- Edit
- Clone ( as linked copy )
- Run
- Export
- Get Code Defined
- Saved Snapshots
- Statistics
- Edit with Model Editor
- Security Settings
- Revision History
- Get URL Link
- Reset
- Delete
- Edit
- Connect Flow
- Clone ( as linked copy )
- Edit with Model Editor
- Security Settings
- Revision History
- Get URL Link
- Delete
- 
											Action General purpose action object that can be used to set variables and define flow logic. 
- 
											AD Add User to Group Add a defined user as a member of a defined group. 
- 
											AD Asset Discovery Discover assets within an Active Directory. 
- 
											AD Create Group Create a new group within Active Directory. 
- 
											AD Create User Create a new user within Active Directory. 
- 
											AD Delete User Delete a user account within Active Directory. 
- 
											AD Disable User Disable an enabled user within Active Directory. 
- 
											AD Enable User Enable a disabled user account. 
- 
											AD Remove User from Group Remove a user from an AD group. 
- 
											AD Reset User Password Reset the password for a given user within Active Directory. 
- 
											AD Search Search for objects within Active Directory based on an LDAP search filter. 
- 
											AD Set Account Expiry Defines an account expiry from an epoch provided value. 
- 
											AD Set Object Attribute Sets an attribute value on a given object. 
- 
											Asset Delete Delete 1 or more assets. 
- 
											Asset Match Find assets that match key/value within a specified time-frame. 
- 
											Asset Search Search and return assets that match a mongo style search syntax. 
- 
											Asset Search Trigger Search and return assets that match a mongo style search syntax. 
- 
											Asset Update Create/Update an asset within the asset management solution. Asset names are unique per entity. 
- 
											AWS Boto3 Change Client Changes the current boto3 client. 
- 
											AWS Boto3 Change Resource Changes the current boto3 resource. 
- 
											AWS boto3 Client Function Access and call a boto3 client function. 
- 
											AWS boto3 Connect Connect to a AWS regional service and defined boto3 client and/or resource. 
- 
											AWS boto3 Disconnect Disconnect from the connected AWS boto3 client and resource. 
- 
											AWS boto3 Resource Function 
- 
											AWS EC2 Attach Volume Attaches a volume to an instance. 
- 
											AWS EC2 Connect Connect to a AWS regional EC2 service. 
- 
											AWS EC2 Create Custom Instance Create a new EC2 instance by providing boto3 create instance parameters. This actions allow you to define more advance instances and access all available options. 
- 
											AWS EC2 Create Instance Creates a new EC2 AWS instance. 
- 
											AWS EC2 Create Instance Image Create an instance image and register it as an AMI. This process will snapshot all attached volumes and automatically provision the AMI. 
- 
											AWS EC2 Create Instance Snapshot Create a full instance snapshot of an EC2 instance and all attached disks. 
- 
											AWS EC2 Create Snapshot Create a snapshot of a volume. 
- 
											AWS EC2 Create Tags Create EC2 tags and attach them to a resource by ID. 
- 
											AWS EC2 Delete Instance Image Deletes an instance image with the option of also removing any unused associated snapshots. 
- 
											AWS EC2 Delete Snapshot Deletes an AWS EC2 snapshot by snapshot ID. 
- 
											AWS EC2 Delete Tag Delete a tag by key and value. 
- 
											AWS EC2 Delete Tags Deletes selective tags from a target resource ID. 
- 
											AWS EC2 Delete Volume Deletes an EC2 volume by volume ID. 
- 
											AWS EC2 Detach Volume Detached a volume from an instance. 
- 
											AWS EC2 Disconnect Disconnect from the connected AWS EC2 service. 
- 
											AWS EC2 Get Image Retrieve data about a image using a image ID. 
- 
											AWS EC2 Get Instance Gets an instance based on the instance ID. 
- 
											AWS EC2 Get Password Gets password data for a given EC2 instance. 
- 
											AWS EC2 Get Snapshot Retrieve data about a snapshot using a snapshot ID. 
- 
											AWS EC2 List Instances Lists found instances which can be filtered based on a defined filter. 
- 
											AWS EC2 List Snapshots Lists found snapshots which can be filtered based on a defined filter. 
- 
											AWS EC2 List Volumes Lists found volumes which can be filtered based on a defined filter. 
- 
											AWS EC2 Register Image Registers a new AMI. 
- 
											AWS EC2 Start Instance Start an AWS EC2 instance. 
- 
											AWS EC2 Stop Instance Stop an AWS EC2 instance 
- 
											AWS EC2 Terminate Instance Terminates an AWS EC2 instance. 
- 
											AWS Lambda Connect Connect to a AWS regional Lambda service. 
- 
											AWS Lambda Disconnect Disconnect from the connected AWS Lambda service. 
- 
											AWS Lambda Invoke Invoke a AWS Lambda defined function. 
- 
											AWS S3 Append Content Append to the bottom of an existing AWS S3 object. 
- 
											AWS S3 Delete Delete AWS S3 object 
- 
											AWS S3 Download Object Download an object an AWS S3 bucket. 
- 
											AWS S3 Get Object Content Return a contents of an AWS S3 object 
- 
											AWS S3 Get Object Head Get AWS S3 object head 
- 
											AWS S3 List List objects contained within an AWS S3 bucket. 
- 
											AWS S3 Put Content Create a new AWS S3 object from data provided 
- 
											AWS S3 Upload File Upload a file to AWS S3. 
- 
											AWS Secrets Manager Connect Connect to a AWS regional Secrets Manager service. 
- 
											AWS Secrets Manager Create Secret Create a new AWS secret within AWS Secrets Manager. 
- 
											AWS Secrets Manager Create Tags Creates tags on the defined secret. 
- 
											AWS Secrets Manager Delete Secret Deletes a secret from AWS Secrets Manager. 
- 
											AWS Secrets Manager Delete Tags Deletes the defined list of tags from a secret. 
- 
											AWS Secrets Manager Describe Secret Get detailed information about a secret but without retrieving the secret data 
- 
											AWS Secrets Manager Disconnect Disconnect from the connected AWS Secrets Manager service. 
- 
											AWS Secrets Manager Generate Password Generates a random password using the AWS Secrets Manager password generator function. 
- 
											AWS Secrets Manager Get Secret Returns a secret's key/values. 
- 
											AWS Secrets Manager Get Secret Value Returns a given secret value in encrypted or plaintext format. 
- 
											AWS Secrets Manager List Secrets Lists secrets found within the AWS secrets manager service. 
- 
											AWS Secrets Manager Rotate Secret Request AWS to rotate the given secrets value. 
- 
											AWS Secrets Manager Update Secret Updates the key/value secret data within an AWS secret. 
- 
											Break Exits out of a loop or subFlow. 
- 
											Choice Pause a flow and await user response before continuing. 
- 
											ClickSend SMS Send an SMS message to a recipient. 
- 
											ClickSend Voice Send an voice message to a recipient. 
- 
											Collect Build events into a list based on the size limited provided. Once the list is built the collect object passes the list of events onto the next object. 
