Creating automation stitches

To create an automation stitch, a trigger event and a response action or actions are selected. Automation stitches can be tested after they are created.

In the GUI, go to Security Fabric > Automation and click Create New. Automation stitches, actions, and triggers are configured in separate dialogs.

The stitch Action execution can be set to either Sequential or Parallel. In sequential execution, actions will execute one after another with a delay (if specified). If one action fails, then the action chain stops. This is the default setting. In parallel execution, all actions will execute immediately when the stitch is triggered.

When creating a stitch, clicking Add Trigger and Add Action displays a list of available triggers and actions, and the option to create a new one.

Once the stitch is configured, a process diagram of the trigger, actions, and delays is displayed. A delay can be added before an action if Sequential action execution is used. Executing the next action can be delayed by up to 3600 seconds (one hour).


Triggers and actions can be configured separately, and then added to an automation stitch.

Tabs on the Automation page

On the Security Fabric > Automation page, there are tabs for Stitch, Trigger, and Action. The Stitch tab is the default view that lists the trigger and actions used in each stitch. Individual triggers and actions can be created or edited in the corresponding tabs.

Click Trigger to view the list of triggers.

Click Action to view the list of actions.

Sample configuration