Integrations
Overview
Section titled “Overview”Integration actions send information out of AIR. Use them to notify people and to pass data to the tools your team already uses.
| Action | Description |
|---|---|
| Send Slack Message | Posts a message to a Slack channel or user. |
| Send Email | Sends an email through the Console’s SMTP settings. |
| Send HTTP Request | Calls any HTTP or HTTPS endpoint, such as webhooks, ticketing systems, SOAR platforms, or your own APIs. |
| Send to SIEM | Sends a CEF event over syslog to a SIEM. |
Common behavior
Section titled “Common behavior”All Integration actions share the following behavior:
- Their text fields (message, subject, URL, body, and headers) accept expressions, so you can include asset details, results of earlier steps, and variables, for example
{{targetAsset.name}}or{{variables.WEBHOOK_HOST}}. - Secrets such as tokens are not entered in the action. Instead, you store them as encrypted variables and select them as a credential.
- They have a Test button. A test sends a real message or request to the destination, with every expression replaced by the word
test. - The step finishes as soon as the destination accepts the message. If the destination rejects the message or cannot be reached, the step fails, and the execution fails with it.