- 
											Concurrent Run several flow paths concurrently 
- 
											Control-M Connect Creates a connection handler for Control-M REST API Service, once connected other actions can be used without the requirement of providing credentials on all actions 
- 
											Control-M Custom Request Execute a call to a given API endpoint. 
- 
											Control-M Get Events Get a list of recent events. 
- 
											Control-M Get Job Get a job and its details. 
- 
											Control-M Get Job Log Get the job log. 
- 
											Control-M Get Job Output Get job output. 
- 
											Control-M Get Job Statistics Get job statistics. 
- 
											Control-M Get Job Status Get the status of a job. 
- 
											Control-M Get Jobs By Status Get jobs by a job status i.e. 'Ended Not OK' 
- 
											Control-M Job Delete Delete a job. 
- 
											Control-M Job Free Free a job. 
- 
											Control-M Job Hold Hold a job. 
- 
											Control-M Job Kill Kill a job. 
- 
											Control-M Job Rerun Rerun a job. 
- 
											Control-M Job Run Now Run a job now 
- 
											Control-M Job Undelete Undelete a job. 
- 
											Control-M Job Wait Info Get job wait info. 
- 
											Control-M Logout Close an existing open Control-M API Service connection. 
- 
											Control-M Set Job Confirm Confirm a job. 
- 
											Control-M Set Job Ok Mark a job as OK. 
- 
											Control-M Update Alert Update details of an alert. 
- 
											Control-M Update Alert Status Update the status of an alert. 
- 
											Create Data Snapshot Create a snapshot of the data within a flow for future review. 
- 
											Create Secret Create a new A-Ops secret 
- 
											Data Trigger A trigger that contains a static user defined list of events. 
- 
											Database Connect MSSQL Connect to a MSSQL Database. 
- 
											Database Connect Oracle Connect to an Oracle Database. 
- 
											Database Connect PostgreSQL Connect to a PostgreSQL database. 
- 
											Database Delete Perform a delete query against a connected database. 
- 
											Database Disconnect Disconnect from any connected database. 
- 
											Database Insert Perform a insert query against a connected database. 
- 
											Database Search Perform a search query against a connected database. 
- 
											Database Update Perform an update query against a connected database. 
- 
											dataIngest 
- 
											Disable Action Disables an existing action by ID. 
- 
											Disable Trigger Disables an existing trigger by ID. 
- 
											DNS Twister Fuzz Returns a list of fuzzed domains from the domain provided. 
- 
											DNS Twister Google Safe Browsing Returns the current Google safe browsing system of the provided domain. 
- 
											DNS Twister IP Resolution Resolve an IP address from a domain. 
- 
											DNS Twister Observe Monitor and report on changes to a given list of domains. The domains use DNS Twister fuzzing to help detect phishing domains. 
- 
											DNS Twister Parked Check Checks if the domains is a parked domain. 
- 
											DNS Twister Report Returns the DNS Twister report of a given domain. 
- 
											DNS Twister WHOIS Gets WHOIS information using the DNS Twister API. 
- 
											Echo Echos a message into the action output. 
- 
											Email Action that provides the ability to send SMTP emails via a SMTP relay. 
- 
											Enable Action Enables an existing action by ID. 
- 
											Enable Trigger Enables an existing trigger by ID. 
- 
											Event Build Correlations Build and updates event correlations. 
- 
											Event Get Correlation Get a correlation from UID string. 
- 
											Event Get Correlations Get a list of correlations based on the provided criteria. 
- 
											Event Threshold Trigger that returns matching correlations based on the defined fields. 
- 
											Event Update Updates a value on an existing event by index. 
- 
											Event Update Score Updates the score on an existing event by index. 
- 
											Execute Trigger Executes a trigger immediately 
- 
											Exit Exits the currently running trigger. 
- 
											Extract Regular expression extraction of a given string. 
- 
											Foreach Loop over a data list of json events. 
- 
											FortiGate Command Execute and receive output from a given command. 
- 
											FortiGate Connect Connect to FortiGate firewall over SSH 
- 
											FortiGate Disconnect Disconnects from an active FortiGate connection. 
- 
											FortiGate Script Execute a defined FortiGate script on the connected firewall. 
- 
											fortiManager Connect Connect to a fortiManager instance. Required before calling any other fortiManager integration objects. 
- 
											fortiManager Get ADOMs List ADOMs present on the fortiManager 
- 
											fortiManager Get Object Return a given object. 
- 
											fortiManager Get Objects Get a list of object by object type 
- 
											fortiManager Set ADOM Change which ADOM is currently being used. 
- 
											fortiManager Set Object Update a fortiManager object 
- 
											FTP Connect Connect to an FTP server 
- 
											FTP Disconnect Closes FTP active session 
- 
											FTP Storbinary Store File to an FTP server 
- 
											ftpRetrieve Retrieve File from an FTP server 
- 
											Fuzzy Match Distance Compares two strings for likeness based on a Levenshtein Distance score. 
- 
											Fuzzy Match String Compares two strings for likeness 
- 
											Generate Password Randomly generate a password string. 
- 
											Geolocate IPv4 Return geolocation data about a given IPv4 address. 
- 
											Get Action Get a given action's details. 
- 
											Get Google Sheet Read and return a Google Docs Sheet 
- 
											Get Trigger Get a given trigger's details. 
- 
											Global Get Retrieve global variable by name. 
- 
											Global Set Sets a global variable that can be later retrieved with the globalGet object. 
- 
											GLPI Complete Task Mark a task as completed. 
- 
											GLPI Connect Connect to a GLPI instance. 
- 
											GLPI Due Tasks Search for tasks that are due or overdue for a given user. 
- 
											GLPI Followup Add a new followup to an existing ticket. 
- 
											GLPI Search Search across the GLPI platform. 
- 
											GLPI Solve Solve a ticket. 
- 
											GLPI Task Create/Update a task within an existing ticket. 
- 
											GLPI Ticket Create a new ticket within the GLPI ticketing system. 
- 
											GLPI Ticket Detail Get the details of a ticket by ticket ID. 
- 
											GoDaddy Connect Connect to a GoDaddy API service using key and secret. This object can be used to start a connection that is then used by other GoDaddy objects within a flow. 
- 
											GoDaddy Delete DNS Record Delete a DNS record of a specified type from a specified domain you own. 
- 
											GoDaddy Get DNS Record Get a DNS record of a specified type from a specified domain you own. 
- 
											GoDaddy Update DNS Record Update a DNS record of a specified type from a specified domain you own. 
- 
											Google Chat Send Message Sends a message via a Google Chat incoming webhook. 
- 
											Google Sheet Get Range Get a list of values from a Google Docs sheet using a range i.e. A:B 
- 
											Google Sheet Insert Inserts into an existing Google Docs sheet at a provided position i.e. A1 
- 
											Google Sheet Update Cell Updates a cell with a provided value 
- 
											Google Sheets Connect Create a Google Docs service connection that can then be used to interact with sheets shared with the service user 
- 
											IBM Cloud Client Function Access and call an IBM VPC Python SDK client function. 
- 
											IBM Cloud Connect Create an API session with IBM Cloud so that subsistent IBM Cloud actions can be executed. 
- 
											IBM Cloud Create Instance Create a new VPC instance within IBM Cloud. 
