Configure entity actions

Entity actions in Exposure Analytics let you automate actions based on the output of discovery filters, posture metrics, and profile rules. They help proactively address security issues and contextual risks, remediate security gaps, and reduce the entity attack surface.

Examples of entity actions include:

• Pushing unmanaged assets to ServiceNow for onboarding and management.

• Creating tickets to address vulnerability scanning gaps on critical servers.

• Sending workstations without endpoint security to SOAR for automated remediation.

Entity actions are triggered by conditions. A condition is linked to one of the following:

• A saved entity discovery filter.

• An entity posture metric.

• An entity posture matrix filter.

• An entity profile rule.

Each condition returns a set of entities that can be acted on. For example, a posture metric condition returns entities with a gap in that metric, while a profile rule condition returns entities that triggered the rule.

Each entity action has one condition and can include multiple actions. Available actions are based on Splunk alert actions. Splunk includes several alert actions by default, and additional actions are available on Splunkbase.

The following table outlines the steps to configure entity actions.