Online Documentation

Using Action1

Action1 provides unique management experience by allowing you get real-time security information from your entire network of endpoints using simple English language queries.

English Queries

For example, you can type "installed software", "perepherial devices" or "running processes" and almost immediately see live responses from all of your workstations, across the entire network. Query results can be exported into CSV or HTML formats for manual analysis or compliance reporting purposes.

Query   Query Results

Dozens of predefined queries are provided out of the box, addressing the most common secuity and operational needs. Action1 Platform is also very easy to extend and we are working tirelessly to improve its capabilities and add new new types of queries. If you can't find a query that you need, please let us know and we'll try to do our best to add it quickly and at no charge to you (just because we LOVE your feedback!). It usually takes a day or two, depending on the current dev team workfload, to develop and test a new query.

Scheduled queries give you the ability to run certain queries regularly and get results automatically via email at pre-determined intervals. Such as you could receive a list of computers missing security patches every week. To schedule a query, click 'Run on Schedule' button on a query page.

Scheduling Query

Alert Rules
Alert rules allow you to receive instant email notifications when something important happens, such as a new software package is installed or a network share is opened by a user. Alert rules are created based on queries. Most predefined queries can be configured as alerts, with certain limitations. To create a new alert rules, select a query and click "Create Alert". If "Create Alert" button is not available, it means that particular query does not support alerts.


A few predefined alerts are automatically enabled for you upon creation of your Action1 account. For example, you will get alerted on USB device usage, changes to installed software and network confirguration. You can create more alert rules based on existing queries. If you can't find a suitable query to convert to an alert that you need, please let us know and we'll try to do our best to add it quickly and at no charge to you.