> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Automation Templates
> Pre-built starting points for common Action automations
## What templates are
When you create an Action, you choose one or more automation channels (email, ticket, webhook, etc.). **Automation Templates** are pre-built configurations for common patterns — pick a template instead of starting from scratch.
The templates panel sits on the right of the [Action Center](/automation):
## Built-in templates
| Template | What it does | Best for |
| ---------------------------------- | ---------------------------------------------------- | ------------------------------------- |
| **Security Notification** | Email alert with device context to security ops | Critical issues that need eyeballs |
| **Move to Blocked Security Group** | AD / Entra ID group change for non-compliant devices | Reducing access for unhealthy devices |
| **Alert Non-Compliant Device** | Teams / Slack notification | Team awareness without ticketing |
| **Reboot Device** | Force reboot via Intune / SCCM | Policy push that requires restart |
| **Isolate Device** | EDR network isolation (CrowdStrike, Defender) | Compromised devices — containment |
| **Create Incident** | ServiceNow / Halo / Jira ticket | Formal ITSM workflow |
## How to use a template
Visible by default in the Action Center.
A guided flow opens with the template's defaults pre-filled.
Same query builder as a from-scratch Action. The template only governs automation — *what* to do; you still define *when* to do it.
Templates ship with sensible defaults but everything is editable — recipient lists, message templates, escalation timing.
Same as any Action.
## Template details
### Security Notification
**Automation:** Email
**Default recipients:** Empty (you must add)
**Default subject:** `Security Alert: [Device Name] requires attention`
**Default body:** Includes device name, user, last online, issue description, and a link back to the device in Protect
**Best for:** Critical issues where someone needs to look at the device immediately. Email is the lowest-friction channel.
### Move to Blocked Security Group
**Automation:** Power Automate webhook → AD / Entra ID group change
**Default behaviour:** Add device to a configurable security group (e.g. `BlockedDevices`)
**Effect:** When this group is referenced in your conditional access policies, the device immediately loses access
**Best for:** Containing a device with active security issues without manual intervention. Pair with conditional access rules that gate sensitive applications.
This template moves devices in your AD / Entra ID. Confirm the destination group has the right effect *before* enabling — accidentally moving production servers to a blocked group breaks things fast.
### Alert Non-Compliant Device
**Automation:** Teams / Slack webhook
**Default channel:** Configurable
**Default message:** Markdown card with device fields and a link
**Best for:** Team-level visibility. Less formal than a ticket; more visible than an email. Great for big-screen SOC displays.
### Reboot Device
**Automation:** Power Automate → Intune / SCCM device action
**Default behaviour:** Trigger a remote reboot
**Best for:** Configuration changes that require restart (policy pushes, encryption updates, agent installs).
Force reboot interrupts users. Use minimum-time-in-view of 24+ hours and consider business-hours filtering.
### Isolate Device
**Automation:** EDR API call (CrowdStrike, Defender, SentinelOne)
**Default behaviour:** Network-isolate the device — block all traffic except management
**Resolution:** Manual un-isolate after investigation
**Best for:** Active threats — when an EDR detection or Vital fires Critical, isolate first, investigate second. The most aggressive built-in template.
Isolation breaks user access entirely. Always pair with an immediate ticket and a defined investigation runbook.
### Create Incident
**Automation:** ServiceNow / Halo / Jira / Datto AutoTask API call
**Default behaviour:** Create a ticket with device context, assigned to a default group
**Resolution sync:** Optional — closing the ticket can resolve the device
**Best for:** Formal ITSM workflow. When work needs to be tracked through your existing service-management process.
## Customising templates
Every template field is editable when you instantiate it. Common customisations:
* **Recipients** — match your team structure
* **Message body** — include department, user contact, severity rationale
* **Conditional logic** — e.g. only create tickets between 9am-5pm; route to different groups based on department
* **Escalation** — different automation at different times in view (email at 24h, ticket at 72h, isolation at 7 days)
## Creating your own templates
Beyond the built-in templates, any Action you create can be exported as a template for re-use by your team. The template appears in the same panel for everyone with appropriate permissions.
To save a custom template:
1. Build an Action with the automation pattern you want to reuse
2. From the Action's 3-dot menu, choose **Save as Template**
3. Name the template; choose visibility (Team or Everyone)
4. Future Action creators see it alongside the built-ins
This is how teams standardise their automation patterns over time — turning organisational knowledge into reusable starting points.
## See also
Conceptual overview
Ongoing patterns
Project patterns