- 
											IBM Cloud Create Instance From Snapshot Create a new VPC instance from an existing snapshot within IBM Cloud. 
- 
											IBM Cloud Create VPC Create a new VPC within IBM Cloud. 
- 
											IBM Cloud Create VPC Instance Volume Snapshot Create a new snapshot for a given volume. 
- 
											IBM Cloud Create VPC IPv4 Subnet Create a new IPV4 Subnet within IBM Cloud. 
- 
											IBM Cloud Create VPC Network Prefix Create a network super-net prefix within a VPC. 
- 
											IBM Cloud Delete Instance Delete a VPC instance within IBM Cloud. 
- 
											IBM Cloud Delete VPC Delete a VPC from your IBM Cloud environment. 
- 
											IBM Cloud Delete VPC Instance Volume Delete an instance volume within IBM Cloud. 
- 
											IBM Cloud Delete VPC Instance Volume Snapshots Delete all snapshots for a given volume within IBM Cloud. 
- 
											IBM Cloud Delete VPC Snapshot Delete snapshot for a given snapshot ID within IBM Cloud. 
- 
											IBM Cloud Delete VPC Subnet Delete a subnet within a VPC in IBM Cloud. 
- 
											IBM Cloud Get VPC Get a single VPC by ID or when no ID is provided return all VPCs within your IBM Cloud Account. 
- 
											IBM Cloud Get VPC Instance Get details of an IBM Cloud VPC instance or list all VPC instances when no instance ID is provided. 
- 
											IBM Cloud Get VPC Instance Volume Get volume details of a given IBM Cloud VPC Instance, or list all volumes for a given instance when Volume ID is blank. 
- 
											IBM Cloud Get VPC Instance Volume Snapshot Get details of a volume snapshot or list all snapshots for a given volume when no snapshot ID is provided. 
- 
											IBM Cloud Get VPC Network Prefix Get IBM Cloud VPC super-net prefix. 
- 
											IBM Cloud Get VPC Subnet Get details of a given subnet or when no subnet is provided all subnets will be returned. 
- 
											IBM Cloud List VPC Region Zones List IBM Cloud VPC zones for a given region. 
- 
											IBM Cloud List VPC Regions List IBM Cloud VPC regions. 
- 
											IBM Cloud VPC Disconnect Disconnect from an IBM Cloud session made using IBM cloud Connect. 
- 
											IPStack Lookup IP Retrieve information about an IP. 
- 
											IPStack My IP Get your external IP address as seen by the IPStack service. 
- 
											jinja2 Format Render a template using a defined jinja2 template. 
- 
											Jira Custom Request Execute a Jira API call 
- 
											localConvertCSVToDict 
- 
											localDelete 
- 
											localExecute 
- 
											localPing 
- 
											localRead 
- 
											localWrite 
- 
											MongoDB Connect Connect to a MongoDB Database. 
- 
											MongoDB Find Execute a MongoDB find query. 
- 
											MS Defender Connect Make an API connection using Microsoft Graph API that can be used to interact with MS Defender. 
- 
											MS Defender Custom Request Execute a custom graph API request. 
- 
											MS Defender for Endpoint Custom Request Execute a custom Defender for Endpoint API request. 
- 
											MS Defender Get Alerts Execute a graph API request that retrieves alerts. 
- 
											MS Defender Get Incidents Execute a graph API request that retreives incidents. 
- 
											MS Defender Get New Alerts Execute a graph API request that retrieves new alerts. 
- 
											MS Defender Get New Incidents Execute a graph API request that retrieves new incidents. 
- 
											MS Defender Run Hunting Query Perform Advanced Threat Hunting in MS Defender with KQL Queries. 
- 
											MS Defender Run Hunting Query Trigger Perform Advanced Threat Hunting in MS Defender with KQL Queries. 
- 
											MSTeams Incoming Message Inbound webhook to read messages coming from the configured teams channel. 
- 
											MSTeams Post Message Post a message to a configured teams channel. 
- 
											netskopeActionGetAlerts 
- 
											netskopeActionGetEvents 
- 
											netskopeGetAlerts 
- 
											netskopeGetEvents 
- 
											Occurrence Action responsible for raising, updating and clearing alarm state based on a given match string UID. 
- 
											Occurrence Update Provides the ability to update variables held within the alarm objects data field. 
- 
											OneNote Add Bulk Content Inserts bulk content onto a OneNote page 
- 
											OneNote Add Content Base64 Image Inserts a base64 image onto the target page 
- 
											OneNote Add Content Image Inserts a image from URL src onto the target page 
- 
											OneNote Add Content Text Insert text content onto the target page. 
- 
											OneNote Add Content Website Render Inserts a rendered version of a given website into the target page. 
- 
											OneNote Add Notebook Section Creates a new section within the target notebook. 
- 
											OneNote Add Section HTML Page Create a new page with custom HTML within the target section. 
- 
											OneNote Add Section Page Creates a basic OneNote page within a target section. 
- 
											OneNote Connect Make an API connection using Microsoft Graph API that can be used to interact with OneNote hosted documents. 
- 
											OneNote Custom Request Execute a custom graph API request. 
- 
											OneNote Delete Notebook Section Deletes a target section within a OneNote document. 
- 
											OneNote Delete Page Deletes a page within a OneNote document. 
- 
											OneNote Get Page Content Retrieve the current OneNote page in HTML format. 
- 
											OneNote List Group Notebooks Lists accessible notebooks within a group that the target user has access to. 
- 
											OneNote List My Notebooks Lists the target users notebooks stored within their personal OneDrive. 
- 
											OneNote List Notebook Sections Lists all sections within a given notebook. 
- 
											OneNote List Section Pages Lists pages within a target section of a OneNote document. 
- 
											OneNote List Site Notebooks Lists accessible notebooks within a sharepoint site that the target user has access to. 
- 
											OpenSearch Custom Request Execute a custom OpenSearch request. 
- 
											OpenSearch Saved Search Search an Opensearch index using a Opensearch Dashboards saved search query. 
- 
											OpenSearch Saved Search Trigger Search an Opensearch index using a Opensearch Dashboards saved search query. 
- 
											OpenSearch Search Search an Opensearch index using a defined search query. 
- 
											OpenSearch Search Trigger Search an Opensearch index using a defined search query. 
- 
											Oracle Cloud Connect Connect to Oracle Cloud service. 
- 
											Oracle Cloud Function Calls an API function for the connected Oracle Cloud Service 
- 
											OTX Get Pulse Get a pulse by pulse ID. 
- 
											OTX Lookup CVE Retrieve CVE information from a given CVE. 
- 
											OTX Lookup Domain Retrieve domain information from a given domain. 
- 
											OTX Lookup Hash Retrieve hash information from a given hash. 
- 
											OTX Lookup Hostname Retrieve hostname information from a given hostname. 
- 
											OTX Lookup IPv4 Retrieve IPv4 information from a given IPv4 address. 
- 
											OTX Lookup IPv6 Retrieve IPv6 information from a given IPv6 address. 
- 
											OTX Lookup URL Retrieve URL information from a given URL. 
- 
											playbook Add Add an occurrence into a playbook. 
- 
											playbook Bulk Add Add multiple occurrences into a playbook. 
- 
											Playbook End Define the end of a playbook within a flow. 
- 
											Playbook Get Get a playbook occurrence item. 
- 
											Playbook Search Trigger for looping through playbooks and their occurrences. 
- 
											Playbook Search Action Search for occurrences within a playbook. 
- 
											Playbook Start Used to start a playbook for a provided playbook occurrence UID string. 
- 
											playbook Start Update Update a defined playbook start action by action ID. 
- 
											Playbook Update Data Update a playbooks occurrence. 
- 
											Proofpoint TR Add Incident Comment Add comment to a Proofpoint Threat Response incident 
- 
											Proofpoint TR Close Incident Close a Proofpoint Threat Response incident 
- 
											Proofpoint TR Get Incident Get Proofpoint Threat Response incident 
- 
											Proofpoint TR Get Incident Alerts Get alerts associated to a Add a Proofpoint Threat Response incident 
- 
											Proofpoint TR List Incidents List Proofpoint Threat Response incidents 
- 
											Proofpoint TR List New Incidents List Proofpoint New Threat Response incidents 
- 
											Queue Add Event Adds a new event to a queue. 
- 
											Queue Event Clear Manually remove an event from the queue. 
- 
											Queue Trigger Checks a given queue for new events that are ready to be executed. 
- 
											Raise Raise an exception. 
- 
											Raise Event Raise a new event based on the fields provided. 
- 
											Remote Command Execute a remote command on an already connected remote system. 
- 
											Remote Connect Aruba Initialize a connection to a remote Aruba system using SSH. 
- 
											Remote Connect Cisco Initialize a connection to a remote Cisco system using SSH. 
- 
											Remote Connect FortiGate Initialize a connection to a remote FortiGate system using SSH. 
- 
											Remote Connect Linux Initialize a connection to a remote linux system using SSH and SCP. 
- 
											Remote Connect Windows Initialize a connection to a remote windows system using WINRM and SMB. 
- 
											Remote Connect Windows PSExec Initialize a connection to a remote windows system using PSExec SMB. 
- 
											Remote Disconnect Disconnect from a remote connection. 
- 
											Remote Download Download a file from a remote connection and store it within storage. 
- 
											Remote Multi-Command Execute multiple commands on an already connected remote system. 
- 
											Remote Powershell Script Executes a powershell script on a remote windows host. 
- 
											Remote Reboot Execute a controlled reboot of an already connected remote windows or linux system. 
- 
											Remote Upload Upload a file from storage to a remote connection. 
- 
											Reset Trigger Resets a trigger based on the trigger ID defined within the event data. data[event][triggerID] is the key used when attempting to reset a trigger. 
- 
											Script Block Executes defined python code. 
- 
											Secure Secret Generate a secure string that can later be used with the getSecret() function to return the plaintext value. 
- 
											ServiceNow Custom Request Execute a Jira API call 
- 
											Set Action Updates a given field on an existing action object with the defined value. 
- 
											Set Trigger Updates a given field on an existing trigger object with the defined value. 
- 
											Sigma Rule Generate SIEM queries from Sigma rules 
- 
											Sigma Rule Trigger Generate SIEM queries from Sigma rules 
- 
											Sigma Rules File Trigger Generate SIEM queries from Sigma rules found within a given rule folder 
- 
											Sleep Sleep for a defined number of seconds before moving onto the next action within a flow. 
- 
											SNMP 
- 
											Snow Connect Connect to the SNOW Api 
- 
											Snow Get Item 
- 
											Snow Get Items 
- 
											Sophos Central Connect Create a connection handler for Sophos Central that can be used with other Sophos Central actions in a flow. 
- 
											Sophos Central Custom Request Send an API request to Sophos Central API endpoint that is not covered by other action objects. 
- 
											Sophos Central Get Alerts Returns alerts after the defined start time. 
- 
											Sophos Central Get Endpoint Gets data about a single endpoint as defined by the endpoint ID. 
- 
											Sophos Central Get Endpoint Software Links Get all the endpoint installer links for a tenant. 
- 
											Sophos Central Get Endpoints Return a list of Sophos Central endpoints, optionally a filter can be provided to filter the list of returned endpoints. 
- 
											Sophos Central List Tenants Returns a list of tenants for a given organization when Sophos Central is deployed in multi-tenant mode 
- 
											Sophos Central Set Tenant Change the current Sophos Central connection tenancy for use when using multi-tenant Sophos deployment. 
- 
											Sophos SIEM Alerts Collect SIEM alerts from Sophos Central. 
- 
											Sophos SIEM Events Collect SIEM events from Sophos Central. 
- 
											Storage Download Download and return the file path for a given storage file. 
- 
											Storage Trigger Load events from an existing storage file in csv, json or txt format. 
- 
											Storage Upload Upload a file to storage. 
- 
											Sub Flow Jump to another flow entry point using a defined trigger ID. SubFlow allows you to call flows as functions passing in and returning data so that flows can be easily reused. 
- 
											Sub Flow Return Exit a subFlow and return true/false as a result via the subFlowResult variable. 
- 
											Timed Time connected actions and output when completed the total time taken. 
- 
											Trigger General purpose trigger object that can be used to start a flow based on a timer or cron schedule. 
- 
											Try Except Try a portion of flow and handel error as an exception if it occurs. 
- 
											UnShorten Unshortens a provided short URL. 
- 
											Update Secret Update the value of a given A-Ops secret 
- 
											Vectra Custom Request Execute a Vectra API call 
- 
											ViewOnce Get Get the ViewOnce message using the ViewOnce generated details. 
- 
											ViewOnce Set Create a new message to shared securely. This action will return the URL that can then be used to access the value. 
- 
											Web Hook Trigger A trigger that is externally called via an API. GET or POST methods can be used to call the external API https://<a-ops_URL>/integration/system/<access_key>/<token> when using POST you can optionally include a list of events within a json list. 
- 
											Web Request Call and external web service over HTTP/S and get the response. 
- 
											While Loop until a condition is True 
- 
											While Continue Jumps back to the while object, evaluates logic and then repeats the loop if the condition is still not met. 
- 
											Wordpress Connect Connect to a wordpress API using username and application password. 
- 
											Wordpress Custom Request Call any supported wordpress API endpoint and return the results to the A-Ops flow. 
- 
											Wordpress Get Health Get a summary of the Wordpress health page. 
- 
											Wordpress Get Version Get the current Wordpress version with an option to check if this is the latest version. 
- 
											Wordpress List Plugins Lists installed plugins with an option to check if the plugins is up to date. 
- 
											Wordpress List Themes Lists installed themes with an option to check if the themes are up to date. 
- 
											Wordpress List Users Lists configured users. 
- 
											Write Google Sheet Write data to a Google Docs Sheet 
- 
											Zendesk Connect Connect to a Zendesk instance via API. 
- 
											Zendesk Custom Request Execute a custom API call against a given endpoint. 
- 
											Zendesk Oauth Create Token Create a new Oauth access token for a given Oauth client. 
- 
											Zendesk Oauth List Clients Returns a list of configured zendesk Oauth clients. 
