As a PhishER user, I would like the ability to have a rule run based on the following time related events:
- Enable or Disable the action based on a time related schedule. (Action Scheduling)
- Run the action every HH:MM against messages that have been received. (Recurring Actions)
- Run the action HH:MM after the message was received. (Allows actions to be delayed)
The time related settings should NOT be a trigger, these settings should work in conjunction with the Triggers.
NOTE: By allowing recurring Actions, the recurring action be used as a work around for actions running other actions, or message state changes triggering actions, as you can filter and target the messages you want using tags in combination with the recurring action.
Recurring Action Name "ActionTwo"
Action Schedule: Run every 5 Minutes
1. Trigger Specify Tags: HAS TAGS: "RunActionTwo" AND NOT TAGS: "ActionTwoComplete"
2. Choose Action: ADD TAG: "ActionTwoComplete"
3. Report Action: Syslog Out
4. Stop Further Actions: This should be Greyed out as Recurring Actions can not trigger actions processed when a message is received and by definition can not be "blocking actions".
5. QuickAction: Should be Greyed out.
6. Delete Matches: User dependent.
I would also suggest making Recurring Actions a completely separate action "type" and put them on a different tab. This way the user doesn't get confused between actions that are run when a message is received vs. recurring actions.
- Recurring Actions should NOT be run when a message is received. This will help reduce confusion around action run order.
- I would also set a parameter than no recurring actions can be run against a message until all other actions have been processed.
- This will prevent a race condition that could possibly occur when a recurring action is scheduled to run against a message that was just received and has not had the other actions applied yet (a recurring rule might run against a message that would of been deleted if the actions had followed the correct order).
Please sign in to leave a comment.