16.2 Action Manager

The Action Manager allows you to configure repeatable actions that can be executed in various contexts throughout the Sentinel system. The Action Manager allows you to configure the following types of actions:

Configure a Correlated Event
Add to Dynamic List
Remove from Dynamic List
Execute a Command
Send an Email
Create an Incident
Execute JavaScript Action Plugins

NOTE:Except for JavaScript Actions, the Actions above can only be used in the context of a correlation rule deployment. For more information about correlation-only actions, see the Correlation section. This section focuses exclusively on JavaScript Action plugins and Actions.

Using the Action Manager you can import, create, and manage Action plugins (.zip files) and configure specific Action instances.

16.2.1 Permissions for Using Action Plugins

To use Action Plugins, a user must be assigned the necessary permissions in the User Manager. By default these permissions are assigned to esecadm.

To grant permissions for the Action Plugins:

Log into the Sentinel Control Center as a user with permissions to use the User Manager.
Go to the Admin tab.
Open the User Configuration folder.
Open the User Manager window. Double-click the desired user. The User Details window displays.
Click the Permissions tab.
Select View Actions, Manage Actions, or Manage Action Plugins (which will automatically select all child permissions). The new permissions will be applied the next time the user logs in. For more information, see Sentinel Control Center User Permissions in Sentinel 6.1 Reference Guide.