From 1b6e638356686c77d09a5ae7fc83fc8fcedcd492 Mon Sep 17 00:00:00 2001
From: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Date: Fri, 23 Jan 2026 10:02:09 -0500
Subject: [PATCH] Update policy automation definitions and triggers (#38325)

Clarified the definition of 'newly failing' policies and updated
automation triggering details.
---
 articles/automations.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/articles/automations.md b/articles/automations.md
index df8993ea3b..cfa503553f 100644
--- a/articles/automations.md
+++ b/articles/automations.md
@@ -13,11 +13,11 @@ You can automatically send activites to a webhook URL or a [log destination](htt
 
 ## Policy automations
 
-Policy automations are triggered if a policy is newly failing on at least one host.
+Policy automations are triggered if a policy is newly failing on at least one host. A policy is "newly failing" if a host updated its response from "no response" to "failing" or from "passing" to "failing."
 
-> Note that a policy is "newly failing" if a host updated its response from "no response" to "failing" or from "passing" to "failing."
+Automations are only fired for Fleet's scheduled policy runs. Running a live policy doesn't trigger automations.
 
-Fleet checks whether to trigger policy automations once per day by default.
+Fleet triggers policy automations once per day by default ([configurable](https://fleetdm.com/docs/rest-api/rest-api#webhook-settings)).
 
 For webhooks, if a policy is newly failing on more than one host during the same period, a separate webhook request is triggered for each host by default.