Get alert
ReadOne alert with its evidence (Pro and Enterprise).
Permissions and limits
Account permissions
- A LiteSOC API key (Settings, API Keys); alerts need the Pro plan or above
Security & Identity · CONNECTIONLiteSOC + NodeHub
Send security events to LiteSOC, read events with their forensics, and list, read and resolve its alerts.
Explore 7 workflow actions for LiteSOC, including account permissions and operation limits.
4 read actions3 write actions
WORKFLOW ACTIONS
What you can configure.
Choose an action in the workflow builder, connect an account, and map its inputs. These actions are available in the catalog; your account access and a successful test determine whether they work for your setup.
Get event
ReadOne event with its full forensic details; an event past retention answers 403.
Permissions and limits
Account permissions
- A LiteSOC API key (Settings, API Keys); alerts need the Pro plan or above
List alerts
ReadAlerts from LiteSOC's detections (impossible travel, brute force and more) by status, severity and type (Pro and Enterprise).
Permissions and limits
Account permissions
- A LiteSOC API key (Settings, API Keys); alerts need the Pro plan or above
List events
ReadSecurity events with their GeoIP and network details, newest first, within the plan's retention (forensics are redacted on Free).
Permissions and limits
Account permissions
- A LiteSOC API key (Settings, API Keys); alerts need the Pro plan or above
Resolve or mark alert safe
WriteResolve an alert with how it was handled, or mark it safe as a false positive (Pro and Enterprise).
Permissions and limits
Account permissions
- A LiteSOC API key (Settings, API Keys); alerts need the Pro plan or above
A repeated request may repeat the external action. Review the previous result before retrying a write.
Send security event
WriteQueue one security event; LiteSOC assigns its severity and enriches it with GeoIP and network data. Standard events: auth.login_success, auth.login_failed, auth.logout, auth.password_reset, auth.mfa_enabled, auth.mfa_disabled, auth.session_expired, auth.token_refreshed, authz.access_denied, authz.role_changed, authz.permission_granted, authz.permission_revoked, admin.user_created, admin.user_deleted, admin.user_suspended, admin.privilege_escalation, admin.settings_changed, admin.api_key_created, admin.api_key_revoked, data.export, data.bulk_delete, data.sensitive_access, security.suspicious_activity, security.rate_limit_exceeded, security.ip_blocked, security.brute_force_detected.
Permissions and limits
Account permissions
- A LiteSOC API key (Settings, API Keys); alerts need the Pro plan or above
A repeated request may repeat the external action. Review the previous result before retrying a write.
Send security events in bulk
WriteQueue up to 100 security events in one request.
Permissions and limits
Account permissions
- A LiteSOC API key (Settings, API Keys); alerts need the Pro plan or above
A repeated request may repeat the external action. Review the previous result before retrying a write.
SETUP
Start with a controlled test.
01Connect the intended account
Use the account and permissions required for your process. Review the connection check before configuring a workflow action.
02Review inputs and access
Select a listed operation and map its required inputs. Use test records and add a human approval before writes that need review.
03Confirm the result
Inspect step outputs and confirm the result in LiteSOC. A saved workflow is not a completed provider action.
EXPLORE YOUR STACK
