you can do whatever you want once your pipeline gets a specific log. zentral and streamalert (for example) both let you add an action to an event