What are Actions?

An Action (or Correlation Action) initiates a response to Correlated Events created by Correlation Rules (see How does Event Correlation work?). Table 31 defines each type of Action. For more information, see Working with Actions.

Table 31. Types of Actions

Type

Description

Email

Sends an email notification to specified recipients.

Notification

Creates a Notification in the Notifications dialog of the TLC Console (see Working with Notifications).

Script

Runs a Windows command.

Note: To create a new Script Action, you must first create an executable file (e.g., an EXE or BAT file) for the script to be run by the Action.This file must be saved in the Scripts directory on your Primary Manager. By default, this path is:

<TLC_Manager_install_dir>\Scripts

Where <TLC_Manager_install_dir> is the installation directory for TLC Manager.

To ensure the integrity of your scripts, TLC creates and saves a SHA1 hash for each of your executable files. If a Script Action runs, but the executable file's hash differs from the stored hash, TLC will not run the script.

Syslog

Sends a Syslog message to a specified Syslog server.