# Triggers

> The events that start an automation. Platform triggers are always available; provider triggers become available when you connect the provider.

A trigger is the event that starts an automation run. Polylane has two kinds:

- **Platform triggers** work in every workspace with no integration required: `cron`, `webhook`, and the `polylane.*` events.
- **Provider triggers** fire when an event arrives from a connected provider. Connecting a provider enables its triggers automatically.

Each trigger carries an event payload the agent uses as context. Filters on the trigger narrow what the automation matches. An automation can have up to 10 triggers. Each trigger type appears at most once per automation, except `cron` and `webhook`, which can repeat.

<triggers-catalog>



</triggers-catalog>

## Trigger families

**Provider events** arrive from connected integrations:

- GitHub: `github.push`, `github.pull_request`, `github.deployment`, `github.workflow_run`, `github.release`, `github.issues`, `github.issue_comment`, `github.review_comment`
- Deployments: `cloudflare.deployment`, `vercel.deployment`, `render.deployment`, `fly.deployment`, `modal.deployment`
- Slack: `slack.message`

**Alerts** use the single `alert` trigger. It fires when a provider alert arrives from Datadog, Honeycomb, Axiom, Sentry, Amazon CloudWatch, Vercel, Render, or Cloudflare. Filter by source and severity (`critical`, `error`, `warning`, `info`, `ok`).

**Platform events** need no integration:

- `polylane.issue.triaged`: an [issue](/detection/issues) finished triage. Filter by source, severity, and status (`incident` or `no_incident`).
- `polylane.change_record.created`: [change intelligence](/detection/change-intelligence) recorded a change.
- `polylane.cloud_account.connected` and `polylane.cloud_account.synced`: filter by provider.
- `polylane.infra_node.created`: a new node appeared in the [topology](/context/topology). Filter by provider.
- `polylane.codebase.synced` and `polylane.repository.created`: [repository](/context/repositories) lifecycle events.
- `polylane.integration.connected`: filter by integration type.
- `cron`: runs on a schedule. Set a cron expression and an optional timezone.
- `webhook`: fires on an inbound request authenticated with the trigger's token.

## Filters

Every provider trigger accepts filters. The available fields depend on the trigger:

- **Code events**: repository, branch, action (for pull requests: `opened`, `synchronize`, `closed`, `merged`), workflow run conclusion, user.
- **Deployments**: account, plus provider-specific fields: project, service or app, environment, branch, deployment state, or region.
- **Slack messages**: channel, channel type, user, keyword, whether the message mentions the bot, and toggles to exclude bot messages and thread replies.

A trigger that alerts you when a production deployment fails on Vercel:

```json [Trigger]
{
  "type": "vercel.deployment",
  "filters": {
    "environments": ["production"],
    "states": ["ERROR"]
  }
}
```

A trigger that runs a weekly review every Monday at 08:00:

```json [Trigger]
{
  "type": "cron",
  "expression": "0 8 * * 1",
  "timezone": "Europe/London"
}
```

A trigger that fires only when an issue from Sentry or CloudWatch is triaged as an incident:

```json [Trigger]
{
  "type": "polylane.issue.triaged",
  "filters": {
    "sources": ["sentry", "cloudwatch"],
    "severities": ["critical", "high"],
    "statuses": ["incident"]
  }
}
```

Configure filters in the console when you build the automation, or pass them on the API payload. See the catalog above for the exact triggers each connected integration exposes. Pair triggers with [actions](/remediation/automations/actions) and [destinations](/remediation/automations/destinations) to complete the automation.