Overview
The Automations page is one place to see every rule and schedule Hestia runs for your workspace. Automations shows what each saved automation does, when it fires, and whether it is on. The most important thing to know: everything here is propose-only. A person always confirms before anything runs. Hearth never takes an action on its own.
Two kinds of automation are available:
- Event rules fire when a matching trigger occurs (for example, a critical detection or a risky-identity signal). When a rule matches, Hearth proposes an action for you to review.
- Schedules are recurring runs of a saved briefing on a cadence (daily, weekly, or hourly). These produce reports on a timetable.
When something is worth acting on, the automation builds a proposal. You review it and confirm it.
Before you begin
Creating or changing an automation, and confirming a proposal, both require the Administrator or Owner role. Viewing Automations and dismissing a proposal are available to all workspace members. A read-only support account cannot create, author, or confirm anything.
To send to a webhook, there is nothing to provision. The built-in Notify action works without a connected integration. You supply a destination URL and, optionally, a secret-header value. Hearth stores it securely.
How it works
The same sequence applies to every action, whether built-in or integration-based:
- A trigger occurs, such as when an event rule matches (a detection or an identity-risk signal), or a schedule comes due.
- Hestia evaluates the situation. Where an action is warranted, it builds a proposal and stops. It does not act.
- The proposal appears in your review queue. You confirm it (it runs) or dismiss it (it does not run).
- Only after your confirmation does the action run.
What you can see and do
The Automations page opens on the Map tab and also has an Activity tab. The Activity tab is a read-only ledger of recent orchestration runs.
Map lists everything Hestia runs for your workspace, grouped into Event rules and Schedules. Each entry shows what it does, when it fires, and whether it is on. From the Map, you can do the following:
- Filter and search: Narrow the list, or use the Enabled only filter to hide anything switched off.
- Save a view: Use the + Save view control to keep a filtered view you return to often. Select ✦ Ask Hestia for a view to describe the view you want in plain language.
- Create an automation: The + New automation button opens a guided builder. You can build a rule step by step, or open the Ask Hestia panel and describe what you want in plain language (for example, "Disable a user and alert #soc when impossible travel is detected"). Hestia drafts the automation into the builder for you to review and save.
- Start from a webhook starter: One-click starters (for example, "Forward every critical detection to a webhook") open the builder pre-filled with a webhook action and a trigger. Add your destination URL and save. These starters open the builder and are not saved rules, because a webhook rule requires a destination URL before it can be saved.
Note: On MSP parent accounts, Cohort scope is a read-only view of the automations across the sub-accounts you manage, grouped by organization. It is for visibility across your fleet, not for editing.
Built-in actions
Every workspace includes the built-in Notify action with no integration required. It is available in four forms:
- Webhook — POST to any URL you provide.
- Slack — formatted message to a Slack incoming webhook.
- Microsoft Teams — formatted message to a Teams webhook.
- Email — an email notification.
A webhook rule allows one webhook per rule. Like everything else in Automations, it is propose-only: when a rule matches, Hearth proposes the send, and a person confirms it before it goes out.
Connected integrations can offer additional response actions. The exact set depends on which integrations you have connected. These follow the same propose-then-confirm path.
Approving proposals
Proposals waiting for your review appear in two locations:
- My Queue (WORKSPACE > My Queue), on the Runs tab — your personal work list.
- Actions (WORKSPACE > Actions), under Proposals to approve — alongside remediation work from Hestia investigations.
From either location, select Confirm to run the action or Dismiss to discard it. Confirming requires the Administrator or Owner role — the server verifies this on each request. Dismissing is available to anyone who can see the proposal. A confirmation is the only thing that ever runs an action.
Creating an automation
- Navigate to WORKSPACE > Automations.
- Click + New automation.
- Do one of the following:
- Build the rule step by step in the guided builder.
- Select the Ask Hestia panel and describe the automation in plain language. Hestia drafts it into the builder for you to review.
- To forward alerts to a destination, select a webhook starter, add your destination URL, and click Save.
Reviewing and confirming a proposal
- Navigate to My Queue (WORKSPACE > My Queue) or Actions (WORKSPACE > Actions).
- Under Proposals to approve, select the proposal you want to review.
- Select Confirm to run the action, or Dismiss to discard it.
Verifying the automation
After you create or confirm an automation, verify the following:
- A new automation appears in the Map under Event rules or Schedules and shows as enabled.
- When its trigger fires, a proposal appears in My Queue and in Actions under Proposals to approve.
- After you confirm a proposal, the run appears in the Activity tab.