Technical Reference
Post-alert Action Example
Standardize enrichment, notification, temporary blocking, and support-ticket actions after an alert.
IP, user, device, and license values on this page are anonymized.
incident: VPN_BRUTE_FORCE actions: 1. enrich source.ip with country/asn/last_seen 2. notify admin and customer contact 3. apply temporary block only when policy allows 4. open support ticket with anonymized evidence