Cavelo Trigger

Trigger workflows on new Cavelo security events

Cavelo Trigger

AI-generated

Summary

Trigger workflows based on new Cavelo security events of three types: new vulnerabilities, new PII discoveries, or new access audit events, with configurable filtering and polling intervals.

Inputs

  • Trigger Type (required) — Select the type of security event to trigger on: new vulnerabilities, new PII discoveries, or new access audit events.
  • Polling Interval (minutes) (required) — Set how often (in minutes) the node checks for new events.
  • Severity Threshold — For 'New Vulnerabilities' trigger type, filter vulnerabilities by severity: All, High and Critical (CVSS >= 7.0), or Critical only (CVSS >= 9.0).
  • Hostname Filter — For 'New Vulnerabilities', filter results by hostname patterns supporting wildcards.
  • Agent UUIDs — For 'New Vulnerabilities', comma-separated list of agent UUIDs to monitor.
  • PII Classifications — For 'New PII Discoveries', select types of PII to monitor (e.g., SSN, Credit Card, Email).
  • High-Risk PII Only — For 'New PII Discoveries', restrict triggering to only high-risk PII types (SSN, Credit Card, Bank Account). Defaults to true.
  • Actions to Monitor — For 'New Access Audits', select actions to monitor (Delete, Download, Copy, Share, or All).
  • Suspicious Activity Only — For 'New Access Audits', limit triggering to suspicious access patterns only, such as risky actions, off-hours access, or failed attempts. Defaults to true.
  • Off-Hours Only — For 'New Access Audits', restrict triggering to events occurring outside business hours (9 AM - 5 PM, Monday to Friday). Defaults to false.

Output shape

a list of event objects matching the configured trigger type and filters

Returns new events detected since the last poll interval; includes enriched fields such as severity labels for vulnerabilities, risk scoring and suspicious flags for access audits, and days since discovery. Events are deduplicated to avoid repeats. Polling respects the configured interval and returns no events if run too soon.

Examples

Example 1: Trigger on new high or critical vulnerabilities every 15 minutes, filtered by agent UUIDs

Trigger Type = New Vulnerabilities; Severity Threshold = High and Critical; Agent UUIDs specified

Example 2: Trigger on new discoveries of SSN and Credit Card PII, high-risk only

Trigger Type = New PII Discoveries; PII Classifications = ['SSN','Credit Card']; High-Risk PII Only = true

Example 3: Trigger on suspicious access audit events during off-hours

Trigger Type = New Access Audits; Suspicious Activity Only = true; Off-Hours Only = true

Discussion