Integration Triggers
Overview
Section titled “Overview”Integration Triggers start an automation outside the usual incident response flow: when an external system calls AIR, when a schedule becomes due, or when an integration finishes syncing.
| Trigger | Starts when… |
|---|---|
| HTTP Request | An external system, such as a SIEM, SOAR platform, or script, sends an HTTP request to the automation’s trigger URL. |
| Scheduler | A schedule you define becomes due: hourly, daily, weekly, monthly, or based on a custom cron expression. |
| TAXII Feed Synced | A TAXII feed finishes syncing indicators and generating Hunt/Triage rules. |
| Git Repository Synced | A Git repository finishes syncing files and generating Hunt/Triage rules. |
These triggers are not tied to a single asset. Each time they fire, AIR evaluates the target scope and creates one execution per matching asset (fan-out). See Asset targeting.