Creating a Workflow

This section describes how to create a Workflow in Axonius.

A new Workflow's configuration page is split into two panes:

• Left pane - Displays the Workflow canvas.
• Right pane - Displays the configuration options for the currently selected node.

The Workflow structure includes:

• The Trigger Type in the top node.
  • For Event type: The selected triggering Event in the top node.
  • For Scheduled and Manual types: The selected Action in the second node.
• As many routes and sub-routes as are needed, where each one can include:
  • Enforcement Actions
  • Action Conditions
  • Events
  • Event Conditions
  • Delays

Learn how to adjust your view of the new Workflow page, as required.

To create a Workflow

1. In the left navigation panel, click the Enforcement Center icon, and then click the Workflows tab.

2. In the All Workflows page that opens, click Create Workflow.

3. In the left pane of the New Workflow screen that opens, click the Workflow Settings icon , and in the Workflow Settings that open in the right pane, type a Workflow name. The name appears in the Workflow pane.
   

4. In the Trigger Type pane, select the type of Workflow trigger and configure it, as required.

   • For an Event trigger type, this includes selecting the Event for the top node.
   • For a Scheduled trigger type, this includes setting the Schedule Plan of the triggering Action (that you add in the second node).

5. For Scheduled and Manual triggers: Add the triggering Action to the second node of the Workflow.

8. Add nodes to the Workflow one at a time, as required.
   To add a node: Hover over the + icon and add one of the Suggested nodes (if they are displayed) or one of the relevant Workflow nodes:

   • Add a Suggested node to the Workflow.

   • Click Add Action to add an Action node, and then select and configure an Action.

   • Click Add Event to add an Event node, and then select and configure an Event.

     • It is not possible to add an Event node following an Action node configured to run on all assets.

   • Click Add Condition to add a condition to the Workflow.

     • When you add a condition under an Event, an Event Conditions box with False and True branches is added to the Workflow. Configure the Event condition.
     • When you add a condition under an Action, an Action Conditions box with False and True branches is added to the Workflow. Configure the Action condition.

   • Click to add a delay to the Workflow. Configure the Delay node.

6. When you have completed building the Workflow:

   • For a Workflow with an Event trigger, click Save and Activate to activate the Workflow.
   • For a Workflow with a Scheduled or Manual trigger, click Save and Run to run the workflow.

   The All Workflows folder opens with the newly added Workflow on top of the table. The Workflow is added to the Drafts folder (if configuration is incomplete) or Shared Workflows folder (if configuration is complete).

Adding Suggested Node to a Workflow

The Axonius Workflows Recommendation Engine can suggest the next node to add to your Workflow, making it easier to build complex and dynamic workflows.

• The Recommendation Engine suggests up to three possible nodes based on the previous node in your Workflow. For example, after a Slack message action, it might suggest a response event or an action condition.
• Suggestions are currently provided only for the node following the bottommost node in the Workflow.
• The Axonius Workflow Node Recommendation engine currently supports the nodes listed below. It is continuously being improved and will support more nodes in the future.

To add a suggested node to the Workflow

1. Under the bottommost node, hover over the + icon to view suggestions.

2. In the Suggested node, click Add [event type] to add the suggested node to the Workflow. You can also choose to add a different node.

Example

The following example shows the response Event recommended by the system when hovering on the + sign below the Microsoft Teams - Send Message interactive action.

Benefits

• Simplifies Workflow building - You can quickly add relevant nodes.
• Improves Workflow logic - Ensures a clear and logical workflow structure.
• Enhances Workflow dynamics - Builds more complex Workflows based on user interaction and responses.

Supported Nodes

The following table lists the currently supported interactive Actions, and their suggested response Events.

Example - Scheduled Workflow

The following example shows a Workflow that begins with a scheduled Enforcement Action that sends a Slack message. Each time a user responds to the Slack message, an event occurs, and based on the response, the workflow continues.

Configure the Workflow as follows

1. In the Trigger Type pane, click Scheduled, and configure a schedule plan for the triggering action of the Workflow. The Scheduled label appears in the Trigger By node in the Workflow pane.
2. Hover over the Trigger By node, click the + icon, and click Add Action . An Action node opens; the system- generated UUID appears on the node (preceded by #). A UUID also appears on the Trigger By node.
3. In the Action Setup pane, do the following:
   1. Select the Slack - Send Direct Message to Assets Enforcement Action as the triggering action. The action name appears in the Action node.
   2. Select the Module and Query Name of the query that defines the assets on which to run the Workflow, and click Apply.
   3. Configure the Required Fields.
      
   • In Additional Fields, configure the predefined responses (buttons) to be added to the Slack message that is sent to each user resulting from the query.
     

4. Hover over the Action node, click the + icon. The , and click .

5. In the Event pane that opens, select the Slack Message Response event. The Event pane shows the Retrieved Asset from the previous node. It also shows the Retrieves information in the Event node. This event is sent each time a user responds to the Slack interactive message using the Response buttons.
   

6. Hover over the Event node, click the + icon, and click .

7. In the Event Conditions pane that opens, add an Event Condition - If Response Equals Yes. This enables performing one action if the response to the Slack message is Yes (True branch), and another action if the response is other than Yes (False branch).
   

8. Hover over the True branch (user Response Equals Yes), click the + icon, and then click to add a Delay node to the branch. In the Delay pane, configure a delay of 5 hours.

9. Hover over the Delay node, click the + icon, and then click .

10. In the Action Setup pane that opens, add the Axonius - Add Tag to Assets Enforcement Action and configure it, including selecting related assets.

11. Click Save. The Workflow is saved.