1）Purpose：
Utilize SmartEvent's Automatic Reaction feature to automatically execute a response script when specific attack events (such as Nikto scans) are detected, enhancing automation and real-time threat response.
2）Use Case：
A.Security administrators want to automatically block source IPs upon detecting intrusion behaviors like Nikto Security Scanner scans.
B.Integrates SmartEvent’s event detection with custom scripts to enable fast and automated response without manual intervention.
C.Ideal for test or production environments requiring immediate mitigation of known attack patterns, along with response logging.
3）Requirements：
SmartEvent Server and SmartEvent Correlation Unit must be deployed and enabled.
The relevant attack event (e.g., Nikto scan) must be identifiable in the logs and captured by the Correlation Unit.
An Automatic Reaction rule must be configured and linked to a script (the script should be placed in $RTDIR/bin/ext_commands/ on the SmartEvent Server and granted executable permissions).
