Skip to main content

Integrations and actions

Policies can trigger actions when they match browser activity. This includes sending events to integrations, creating threats, collecting evidence, and including events in reports.

Integration types​

Keep Aware supports several types of integrations for policy actions. For a complete list of supported integrations and setup guides, see the Integrations documentation.

Alerting integrations​

Send real-time alerts when policies trigger. See Alerting Integrations for available options and setup guides.

Threats and event forwarding​

Forward events to SIEM platforms and security tools. See Threats and Event Forwarding for available options and setup guides.

Evidence collection​

Capture page content, screenshots, or input data from events. See Evidence Collection for available options and setup guides.

Adding integrations to a policy​

  1. Open the policy in the Policy Editor
  2. Navigate to the Integrations section
  3. Select integrations from the available list
  4. Configure integration-specific options
  5. Click Save

When the policy triggers, events are sent to all selected integrations.

Integration configuration​

Forward to integrations​

Select one or more integrations to receive events. Each integration must be configured in the Integrations catalog before it appears here.

Evidence collection​

Capture browser content when the policy triggers.

Configuration:

  • Select a cloud storage integration for the destination
  • Choose what to capture:
    • Page screenshot
    • Page content (HTML DOM)
    • Input data

Use cases:

  • Phishing investigation evidence
  • Data exfiltration forensics
  • Compliance documentation

Evidence is stored in your configured cloud storage and linked to the event. See Evidence Collection for setup details.

Policy actions​

Beyond integrations, policies can trigger internal actions:

Reporting​

Include events in Keep Aware reports and dashboards.

Enable by: Checking "Include in reporting" in the Integrations section.

Effect:

  • Events appear in the Reporting dashboard
  • Events are included in scheduled reports
  • Metrics and trends are tracked

Create threat​

Generate a threat investigation when the policy triggers.

Enable by: Checking "Create threat" in the Integrations section.

Effect:

  • A new threat is created for each event
  • Threats appear in the Threats dashboard
  • Threats can be assigned and investigated

Best for:

  • High-severity policies
  • Incidents requiring investigation
  • Events needing response tracking

Console actions​

Configure what happens in the console:

  • Log — Event is logged and searchable
  • Label — Custom label is applied to the event

Labels are useful for:

  • Categorizing events
  • Filtering in search
  • Identifying policy matches in exports

Action priority​

When multiple policies match the same event:

  1. All matching policies' integrations are triggered
  2. All matching policies' reporting actions apply
  3. Only the highest-priority policy's safeguard is shown
  4. Threat creation follows priority and suppression rules

Suppression​

Enable Suppress to prevent lower-priority policies from triggering when this policy matches.

Use case: When a high-priority threat policy matches, you may not want lower-priority audit policies to also trigger for the same event.

Configuration:

  1. Enable "Suppress lower priority policies" in Advanced Settings
  2. Set an appropriate priority (higher = evaluated first)

Cooldown​

Cooldown limits how frequently integration and threat actions trigger for the same policy/user combination.

Configuration:

  • Specify cooldown in seconds
  • Default is 60 seconds

Effect:

  • Integrations are only triggered once per cooldown period
  • Prevents alert flooding for repeated events

Note: Cooldown affects integrations and threat creation, not safeguards. Safeguards have their own cooldown configuration.

Example configurations​

High-severity threat alert​

Integrations:
  - Alerting integration (e.g., Slack, Teams)
  - Event forwarding integration (e.g., SIEM)

Actions:
  - Create Threat: Enabled
  - Include in Reporting: Enabled
  - Evidence Collection: Enabled

Cooldown: 300 seconds (5 minutes)

DLP monitoring​

Integrations:
  - Event forwarding integration

Actions:
  - Include in Reporting: Enabled
  - Create Threat: Disabled
  - Evidence Collection: Enabled

Cooldown: 60 seconds

Audit logging only​

Integrations:
  - None

Actions:
  - Include in Reporting: Enabled
  - Create Threat: Disabled
  - Label: "policy-audit"

Cooldown: 0 (no cooldown)

Critical threat response​

Integrations:
  - Multiple alerting integrations
  - Event forwarding integration
  - Evidence collection

Actions:
  - Create Threat: Enabled
  - Include in Reporting: Enabled
  - Evidence Collection: Enabled
  - Suppress: Enabled

Priority: 5 (Highest)
Cooldown: 0 (alert every occurrence)

Best practices​

  1. Match integrations to severity — High-severity policies should alert; low-severity can just log

  2. Use cooldowns appropriately — High-frequency events need cooldowns to prevent alert fatigue

  3. Enable evidence collection selectively — Storage costs can add up; use for investigation-worthy policies

  4. Create threats for actionable events — Only create threats when someone needs to investigate

  5. Use labels for categorization — Labels make searching and filtering easier

  6. Configure redundant integrations for critical policies — Send to multiple destinations for reliability

  7. Test integrations — Verify alerts are received before deploying policies widely

Table of Contents