- 
											Zendesk Oauth List Tokens Returns a list of Oauth tokens for a given Oauth client 
- 
											Zendesk Oauth Revoke Token Revoke an existing Oauth token 
- 
											Zendesk Update Ticket Update a ticket by ID and corresponding fields. 
- 
												AD Asset Discovery Discover assets within an Active Directory. 
- 
												Asset Search Trigger Search and return assets that match a mongo style search syntax. 
- 
												Data Trigger A trigger that contains a static user defined list of events. 
- 
												DNS Twister Observe Monitor and report on changes to a given list of domains. The domains use DNS Twister fuzzing to help detect phishing domains. 
- 
												Event Threshold Trigger that returns matching correlations based on the defined fields. 
- 
												GLPI Due Tasks Search for tasks that are due or overdue for a given user. 
- 
												MS Defender Run Hunting Query Trigger Perform Advanced Threat Hunting in MS Defender with KQL Queries. 
- 
												MSTeams Incoming Message Inbound webhook to read messages coming from the configured teams channel. 
- 
												netskopeGetAlerts 
- 
												netskopeGetEvents 
- 
												OpenSearch Saved Search Trigger Search an Opensearch index using a Opensearch Dashboards saved search query. 
- 
												OpenSearch Search Trigger Search an Opensearch index using a defined search query. 
- 
												Playbook Search Trigger for looping through playbooks and their occurrences. 
- 
												Queue Trigger Checks a given queue for new events that are ready to be executed. 
- 
												Sigma Rule Trigger Generate SIEM queries from Sigma rules 
- 
												Sigma Rules File Trigger Generate SIEM queries from Sigma rules found within a given rule folder 
- 
												Sophos SIEM Alerts Collect SIEM alerts from Sophos Central. 
- 
												Sophos SIEM Events Collect SIEM events from Sophos Central. 
- 
												Storage Trigger Load events from an existing storage file in csv, json or txt format. 
- 
												Trigger General purpose trigger object that can be used to start a flow based on a timer or cron schedule. 
- 
												Web Hook Trigger A trigger that is externally called via an API. GET or POST methods can be used to call the external API https://<a-ops_URL>/integration/system/<access_key>/<token> when using POST you can optionally include a list of events within a json list. 
- 
												Action General purpose action object that can be used to set variables and define flow logic. 
- 
												AD Add User to Group Add a defined user as a member of a defined group. 
- 
												AD Create Group Create a new group within Active Directory. 
- 
												AD Create User Create a new user within Active Directory. 
- 
												AD Delete User Delete a user account within Active Directory. 
- 
												AD Disable User Disable an enabled user within Active Directory. 
- 
												AD Enable User Enable a disabled user account. 
- 
												AD Remove User from Group Remove a user from an AD group. 
- 
												AD Reset User Password Reset the password for a given user within Active Directory. 
- 
												AD Search Search for objects within Active Directory based on an LDAP search filter. 
- 
												AD Set Account Expiry Defines an account expiry from an epoch provided value. 
- 
												AD Set Object Attribute Sets an attribute value on a given object. 
- 
												Asset Delete Delete 1 or more assets. 
- 
												Asset Match Find assets that match key/value within a specified time-frame. 
- 
												Asset Search Search and return assets that match a mongo style search syntax. 
- 
												Asset Update Create/Update an asset within the asset management solution. Asset names are unique per entity. 
- 
												AWS Boto3 Change Client Changes the current boto3 client. 
- 
												AWS Boto3 Change Resource Changes the current boto3 resource. 
- 
												AWS boto3 Client Function Access and call a boto3 client function. 
- 
												AWS boto3 Connect Connect to a AWS regional service and defined boto3 client and/or resource. 
- 
												AWS boto3 Disconnect Disconnect from the connected AWS boto3 client and resource. 
- 
												AWS boto3 Resource Function 
- 
												AWS EC2 Attach Volume Attaches a volume to an instance. 
- 
												AWS EC2 Connect Connect to a AWS regional EC2 service. 
- 
												AWS EC2 Create Custom Instance Create a new EC2 instance by providing boto3 create instance parameters. This actions allow you to define more advance instances and access all available options. 
- 
												AWS EC2 Create Instance Creates a new EC2 AWS instance. 
- 
												AWS EC2 Create Instance Image Create an instance image and register it as an AMI. This process will snapshot all attached volumes and automatically provision the AMI. 
- 
												AWS EC2 Create Instance Snapshot Create a full instance snapshot of an EC2 instance and all attached disks. 
- 
												AWS EC2 Create Snapshot Create a snapshot of a volume. 
- 
												AWS EC2 Create Tags Create EC2 tags and attach them to a resource by ID. 
- 
												AWS EC2 Delete Instance Image Deletes an instance image with the option of also removing any unused associated snapshots. 
- 
												AWS EC2 Delete Snapshot Deletes an AWS EC2 snapshot by snapshot ID. 
- 
												AWS EC2 Delete Tag Delete a tag by key and value. 
- 
												AWS EC2 Delete Tags Deletes selective tags from a target resource ID. 
- 
												AWS EC2 Delete Volume Deletes an EC2 volume by volume ID. 
- 
												AWS EC2 Detach Volume Detached a volume from an instance. 
- 
												AWS EC2 Disconnect Disconnect from the connected AWS EC2 service. 
- 
												AWS EC2 Get Image Retrieve data about a image using a image ID. 
- 
												AWS EC2 Get Instance Gets an instance based on the instance ID. 
- 
												AWS EC2 Get Password Gets password data for a given EC2 instance. 
- 
												AWS EC2 Get Snapshot Retrieve data about a snapshot using a snapshot ID. 
- 
												AWS EC2 List Instances Lists found instances which can be filtered based on a defined filter. 
- 
												AWS EC2 List Snapshots Lists found snapshots which can be filtered based on a defined filter. 
- 
												AWS EC2 List Volumes Lists found volumes which can be filtered based on a defined filter. 
- 
												AWS EC2 Register Image Registers a new AMI. 
- 
												AWS EC2 Start Instance Start an AWS EC2 instance. 
- 
												AWS EC2 Stop Instance Stop an AWS EC2 instance 
- 
												AWS EC2 Terminate Instance Terminates an AWS EC2 instance. 
- 
												AWS Lambda Connect Connect to a AWS regional Lambda service. 
- 
												AWS Lambda Disconnect Disconnect from the connected AWS Lambda service. 
- 
												AWS Lambda Invoke Invoke a AWS Lambda defined function. 
- 
												AWS S3 Append Content Append to the bottom of an existing AWS S3 object. 
- 
												AWS S3 Delete Delete AWS S3 object 
- 
												AWS S3 Download Object Download an object an AWS S3 bucket. 
- 
												AWS S3 Get Object Content Return a contents of an AWS S3 object 
- 
												AWS S3 Get Object Head Get AWS S3 object head 
- 
												AWS S3 List List objects contained within an AWS S3 bucket. 
- 
												AWS S3 Put Content Create a new AWS S3 object from data provided 
- 
												AWS S3 Upload File Upload a file to AWS S3. 
- 
												AWS Secrets Manager Connect Connect to a AWS regional Secrets Manager service. 
- 
												AWS Secrets Manager Create Secret Create a new AWS secret within AWS Secrets Manager. 
