EDR new responses definition
actually responses definition include Powershell, Batch, Command line, Awareness and taken picture. It should be extend to E-Mail, SNMP Trap and Web-hook. At least E-Mail should be implement. That way one could decide to send E-Mail based on filtered event.
It is actually possible to send E-Mail for a complete event-type but not to define further condition under which the E-Mail should be sent ( user, folder, computer, etc, ...). Of course it is possible to write script but E-Mail is already there in the solution.
It sould be although possible to restrict the action repetition if one action (f.e access a file) leads to multiple event-entries.