Triggered actions are made up of a trigger and an action. The trigger defines an event that causes an action to be performed. Only certain actions are valid for a trigger.

Triggered actions are defined per tenant via the /triggered_actions endpoints. They can be inserted, updated, and deleted. Updating a triggered action cannot change the type of the trigger or action

The following event types are currently supported:
  • object_modified triggers fire when an object that can have a GraphQL subscription and is tracked for changes is inserted, updated or deleted. To configure the trigger, you need to provide the trigger type, the target schema/object name, and an EQL filter.

    The filter specifies when the action should be performed and can refer to the operation name and the current and previous data objects.

    
      "trigger" : {
          "type": "object_modified",
          "schemaName": "Jobs",
          "filter": "Operation == 'INSERT' OR Current.JobStatus != Previous.JobStatus"
        }


    The following fields are available in the filter:
    • Operation: The operation that triggered the event. Can be INSERT, UPDATE, or DELETE.
    • Current: The current object.
    • Previous: The previous object. Only available for UPDATE and DELETE operations.
  • event triggers fire when pre-defined events occur.
    • recurring_schedule: Indicates that a recurring schedule has been updated.
      • jobIds: The list of jobs updated as part of a single action.
      • jobFields: Represents the set of values changed across jobs.