Cortex Actions

Searches Add/Remove Programs for exact or partial software name

 Useful if you need to uninstall software only where it exists

Evaluate the CPU usage over a specific sample period

Detect the status of the Windows Firewall (enabled or disabled).

This step is used to log the user out of the current session on the device. It uses the Windows Terminal Services API to open the server, get the active console session ID, and log off the session.

If the log off is successful, the output result is set to 'success', otherwise it is set to 'failed'.

This includes both mounting and unmounting actions.

Mount an ISO image to make its contents accessible as if they were part of the local file system. This allows browsing, reading, and modifying the files within the ISO image just like any other directory on your system.

Unmounting is the process of disconnecting a mounted file system from its mount point. When you're done working with an ISO image, unmounting it ensures that the file system is safely detached from the mount point. This action frees up system resources and prevents data corruption.

ISO files are normally used to back up optical disks or data in a more functional way.

Detect the type of operating system

 This is useful if you have different actions based on Windows, Mac OS or Linux operating systems

Sends email for approval before processing the next step in the task.

Example: Confirm approval before deployment of patches

 If emailing to multiple email addresses, set the "number of approvers" appropriately.  If you need all users to approve, the number must match the number of emails addresses.

Requires end-user approval before processing the next step in the task. Snooze and cancellation options can be used if required.

Example: The end-user is asked to close all Outlook applications before application upgrade.

This action allows to create informative message which be displayed to users on the notification dialog.

Notification can be customized with the company logo.

Maximum text size is 200 symbols.

Notification timers allow to specify time during which the popup message will be displayed on a device.

After this time the message disappears automatically if not skipped by the user.

Wait for a defined period of time before processing the next task. It's useful for ensuring that preceding tasks have completed or for synchronizing with external events.

Example: Wait 15 minutes for services to come online.

Execute a custom batch script

 You can copy and paste a pre-existing script

Execute a Windows Powershell script

Example: Shut down the virtual machine to patch the host

Execute a custom VB script

 VB is extremely useful for multiple-step actions

Process (hash) is stopped if running

 Hash is either MD5 or Sha1

Create and set global variables.

Global variables store script output results for every device. Global variables are useful when you need to reference a variable from outside the current workflow, making them particularly handy for Cortex sequences. These variables allow for consistent referencing of workflows across devices' lifecycles.

Disable a specified account if it exists

Example: If you have a user account that you want to make unavailable without deleting it

Enable a specified account if it exists

Example: Enable a local account that is only used for local device backups

Search for a local account

Example: Search for 'Administrator' user accounts as these breach a security policy

Put the device into quarantine mode

 Quarantine is very useful if suspicious activity has occurred on a device

Verify disk space health. Monitoring disk space health is crucial for ensuring optimal system performance and preventing potential issues related to storage limitations.

Health is either Healthy, Medium, or Low and the tolerances are all definable

Example: Check disk space prior to deployment of software or patches

Check for specific event log entries on a device. It retrieves event logs based on the specified criteria such as log name, entry type, time range, user name, i source, message content, category, instance ID, and minimum number of events. It returns 'Found' if the specified number of events matching the criteria are found, otherwise it returns 'NotFound'

Search a specified drive for a specific file (file name)

Example: Search the drive for a Tor browser or BitTorrent binary.

Action which checks if the time is good for the Cortex chain to continue.

The time is taken according to device(s) time zone for which Cortex action is being executed.

Action designed to check incoming variable value from another action.

And depending on received value 'If variable' decides which way the workflow will go further. It allows to read any of the 3 values of a variable: Output, ErrorCode or ReturnCode

Checks if the time on the device is synchronized with a particular server. The admissible time difference can be specified in minutes.

Detect if Process (hash) is running

 Hash is either MD5 or Sha1

Check if the reboot is needed

 This is really useful if you are performing a complex software upgrade that requires a device to be in a non-reboot state

Shows if there is a logged in user on a device.

This action is applicable only for Windows devices.

Ping an IP Address or URL to detect on which network the device is connected

Example: Ping a local server to make sure the device is inside the company network

Check if a device has been up and running for a specified time period

Example: Has the server been running for 10 minutes since being rebooted

Perform an inventory scan on the device

Example: Perform an inventory scan to ensure it is up to date before trying to install the software

Action which is a part of Zero Trust feature available in Syxsense Enterprise subscription. It is required for all zero trust evaluations.

The action tags the device as 'Not trusted' if it does not match certain criteria according to the corporate standards.

This criteria is flexible and should be specified by the customer (e.g. some software is preinstalled, appropriate settings are configured, etc.)

The action tags the device as 'Trusted' if it matches the certain criteria according to corporate standards, as described above.

Select which patches to scan from single, multiple, groups or queries of patches

 Returns Detected if anything is found

This action performs patch scan and downloads patch source if the patch is detected on the device. Patch installation is not executed.
If the patch is not detected the source will not be downloaded.
The action gives more flexibility during deployment process.

The patches could be staged before installation.

Action made to apply/run the remediation workflows which were previously accepted/saved by the customer before using Security Resolve action.

This action allow to select the approved remediations by:

• Custom Query: User defined queries for security vulnerabilities matching certain criteria. Updated when the task runs.
• Group: Fixed groups of specific security vulnerabilities
• Specific: Select any combination of security vulnérabilités, security groups and security queries
• All security vulnerabilities

Returns Detected if anything is found

Select the pre-existing system rule of patches released on the previous Microsoft Patch Tuesday to scan

Performs reboot with a custom message presented to the end-user

This will reboot immediately if there are users not logged on

Quick Reboot UI

Uninstall the software

This action is used for software deployment without launching install command. The file is loaded to DownloadFolder and DownloadCacheFolder, but not executed.

 Checking the 'Using Peer File' checkbox in Properties allows implementing of a peer-to-peer technology which is useful for traffic reduction.

Select which patches to scan from single, multiple, groups or queries of patches

 Returns Detected if anything is found

Performs reboot with a custom message presented to the end-user

Evaluate the CPU usage over a specific sample period

The alert generated is resolved

Example: Device has been removed from Quarantine and the Alert is resolved

An alert can be generated for every device that has the alert triggered

Example: Device spikes in CPU so an alert is generated

Detect if Process (hash) is running

 Hash is either MD5 or Sha1

Check if the reboot is needed

 This is really useful if you are performing a complex software upgrade that requires a device to be in a non-reboot state

Ping an IP Address or URL to detect on which network the device is connected

Example: Ping a local server to make sure the device is inside the company network

Execute a custom bash script

 You can copy and paste a pre-existing script

Process (hash) is stopped if running

 Hash is either MD5 or Sha1

Sends email for approval before processing the next step in the task.

Example: Confirm approval before deployment of patches

 If emailing to multiple email addresses, set the "number of approvers" appropriately.  If you need all users to approve, the number must match the number of emails addresses.

Uninstall the software

This action is used for software deployment without launching install command. The file is loaded to DownloadFolder and DownloadCacheFolder, but not executed.

 Checking the 'Using Peer File' checkbox in Properties allows implementing of a peer-to-peer technology which is useful for traffic reduction.