- 
												AWS Secrets Manager Create Tags Creates tags on the defined secret. 
- 
												AWS Secrets Manager Delete Secret Deletes a secret from AWS Secrets Manager. 
- 
												AWS Secrets Manager Delete Tags Deletes the defined list of tags from a secret. 
- 
												AWS Secrets Manager Describe Secret Get detailed information about a secret but without retrieving the secret data 
- 
												AWS Secrets Manager Disconnect Disconnect from the connected AWS Secrets Manager service. 
- 
												AWS Secrets Manager Generate Password Generates a random password using the AWS Secrets Manager password generator function. 
- 
												AWS Secrets Manager Get Secret Returns a secret's key/values. 
- 
												AWS Secrets Manager Get Secret Value Returns a given secret value in encrypted or plaintext format. 
- 
												AWS Secrets Manager List Secrets Lists secrets found within the AWS secrets manager service. 
- 
												AWS Secrets Manager Rotate Secret Request AWS to rotate the given secrets value. 
- 
												AWS Secrets Manager Update Secret Updates the key/value secret data within an AWS secret. 
- 
												Break Exits out of a loop or subFlow. 
- 
												Choice Pause a flow and await user response before continuing. 
- 
												ClickSend SMS Send an SMS message to a recipient. 
- 
												ClickSend Voice Send an voice message to a recipient. 
- 
												Collect Build events into a list based on the size limited provided. Once the list is built the collect object passes the list of events onto the next object. 
- 
												Concurrent Run several flow paths concurrently 
- 
												Control-M Connect Creates a connection handler for Control-M REST API Service, once connected other actions can be used without the requirement of providing credentials on all actions 
- 
												Control-M Custom Request Execute a call to a given API endpoint. 
- 
												Control-M Get Events Get a list of recent events. 
- 
												Control-M Get Job Get a job and its details. 
- 
												Control-M Get Job Log Get the job log. 
- 
												Control-M Get Job Output Get job output. 
- 
												Control-M Get Job Statistics Get job statistics. 
- 
												Control-M Get Job Status Get the status of a job. 
- 
												Control-M Get Jobs By Status Get jobs by a job status i.e. 'Ended Not OK' 
- 
												Control-M Job Delete Delete a job. 
- 
												Control-M Job Free Free a job. 
- 
												Control-M Job Hold Hold a job. 
- 
												Control-M Job Kill Kill a job. 
- 
												Control-M Job Rerun Rerun a job. 
- 
												Control-M Job Run Now Run a job now 
- 
												Control-M Job Undelete Undelete a job. 
- 
												Control-M Job Wait Info Get job wait info. 
- 
												Control-M Logout Close an existing open Control-M API Service connection. 
- 
												Control-M Set Job Confirm Confirm a job. 
- 
												Control-M Set Job Ok Mark a job as OK. 
- 
												Control-M Update Alert Update details of an alert. 
- 
												Control-M Update Alert Status Update the status of an alert. 
- 
												Create Data Snapshot Create a snapshot of the data within a flow for future review. 
- 
												Create Secret Create a new A-Ops secret 
- 
												Database Connect MSSQL Connect to a MSSQL Database. 
- 
												Database Connect Oracle Connect to an Oracle Database. 
- 
												Database Connect PostgreSQL Connect to a PostgreSQL database. 
- 
												Database Delete Perform a delete query against a connected database. 
- 
												Database Disconnect Disconnect from any connected database. 
- 
												Database Insert Perform a insert query against a connected database. 
- 
												Database Search Perform a search query against a connected database. 
- 
												Database Update Perform an update query against a connected database. 
- 
												dataIngest 
- 
												Disable Action Disables an existing action by ID. 
- 
												Disable Trigger Disables an existing trigger by ID. 
- 
												DNS Twister Fuzz Returns a list of fuzzed domains from the domain provided. 
- 
												DNS Twister Google Safe Browsing Returns the current Google safe browsing system of the provided domain. 
- 
												DNS Twister IP Resolution Resolve an IP address from a domain. 
- 
												DNS Twister Parked Check Checks if the domains is a parked domain. 
- 
												DNS Twister Report Returns the DNS Twister report of a given domain. 
- 
												DNS Twister WHOIS Gets WHOIS information using the DNS Twister API. 
- 
												Echo Echos a message into the action output. 
- 
												Email Action that provides the ability to send SMTP emails via a SMTP relay. 
- 
												Enable Action Enables an existing action by ID. 
- 
												Enable Trigger Enables an existing trigger by ID. 
- 
												Event Build Correlations Build and updates event correlations. 
- 
												Event Get Correlation Get a correlation from UID string. 
- 
												Event Get Correlations Get a list of correlations based on the provided criteria. 
- 
												Event Update Updates a value on an existing event by index. 
- 
												Event Update Score Updates the score on an existing event by index. 
- 
												Execute Trigger Executes a trigger immediately 
- 
												Exit Exits the currently running trigger. 
- 
												Extract Regular expression extraction of a given string. 
- 
												Foreach Loop over a data list of json events. 
- 
												FortiGate Command Execute and receive output from a given command. 
- 
												FortiGate Connect Connect to FortiGate firewall over SSH 
- 
												FortiGate Disconnect Disconnects from an active FortiGate connection. 
- 
												FortiGate Script Execute a defined FortiGate script on the connected firewall. 
- 
												fortiManager Connect Connect to a fortiManager instance. Required before calling any other fortiManager integration objects. 
- 
												fortiManager Get ADOMs List ADOMs present on the fortiManager 
- 
												fortiManager Get Object Return a given object. 
- 
												fortiManager Get Objects Get a list of object by object type 
- 
												fortiManager Set ADOM Change which ADOM is currently being used. 
- 
												fortiManager Set Object Update a fortiManager object 
- 
												FTP Connect Connect to an FTP server 
- 
												FTP Disconnect Closes FTP active session 
- 
												FTP Storbinary Store File to an FTP server 
- 
												ftpRetrieve Retrieve File from an FTP server 
- 
												Fuzzy Match Distance Compares two strings for likeness based on a Levenshtein Distance score. 
- 
												Fuzzy Match String Compares two strings for likeness 
- 
												Generate Password Randomly generate a password string. 
- 
												Geolocate IPv4 Return geolocation data about a given IPv4 address. 
- 
												Get Action Get a given action's details. 
- 
												Get Google Sheet Read and return a Google Docs Sheet 
- 
												Get Trigger Get a given trigger's details. 
- 
												Global Get Retrieve global variable by name. 
- 
												Global Set Sets a global variable that can be later retrieved with the globalGet object. 
- 
												GLPI Complete Task Mark a task as completed. 
- 
												GLPI Connect Connect to a GLPI instance. 
- 
												GLPI Followup Add a new followup to an existing ticket. 
- 
												GLPI Search Search across the GLPI platform. 
- 
												GLPI Solve Solve a ticket. 
- 
												GLPI Task Create/Update a task within an existing ticket. 
- 
												GLPI Ticket Create a new ticket within the GLPI ticketing system. 
- 
												GLPI Ticket Detail Get the details of a ticket by ticket ID. 
