--- title: "Adding a Trigger Knowledge Base Article | ThreatConnect" slug: "adding-a-trigger" description: "This article describes how to add Triggers in the Playbook Designer." tags: ["Orchestration and Automation"] updated: 2023-05-10T16:57:02Z published: 2023-05-10T16:57:02Z canonical: "knowledge.threatconnect.com/adding-a-trigger" --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # Adding a Trigger 1. To add a Trigger to a Playbook, click the![Playbook Designer Triggers icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Playbook%20Designer%20Triggers%20icon.png)**Triggers**button on the side navigation bar of the **Playbook Designer**. All available Triggers will be displayed to the left of the design pane (Figure 1). To narrow down the results, collapse the sub-menus, or type the name of the desired Trigger in the search bar. ![Figure 1_Adding a Trigger_7.1](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_Adding%20a%20Trigger_7.1.png) 2. Select a Trigger to add to the design pane. See the [“Triggers” section of *Parts of a Playbook*](https://knowledge.threatconnect.com/docs/parts-of-a-playbook#triggers) for a definition of each Trigger. This example uses an Address Indicator Trigger (Figure 2). ![Figure 2_Adding a Trigger_7.1](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_Adding%20a%20Trigger_7.1.png) NoteThe red exclamation point icon at the lower-left corner of the Trigger indicates that required information is missing, creating a validation error. Hover the cursor over the icon on the Trigger to view details on the missing information. Details on validation errors can also be found in the![Validations icon_No Errors](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Validations%20icon_No%20Errors.png)**[Validations](https://knowledge.threatconnect.com/docs/validations)** pane of the side navigation bar, where the icon displayed on the sidebar shows the current number of validation errors in the Playbook (e.g.,![Validations icon_3 Errors](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Validations%20icon_3%20Errors.png)). 3. Double-click inside the Trigger to open the **Edit Trigger**configuration pane on the left side of the screen (Figure 3). Configure the Address Trigger’s basic information in the **Configure** step of the **Edit Trigger** pane. ImportantThe contents of the **Edit Trigger** configuration pane differ for each Trigger type. Click **Display Documentation![Playbooks_Display Documentation icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Playbooks_Display%20Documentation%20icon.png)**at the upper right of the **Edit Trigger** pane to view information about the Trigger, including a description, input parameters, and output variables. Refer to this information when configuring the options in the **Edit Trigger** pane.![Figure 3_Adding a Trigger_7.1](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%203_Adding%20a%20Trigger_7.1.png) - **Trigger Name**: Enter a name for the Address Trigger. - **Trigger****Type**: This****field is pre-populated with the relevant object type (Address in this case) and cannot be edited. - Click the **NEXT** button. 4. Configure the action that will cause the Address Trigger to [execute the Playbook](https://knowledge.threatconnect.com/docs/executing-a-playbook#playbooks-with-a-group-indicator-case-track-or-victim-trigger) in the **Action** step of the **Edit Trigger** pane (Figure 4).![Figure 4_Adding a Trigger_7.1](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%204_Adding%20a%20Trigger_7.1.png) - **Owners**: Select one or more owners where the Address Trigger can be executed. Use the **Select All** link to select all available owners. - **Action Type**: Select the type of action that will cause the Address Trigger to execute the Playbook. NoteDepending on the selected **Action Type**, further selections may be displayed at the bottom of the **Action** section. For example, selecting **Create** for the **Action Type**causes a **Fire on Duplicate** checkbox to be displayed. - Click the **NEXT** button. 5. Configure the filters to apply when determining whether the Address Trigger should execute the Playbook in the **Filters** step of the **Edit Trigger** pane (Figure 5). ![Figure 5_Adding a Trigger_7.1](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%205_Adding%20a%20Trigger_7.1.png) - **Apply “OR” operator to all selected filters**: Select this checkbox to use “OR” logic when multiple filters are in use. - **Add Filters (up to 5)**: Select up to five filters (the number of available filters depends on the **Action** chosen). For each selected filter, use the corresponding dropdown and text box to configure the value that will filter the **Action Type** selected in the previous step. - Click the **SAVE** button. If desired, hover the cursor over the hashtag at the upper-left corner of the Trigger box in the design pane to view a scrollable list of available output variables (Figure 6). Output variables are values that a Trigger, App, or Operator can send to other Triggers, Apps, and Operators. They can be used in an Attribute, the body of an email, etc. ![Figure 6_Adding a Trigger_7.1](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%206_Adding%20a%20Trigger_7.1.png) NoteThe Trigger in this example still shows a validation error because it has not been connected to an output element. See [*Validations*](https://knowledge.threatconnect.com/docs/validations) and *[Connecting Playbook Elements](https://knowledge.threatconnect.com/docs/connecting-playbook-elements)* for more information. Click the **Menu**![Playbook Trigger Menu icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Playbook%20Trigger%20Menu%20icon.png)icon at the upper-right corner of the Trigger box to view a dropdown from which you can edit, disable, clone, or delete the Trigger. --- *ThreatConnect® is a registered trademark of ThreatConnect, Inc.* 20110-22 v.03.A