At first glance, the benefits of Custom action are not so obvious to a beginner. I can use them to change firewall rules or for custom alerts.

And for what else?
What functionality in custom action do you use or theoretically would like?

------------------------------
Vlad Kirov
------------------------------

Hello Vlad,

Basically, Custom action scripts will let you have all the integration possibly not possible using default rule response. 

Two possibilities which I can think of are:
-- You can add a script that can send an SMS to stakeholders if you have an SMS gateway.
-- You can integrate with any of the third-party applications and run Some API queries or post some information there
-- Sendmail ( This is already part of your response though )

------------------------------
Vishal Tangadkar
------------------------------

Hi Vlad,

maybe this introduction learning course about custom action scripts on https://www.securitylearningacademy.com helps to enrich your beginner level.
https://www.securitylearningacademy.com/enrol/index.php?id=3106

Regards,
Ralph

------------------------------
Ralph Belfiore
SIEM Expert
pro4bizz GmbH
Karlsruhe
+4972190981727
------------------------------