This section explains how to create and configure workflows within Axonius.
Workflow Interface
The workflow configuration page is divided into two panes:
- Workflow canvas (left pane) - Visually represents the workflow structure.
- Configuration (right pane) - Displays settings for the selected node.
A workflow consists of:
- Trigger node (top) - Initiates the workflow (Event, Scheduled, or Manual).
- For Event type: The triggering Event is in the top node.
- For Scheduled and Manual types: The triggering Action is in the second node.
- Routes and sub-routes - Sequences of actions, conditions, events, and delays.
Learn how to adjust your view of the new Workflow page, as required.
Creating a New Workflow
To create a Workflow
-
In the left navigation panel, click the Enforcement Center
icon, and then click the Workflows tab.
-
In the All Workflows page that opens, click Create Workflow.
-
A new, activated workflow is created with a default name. Optionally, change the workflow name or deactivate it via the Workflow Settings.
Selecting a Trigger Type
To select the Workflow trigger type
- In the Trigger Type pane, select one of the following:
- Event (the default) - Workflow starts when a specified event occurs. In the Workflow pane, the top node displays the system-generated UUID (preceded by #) as well as an Event label. When the selected triggering Event occurs, the Workflow begins running.
- Scheduled - Automatically runs a triggering action according to a configured schedule. This starts the Workflow run.
- Manual - Runs a triggering action on demand (by clicking Save and Run). This starts the Workflow run.
Configuring the Trigger
To configure the trigger
- Select and set up the trigger:
When you select Trigger Type = Scheduled or Manual, the only button available directly below it is Add Action , as in the second node you need to select the triggering action.
Adding Nodes to the Workflow
This section describes how to add nodes to the Workflow one at a time, as required.
To add nodes
- Hover over the + icon to add nodes.
- Choose from:
- Suggested nodes (if available) - Recommended nodes based on the workflow context. Learn how to use Suggested nodes.
- Add Action
- Select and configure an Action.
- Add Event
- Select and configure an Event. An Event node cannot follow an Action node configured to run on all assets.
- Add Condition
- Configure the Event condition or configure the Action condition with After and True branches.
- Add Delay
- Configure the Delay duration.
- Repeat for Each
- Configure the Sub-Workflow.
Saving and Running/Activating the Workflow
When you have completed building the Workflow, save it and run or activate it.
To save and run/activate the Workflow
- For an Event triggered Workflow - Click Save and Activate.
- For a Scheduled/Manual trigger - Click Save and Run.
The All Workflows folder opens with the newly added Workflow on top of the table. The Workflow is saved to the Drafts (if configuration is incomplete) or Shared Workflows (if configuration is complete) folder.
- Click Save at any time during the configuration to save changes without running/activating.
- Conditions and actions must be fully configured to save and activate/run. If not, the Save/Save and Activate/Save and Run buttons are disabled.
- It is possible to Save a Workflow with a Delay node configured with an invalid Delay time. However, the delay time must be valid to Save and Run or Save and Activate the Workflow.
Configuring Workflow Settings
A newly created Workflow is assigned a default name and is in Activate mode. This section describes how to assign the Workflow another unique name or deactivate it. When you deactivate the Workflow, its configuration remains in the system, but it doesn't run even when its triggering criteria are met.
To configure the Workflow Settings (optional)
-
In the left canvas pane of the New Workflow screen that opens, click the Workflow Settings icon
.
-
In the right pane of the Workflow Settings drawer that opens:
- In Workflow name, change the Workflow name. The new name appears in the Workflow canvas pane.
- