MonsterOps logo MonsterOps
Docs / Automation / Automation

Automation

Overview

Automation is event-driven: "when X happens, do Y." A rule matches an event (plus optional conditions) and runs one action. It's the glue that lets MonsterOps react to what's happening on the network without you watching.

Automation is event-driven; its sibling the Scheduler is time-driven. Both are safe to start small — one rule — and expand once you trust the behaviour.

Where things are

  • Rule list — your rules, each showing its trigger event and action.
  • Rule editor — pick the event (e.g. user.disabled, nas.created), add optional conditions, and choose one action.
  • Actions — logging, webhooks, email, enable/disable users, group membership, firewall_ban, and Run NAS command.

Run NAS command

The Run NAS command action runs a single CLI command on a managed NAS over SSH when the event fires, using the credentials NAS Manager already stores. The command can reference the triggering event through placeholders:

  • {entity_id} — the entity the event is about (e.g. the username)
  • {actor} — who triggered it
  • {type} — the event type
  • {data.<key>} — any field from the event payload

So a rule can act on whatever fired it. The classic example — kick a user's live session the moment they're disabled on a MikroTik BRAS:

Event:   user.disabled
Action:  Run NAS command on  →  BRAS-01
Command: /ppp active remove [find name="{entity_id}"]

Common tasks

  • Auto-ban brute force — pair a rejection-threshold event with firewall_ban (see also the Firewall brute-force auto-block).
  • Notify on an event — use the webhook or email action to alert an external system.
  • Disconnect on disable — the Run NAS command example above.

Problems you may hit

A Run NAS command rule does nothing

It's a logged no-op (never an error) if the target NAS is missing, disabled, or the command is empty. Check the target device is managed in NAS Manager with working credentials, and look at the automation log.

  • Placeholders come out literally — substitution is an explicit whitelist ({entity_id}/{actor}/{type}/{data.<key>}); other braces pass through untouched by design. Use exactly those tokens.
  • Rule never fires — the event name or a condition doesn't match; simplify to just the event first, confirm it fires, then add conditions back.