- 
												GoDaddy Connect Connect to a GoDaddy API service using key and secret. This object can be used to start a connection that is then used by other GoDaddy objects within a flow. 
- 
												GoDaddy Delete DNS Record Delete a DNS record of a specified type from a specified domain you own. 
- 
												GoDaddy Get DNS Record Get a DNS record of a specified type from a specified domain you own. 
- 
												GoDaddy Update DNS Record Update a DNS record of a specified type from a specified domain you own. 
- 
												Google Chat Send Message Sends a message via a Google Chat incoming webhook. 
- 
												Google Sheet Get Range Get a list of values from a Google Docs sheet using a range i.e. A:B 
- 
												Google Sheet Insert Inserts into an existing Google Docs sheet at a provided position i.e. A1 
- 
												Google Sheet Update Cell Updates a cell with a provided value 
- 
												Google Sheets Connect Create a Google Docs service connection that can then be used to interact with sheets shared with the service user 
- 
												IBM Cloud Client Function Access and call an IBM VPC Python SDK client function. 
- 
												IBM Cloud Connect Create an API session with IBM Cloud so that subsistent IBM Cloud actions can be executed. 
- 
												IBM Cloud Create Instance Create a new VPC instance within IBM Cloud. 
- 
												IBM Cloud Create Instance From Snapshot Create a new VPC instance from an existing snapshot within IBM Cloud. 
- 
												IBM Cloud Create VPC Create a new VPC within IBM Cloud. 
- 
												IBM Cloud Create VPC Instance Volume Snapshot Create a new snapshot for a given volume. 
- 
												IBM Cloud Create VPC IPv4 Subnet Create a new IPV4 Subnet within IBM Cloud. 
- 
												IBM Cloud Create VPC Network Prefix Create a network super-net prefix within a VPC. 
- 
												IBM Cloud Delete Instance Delete a VPC instance within IBM Cloud. 
- 
												IBM Cloud Delete VPC Delete a VPC from your IBM Cloud environment. 
- 
												IBM Cloud Delete VPC Instance Volume Delete an instance volume within IBM Cloud. 
- 
												IBM Cloud Delete VPC Instance Volume Snapshots Delete all snapshots for a given volume within IBM Cloud. 
- 
												IBM Cloud Delete VPC Snapshot Delete snapshot for a given snapshot ID within IBM Cloud. 
- 
												IBM Cloud Delete VPC Subnet Delete a subnet within a VPC in IBM Cloud. 
- 
												IBM Cloud Get VPC Get a single VPC by ID or when no ID is provided return all VPCs within your IBM Cloud Account. 
- 
												IBM Cloud Get VPC Instance Get details of an IBM Cloud VPC instance or list all VPC instances when no instance ID is provided. 
- 
												IBM Cloud Get VPC Instance Volume Get volume details of a given IBM Cloud VPC Instance, or list all volumes for a given instance when Volume ID is blank. 
- 
												IBM Cloud Get VPC Instance Volume Snapshot Get details of a volume snapshot or list all snapshots for a given volume when no snapshot ID is provided. 
- 
												IBM Cloud Get VPC Network Prefix Get IBM Cloud VPC super-net prefix. 
- 
												IBM Cloud Get VPC Subnet Get details of a given subnet or when no subnet is provided all subnets will be returned. 
- 
												IBM Cloud List VPC Region Zones List IBM Cloud VPC zones for a given region. 
- 
												IBM Cloud List VPC Regions List IBM Cloud VPC regions. 
- 
												IBM Cloud VPC Disconnect Disconnect from an IBM Cloud session made using IBM cloud Connect. 
- 
												IPStack Lookup IP Retrieve information about an IP. 
- 
												IPStack My IP Get your external IP address as seen by the IPStack service. 
- 
												jinja2 Format Render a template using a defined jinja2 template. 
- 
												Jira Custom Request Execute a Jira API call 
- 
												localConvertCSVToDict 
- 
												localDelete 
- 
												localExecute 
- 
												localPing 
- 
												localRead 
- 
												localWrite 
- 
												MongoDB Connect Connect to a MongoDB Database. 
- 
												MongoDB Find Execute a MongoDB find query. 
- 
												MS Defender Connect Make an API connection using Microsoft Graph API that can be used to interact with MS Defender. 
- 
												MS Defender Custom Request Execute a custom graph API request. 
- 
												MS Defender for Endpoint Custom Request Execute a custom Defender for Endpoint API request. 
- 
												MS Defender Get Alerts Execute a graph API request that retrieves alerts. 
- 
												MS Defender Get Incidents Execute a graph API request that retreives incidents. 
- 
												MS Defender Get New Alerts Execute a graph API request that retrieves new alerts. 
- 
												MS Defender Get New Incidents Execute a graph API request that retrieves new incidents. 
- 
												MS Defender Run Hunting Query Perform Advanced Threat Hunting in MS Defender with KQL Queries. 
- 
												MSTeams Post Message Post a message to a configured teams channel. 
- 
												netskopeActionGetAlerts 
- 
												netskopeActionGetEvents 
- 
												Occurrence Action responsible for raising, updating and clearing alarm state based on a given match string UID. 
- 
												Occurrence Update Provides the ability to update variables held within the alarm objects data field. 
- 
												OneNote Add Bulk Content Inserts bulk content onto a OneNote page 
- 
												OneNote Add Content Base64 Image Inserts a base64 image onto the target page 
- 
												OneNote Add Content Image Inserts a image from URL src onto the target page 
- 
												OneNote Add Content Text Insert text content onto the target page. 
- 
												OneNote Add Content Website Render Inserts a rendered version of a given website into the target page. 
- 
												OneNote Add Notebook Section Creates a new section within the target notebook. 
- 
												OneNote Add Section HTML Page Create a new page with custom HTML within the target section. 
- 
												OneNote Add Section Page Creates a basic OneNote page within a target section. 
- 
												OneNote Connect Make an API connection using Microsoft Graph API that can be used to interact with OneNote hosted documents. 
- 
												OneNote Custom Request Execute a custom graph API request. 
- 
												OneNote Delete Notebook Section Deletes a target section within a OneNote document. 
- 
												OneNote Delete Page Deletes a page within a OneNote document. 
- 
												OneNote Get Page Content Retrieve the current OneNote page in HTML format. 
- 
												OneNote List Group Notebooks Lists accessible notebooks within a group that the target user has access to. 
- 
												OneNote List My Notebooks Lists the target users notebooks stored within their personal OneDrive. 
- 
												OneNote List Notebook Sections Lists all sections within a given notebook. 
- 
												OneNote List Section Pages Lists pages within a target section of a OneNote document. 
- 
												OneNote List Site Notebooks Lists accessible notebooks within a sharepoint site that the target user has access to. 
- 
												OpenSearch Custom Request Execute a custom OpenSearch request. 
- 
												OpenSearch Saved Search Search an Opensearch index using a Opensearch Dashboards saved search query. 
- 
												OpenSearch Search Search an Opensearch index using a defined search query. 
- 
												Oracle Cloud Connect Connect to Oracle Cloud service. 
- 
												Oracle Cloud Function Calls an API function for the connected Oracle Cloud Service 
- 
												OTX Get Pulse Get a pulse by pulse ID. 
