Using Automation Templates

A library of ready to use automation templates

Overview

Strobes includes a library of ready to use automation templates that cover the most common security workflow scenarios from Slack notifications for critical vulnerabilities to automatic JIRA ticket creation and SLA deadline alerts. Instead of building an automation from scratch, you can pick a template, give it a name, configure the trigger events, and have it running in minutes.

Automations are managed under Automations → Templates in the left sidebar.

Before You Start

You need Owner or Manager permissions to create or modify automations.
If you want to send notifications to Slack, have your Slack Incoming Webhook URL ready.

Available Templates

The Templates tab shows all pre-built automation templates. Each section displays the template name, a short description, and its category. The available templates are:

Template	What it does	Category
Critical Vulnerability Notification	Sends Slack notifications for critical vulnerabilities	Notifications
Automatic Status Update	Updates vulnerability status based on severity and remediation progress	Workflow Automation
High Severity MS Teams Alert	Sends Microsoft Teams notifications for high-severity vulnerabilities	Notifications
Vulnerability Assignment Email	Sends email when a vulnerability is assigned to a user	Notifications
JIRA Ticket Creation	Creates JIRA tickets for new critical and high vulnerabilities	Issue Tracking
Web Vulnerability Auto-Tagger	Automatically tags web vulnerabilities by type	Tag Management
SLA Deadline Alert	Notifies when vulnerabilities approach SLA deadlines	SLA Management
Automatic Vulnerability Assignment	Assigns vulnerabilities to team members by type and severity	Workflow Automation
Auto-Prioritize Sensitive Asset Vulnerabilities	Adjusts priority for vulnerabilities on sensitive assets	Risk Management
Exploit Available Notification	Alerts when an exploit is detected for a vulnerability	Threat Intelligence
Zero-Day Emergency Protocol	Triggers emergency response for zero-day vulnerabilities	Incident Response
Compliance Report Generator	Generates and emails weekly compliance status reports	Compliance
Expired Certificate Alert	Alerts for expired or soon-to-expire SSL certificates	Certificate Management

Step 1: Open the Templates Tab

Go to Automations in the left sidebar.
Click the Templates tab at the top of the page.

Step 2: Select a Template

Browse the grid and find the template that matches your use case. Click Use Template → on the card you want to use.

This opens the Strobes Action configuration wizard; a 5-step form that walks you through setting up the automation. The template pre-fills the configuration name and relevant defaults, but you can adjust everything.

Step 3: Configuration Details (Step 1/5)

Configuration Name (required) The name is pre-filled from the template (e.g., "SLA Deadline Alert"). You can rename it to something more specific to your environment.

Select Module Choose which data type this automation applies to:

Assets — triggers on asset-level events
Findings — triggers on finding-level events (most templates default to this)
Engagements — triggers on engagement events
Scan Logs — triggers on scan activity

Allow multiple actions to perform Toggle this on if you want the automation to execute more than one action when triggered (e.g., send a Slack message and create a JIRA ticket).

Step 4: Events (Step 2/5)

Events define when the automation triggers.

Type — choose one:

Hooks — triggers on specific data events (record created, field updated, etc.)
Schedule — triggers at a set time interval
Webhook — triggers when an external system calls a webhook endpoint

For Hooks, use the search box to find and select the hooks you want. Hook options are grouped by module:

Under Findings: Create, Title Update, Description Update, Steps to Reproduce Update, Mitigation Update, and more. Under Custom Fields: Custom risk score update, accepted risk date update, and others.

Selected hooks appear as tags. You can select multiple — for example, "State Update" and "Custom Risk score Update" together mean the automation fires whenever a finding is created or its severity changes.

Step 5: Filters (Step 3/5)

Filters let you narrow which records the automation acts on. Enter a query expression in the Query field to restrict the automation to specific findings.

Example:

days_old >= 25

This would limit the automation to findings equal to or older than 25 days. Leave the field blank if you want the automation to apply to all records matching the selected hooks.

Step 6: Pipelines (Step 4/5)

Pipelines are optional custom Python scripts that run between the trigger event and the action. They let you transform data, calculate risk scores, or apply custom logic before the action executes.

If you don't need custom logic, skip this step — click Configure only if you want to write a pipeline script. Most template-based automations work without a pipeline.

Step 7: Actions (Step 5/5)

Actions define what happens when the automation fires. Use the Search by Action dropdown to find and select an action. You can add multiple actions — each appears as a numbered card below the search field.

Configuring a Slack Action

When you select Send to Slack, a Configure Slack panel opens on the right:

Webhook URL — paste your Slack incoming webhook URL (e.g., https://api.slack.com/xyz). Click the link to create one if you don't have it yet.
Pipeline Variables — toggle on Preview Values to see live data from a test run in your message preview.
Message Template — write the notification message. Use {{ to insert dynamic variables from your pipeline output. Example: Critical vulnerability detected: {{title}} with severity {{severity}}. Please review immediately.

Click Submit on the Configure Slack panel to save the action configuration.

Completing Actions

Once at least one action is configured and all required fields are filled, the Continue button activates. If you see an Actions Data is Required warning, click the action card's expand arrow and fill in any missing fields (e.g., Webhook URL for Slack, or date fields for Accepted Risk Date).

Click Continue to submit.

Step 8: Automation Created

Strobes processes the configuration ("Creating… Please wait while we create the action…") and then returns you to the Actions tab with a green Action Created Successfully! notification. Your new automation appears in the table immediately.

Managing Existing Automations

The Actions tab lists all automations in your organization. Each row shows:

Module — the data type the automation applies to (Findings, Engagements, etc.)
Name — the automation name
Query — the filter condition
Weightage — priority weighting if multiple automations apply to the same event
Created By — the user who created it
Created On / Last Updated — timestamps

Use the search bar to find a specific automation by name. Click the edit or delete icons in the Actions column to modify or remove an automation.

Tips

Use the template name as-is first. The pre-filled names are descriptive and searchable. Rename only if you're running multiple variations of the same template.

Hooks stack — select only what you need. Adding too many hooks (e.g., every finding field update) can cause an automation to fire dozens of times per vulnerability. Start with just the hooks that represent meaningful workflow events (Create, Severity Update).

Test filters with a small dataset first. Set a narrow query (e.g., a specific asset ID or finding ID) when first activating an automation to verify it behaves as expected before broadening the scope.

Check the Slack webhook before saving. Paste the webhook URL into a curl test or Slack's own test tool before entering it in Strobes. A bad URL silently fails — the automation will run but no message will be delivered.