Automatically perform tasks when a computer is added or changed

Event-based tasks let you monitor protected computers for specific events and perform tasks based on certain conditions.

Create an event-based task

In Workload Security, click Administration > Event-Based Tasks > New to open a series of dialogs containing steps for creating a new task. You are prompted for different information depending on the type of task.

Edit or stop an existing event-based task

To change the properties for an existing event-based task, go to click Administration > Event-Based Tasks. Select the event-based task from the list and click Properties.

Events to monitor

• Agent-Initiated Activation: An agent is activated using agent-initiated activation.
• IP Address Changed: A computer has begun using a different IP.

Conditions

You can require specific match conditions to be met in order for a task to be carried out. For example, you might require an AWS tag of ProductionSystem to be present in an Amazon EC2 instance in order for the Activate Computer action (see Actions) to occur on it.

When adding conditions:

• Click the plus button to add multiple conditions. In a multi-condition setup, all conditions must be met for the action to be carried out.
• Use Java regular expression syntax (regex). For examples, see Java regex examples. For details on regex, see Class pattern.

List of conditions and descriptions of each

• Cloud Instance Image ID: AWS cloud instance AMI ID.

This match condition is only available for AWS cloud instances.

• Cloud Instance Metadata: The metadata being matched corresponds to AWS tags, Azure tags, or GCP labels that have been added to your AWS, Azure, or GCP instances.

This match condition is only available for AWS instances, Azure VMs, and GCP VMs added to Deep Security Manager through Computers > Add > Add AWS Account, Computers > Add > Add Azure Account, or Computers > Add > Add GCP Account. Metadata currently associated with a computer is displayed on the Overview page in its editor window. To define the conditions to match, you must provide two pieces of information: the metadata key and the metadata value. For example, to match a computer that has a metadata key named AlphaFunction that has a value of DServer, you would enter AlphaFunction and DServer. If you wanted to match more than one possible condition, you could use regular expressions and enter AlphaFunction and .*Server, or AlphaFunction and D.*

• Cloud Instance Security Group Name: The security group the cloud instance applies to.

This match condition is only available for AWS cloud instances.

• Cloud Account Name: The Display Name field in the Cloud Account properties window.
• Cloud Vendor: The cloud environment vendor of the instance. This condition is used to match on instances from a specific cloud vendor.

Cloud Vendor only works if you added your cloud instances to the manager through Computers > Add > Add AWS Account, Computers > Add > Add Azure Account, or Computers > Add > Add GCP Account.

• Computer Name: The Hostname field in the computer properties window.
• GCP Network Tag: Network tags that have been added to GCP VMs.

If the GCP VM has multiple GCP network tags, and a match is found on any one of them, the VM is considered as matched.

• Platform: The operating system of the computer.

Java regex examples

Depending on the source of the new computer, some fields may not be available. For example, Platform would not be available for computers added as a result of the synchronization with an Active Directory.

Actions

The following actions can be taken depending on which of the events are detected:

• Activate Computer: Workload Security protection is activated on the computer.
  • Delay activation by (minutes): Activation is delayed by a specified number of minutes.
• Deactivate Computer: Workload Security protection is deactivated on the computer.
• Assign Policy: The new computer is automatically assigned a policy. The computer must be activated first.
• Assign Relay Group: The new computer is automatically assigned a relay group from which to receive security updates.
• Assign to Computer Group: The computer is placed in one of the computer groups on the Computers page.

Order of execution

When using event based tasks, you should create and use conditions that are unique to each task. This is because when identical conditions are encountered, Workload Security processes them in a specific order, and this order does not take into account the number of conditions within a task to rank said tasks against each other.

For example, if the server01.example.com computer on a Windows Server 2012 platform encountered the following event-based tasks:

The event-based task with more conditions is not automatically executed first. Instead, the Platform condition is matched twice, and the event-based tasks are executed based on the name of the task.

To avoid unexpected results, use a specific naming convention for your event-based tasks, such as CamelCase.

Temporarily disable an event-based task

To prevent an existing event-based task from running, right-click it and then click Disable . For example, you may want to temporarily disable an event-based task while you perform certain administrative duties during which you do not want any activity to occur.

To re-enable an event-based task, right-click it and then click Enable.