- 
												OTX Lookup CVE Retrieve CVE information from a given CVE. 
- 
												OTX Lookup Domain Retrieve domain information from a given domain. 
- 
												OTX Lookup Hash Retrieve hash information from a given hash. 
- 
												OTX Lookup Hostname Retrieve hostname information from a given hostname. 
- 
												OTX Lookup IPv4 Retrieve IPv4 information from a given IPv4 address. 
- 
												OTX Lookup IPv6 Retrieve IPv6 information from a given IPv6 address. 
- 
												OTX Lookup URL Retrieve URL information from a given URL. 
- 
												playbook Add Add an occurrence into a playbook. 
- 
												playbook Bulk Add Add multiple occurrences into a playbook. 
- 
												Playbook End Define the end of a playbook within a flow. 
- 
												Playbook Get Get a playbook occurrence item. 
- 
												Playbook Search Action Search for occurrences within a playbook. 
- 
												Playbook Start Used to start a playbook for a provided playbook occurrence UID string. 
- 
												playbook Start Update Update a defined playbook start action by action ID. 
- 
												Playbook Update Data Update a playbooks occurrence. 
- 
												Proofpoint TR Add Incident Comment Add comment to a Proofpoint Threat Response incident 
- 
												Proofpoint TR Close Incident Close a Proofpoint Threat Response incident 
- 
												Proofpoint TR Get Incident Get Proofpoint Threat Response incident 
- 
												Proofpoint TR Get Incident Alerts Get alerts associated to a Add a Proofpoint Threat Response incident 
- 
												Proofpoint TR List Incidents List Proofpoint Threat Response incidents 
- 
												Proofpoint TR List New Incidents List Proofpoint New Threat Response incidents 
- 
												Queue Add Event Adds a new event to a queue. 
- 
												Queue Event Clear Manually remove an event from the queue. 
- 
												Raise Raise an exception. 
- 
												Raise Event Raise a new event based on the fields provided. 
- 
												Remote Command Execute a remote command on an already connected remote system. 
- 
												Remote Connect Aruba Initialize a connection to a remote Aruba system using SSH. 
- 
												Remote Connect Cisco Initialize a connection to a remote Cisco system using SSH. 
- 
												Remote Connect FortiGate Initialize a connection to a remote FortiGate system using SSH. 
- 
												Remote Connect Linux Initialize a connection to a remote linux system using SSH and SCP. 
- 
												Remote Connect Windows Initialize a connection to a remote windows system using WINRM and SMB. 
- 
												Remote Connect Windows PSExec Initialize a connection to a remote windows system using PSExec SMB. 
- 
												Remote Disconnect Disconnect from a remote connection. 
- 
												Remote Download Download a file from a remote connection and store it within storage. 
- 
												Remote Multi-Command Execute multiple commands on an already connected remote system. 
- 
												Remote Powershell Script Executes a powershell script on a remote windows host. 
- 
												Remote Reboot Execute a controlled reboot of an already connected remote windows or linux system. 
- 
												Remote Upload Upload a file from storage to a remote connection. 
- 
												Reset Trigger Resets a trigger based on the trigger ID defined within the event data. data[event][triggerID] is the key used when attempting to reset a trigger. 
- 
												Script Block Executes defined python code. 
- 
												Secure Secret Generate a secure string that can later be used with the getSecret() function to return the plaintext value. 
- 
												ServiceNow Custom Request Execute a Jira API call 
- 
												Set Action Updates a given field on an existing action object with the defined value. 
- 
												Set Trigger Updates a given field on an existing trigger object with the defined value. 
- 
												Sigma Rule Generate SIEM queries from Sigma rules 
- 
												Sleep Sleep for a defined number of seconds before moving onto the next action within a flow. 
- 
												SNMP 
- 
												Snow Connect Connect to the SNOW Api 
- 
												Snow Get Item 
- 
												Snow Get Items 
- 
												Sophos Central Connect Create a connection handler for Sophos Central that can be used with other Sophos Central actions in a flow. 
- 
												Sophos Central Custom Request Send an API request to Sophos Central API endpoint that is not covered by other action objects. 
- 
												Sophos Central Get Alerts Returns alerts after the defined start time. 
- 
												Sophos Central Get Endpoint Gets data about a single endpoint as defined by the endpoint ID. 
- 
												Sophos Central Get Endpoint Software Links Get all the endpoint installer links for a tenant. 
- 
												Sophos Central Get Endpoints Return a list of Sophos Central endpoints, optionally a filter can be provided to filter the list of returned endpoints. 
- 
												Sophos Central List Tenants Returns a list of tenants for a given organization when Sophos Central is deployed in multi-tenant mode 
- 
												Sophos Central Set Tenant Change the current Sophos Central connection tenancy for use when using multi-tenant Sophos deployment. 
- 
												Storage Download Download and return the file path for a given storage file. 
- 
												Storage Upload Upload a file to storage. 
- 
												Sub Flow Jump to another flow entry point using a defined trigger ID. SubFlow allows you to call flows as functions passing in and returning data so that flows can be easily reused. 
- 
												Sub Flow Return Exit a subFlow and return true/false as a result via the subFlowResult variable. 
- 
												Timed Time connected actions and output when completed the total time taken. 
- 
												Try Except Try a portion of flow and handel error as an exception if it occurs. 
- 
												UnShorten Unshortens a provided short URL. 
- 
												Update Secret Update the value of a given A-Ops secret 
- 
												Vectra Custom Request Execute a Vectra API call 
- 
												ViewOnce Get Get the ViewOnce message using the ViewOnce generated details. 
- 
												ViewOnce Set Create a new message to shared securely. This action will return the URL that can then be used to access the value. 
- 
												Web Request Call and external web service over HTTP/S and get the response. 
- 
												While Loop until a condition is True 
- 
												While Continue Jumps back to the while object, evaluates logic and then repeats the loop if the condition is still not met. 
- 
												Wordpress Connect Connect to a wordpress API using username and application password. 
- 
												Wordpress Custom Request Call any supported wordpress API endpoint and return the results to the A-Ops flow. 
- 
												Wordpress Get Health Get a summary of the Wordpress health page. 
- 
												Wordpress Get Version Get the current Wordpress version with an option to check if this is the latest version. 
- 
												Wordpress List Plugins Lists installed plugins with an option to check if the plugins is up to date. 
- 
												Wordpress List Themes Lists installed themes with an option to check if the themes are up to date. 
- 
												Wordpress List Users Lists configured users. 
- 
												Write Google Sheet Write data to a Google Docs Sheet 
- 
												Zendesk Connect Connect to a Zendesk instance via API. 
- 
												Zendesk Custom Request Execute a custom API call against a given endpoint. 
- 
												Zendesk Oauth Create Token Create a new Oauth access token for a given Oauth client. 
- 
												Zendesk Oauth List Clients Returns a list of configured zendesk Oauth clients. 
- 
												Zendesk Oauth List Tokens Returns a list of Oauth tokens for a given Oauth client 
- 
												Zendesk Oauth Revoke Token Revoke an existing Oauth token 
- 
												Zendesk Update Ticket Update a ticket by ID and corresponding fields. 
- 
										Text