow the steps in the section on Creating an Action. You can skip the steps about defining Filters, because the filter is now populated.

Workflow for Editing a Configuration #

To edit an existing configuration , follow these steps:

  1. Choose Actions from the left pane.

  2. In the Actions page, click an icon in the right pane.

  3. To create a configuration for the action, click the Configuration (gear) icon in the upper left. A configuration provides the connection and authorization information to communicate with the external solution.

  4. In the Manage Action Configurations page, find the configuration you want to edit and click its Edit (pencil) icon.

    manage_action_configurations_edit.png

  5. You can edit one or more fields in the configuration.
  6. Click Save to save your changes.

Workflow for Editing an Action #

To edit an existing actions, follow these steps:

  1. Choose Actions from the left pane.

  2. In the Actions page, choose from the action types in the Categories pane or click on an icon in the right pane.

  3. In the Configured Actions pane, find the action you want to edit. Click its Edit (pencil) icon.

    actions_configured_actions_pane_edit_15.0.png

  4. You can edit fields in the General page, the Filters page, the Schedule page, or the Details page.

  5. Click the Save Profile (disc) icon to save your changes.

Viewing Status of an Existing Action and Executing an Action On-Demand #

To view information about an existing action:

  1. Choose Actions from the left pane.

  2. In the Actions page, click an icon in the right pane.

  3. The Configured Actions pane displays information about the status of each action and provides options to execute the action on-demand:

actions_configured_actions_status2_15.0-update3.png

  1. Red toggle icon. Action is enabled and has errors.
  2. Green toggle icon. Action is enabled and does not have errors.
  3. Gray toggle icon. Action is disabled.
  4. Orange toggle icon. Action is currently executing.
  5. Red Last Run Time. Action had errors during last run.
  6. Blue Next Run Time. Action is scheduled to run in the future.
  7. Green Last Run Time. Action executed successfully during last run.
  8. Orange Last Run Time. Action is currently executing.
  9. Airplane icon. Executes the action on-demand (now).

Action Logs #

You can view general logs and detailed logs about each Lucidum actions.

To view these logs:

  1. Choose Actions from the left pane.

  2. In the Actions page, click an icon in the right pane.

  3. In the Configured Actions pane, select the View Logs icon.

  4. The Action Logs modal page appears:

    action_logs.png

  5. The Action Logs modal displays:

    • Status. Specifies whether the last execution of the action was successful (green) or failed (red).

    • Triggered At. The date and time the action was last triggered.

    • Records. Number of records included in the action.

    • Actions. Download the log file for the last execution of the action.

  6. To download a detailed log file for an execution of the action, click on the download icon in the Actions column.

  7. Lucidum downloads a .csv file to your local computer. The .csv file includes the payload for the action. You specify this payload in the Output Fields field of the action.

  8. An example log file looks like this:

    csv_log_download.png

    • This action found nine assets that match the Filter in the Filters page.

    • For each of those assets, the action sent the values from the fields specified in Output Fields in the Details page to Tenable Vulnerability Management . In our example, the fields in the payload are Data Sources, First Time Seen, IP Address, Last Time Seen, Lucidum Asset Name, and Lucidum User Name.

Action Limits in Lucidum #

  • Each action can include up to 5,000 records.

  • You can trigger actions to run as frequently as every 5 minutes.

What are your Feelings

Quick LInks

Linkedin Youtube X-twitter Facebook

@ 2025 Lucidum, Inc. Design By Sandman Studios

SOLUTIONS

COMPANY

RESOURCES

Solutions

COMPANY

Resource Library