Event Actions

overview event actions represent what happens when an event is raised actions are specific to a rule set and the role that rule set is associated with in other words, 2 different sets of agents can have 2 different sets of actions take place for the same event there are 3 common sets of event actions used with a given event which increase in aggressiveness based on the desired handling of the event just log the event for viewing by the supervisor and reporting purposes (inserttodb) log the event and put the agent's windows screen to sleep (inserttodb + lockscreen) log the event, lock the agent's screen, and require a one time passcode/otp to be entered (inserttodb + blackout) managing event actions once you have accessed remote security rules and selected the desired role, click on the event action tab for more info on getting to this point, see remote security rules docid\ mxqk0wmz iye61wlioe2h this page contains a list of all configurable events on your system to manage the actions for a specific event, click on the arrow at the left end of the event to add a new action to that event, click on "add new action record" to modify an existing action, click on the pen button to the left of the existing action to remove an action from an event, click on the trash can to the left of the existing action event action settings when you add a new or edit an existing event action, the following window will appear name represents the type of action to take there are 4 types of actions report logging of the event screenblocker putting the screen to sleep or locking it monitorprocesses killing a detected application/process clipboardmonitor clearing the clipboard enable check this box to enable the action state for secure work from home actions, this can always be set to "na" trigger action there are 6 actions which are used by secure work from home (with there associated name/action type in parens) inserttodb (report) log the action to the database for viewing / reporting lockscreen (screenblocker) put the agent's screen to sleep blackout (screenblocker) lock the agent's screen and require a one time passcode (otp) be entered releaseblackout (screenblocker) release the blackout this can be used in conjunction with the networkconnectiondetected event in case a blackout was implemented on networkdisconnectiondetected kill (monitorprocesses) kills the specified process (see arguments ) restartcamera (screenblocker) used with the camerablockdetected event to restart the camera should a usb camera be plugged / unplugged clearclipboard (clipboardmonitor) clears the clipboard count number of additional times the event must be detected in duration seconds for this action to be taken count = 1 or 0 perform this action the 1st time this event occurs (duration not used) count = 1 perform this action the 2nd time this event occurs within duration seconds count = 2 perform this action the 3rd time this event occurs within duration seconds and so on for 3, 4, 5, etc duration represents seconds used in conjunction with count above arguments currently only used with the "kill" trigger action to specify the process to be killed message type not currently used message text not currently used modify reason used for change auditing purposes required when an existing event action is modified