Glossary: Security Operations and Incident Response

Trigger, condition and action

Also written: trigger, condition, action

The three parts of an automated workflow: the event that starts it, the test that picks a path, and what it does, such as opening ticket 1041.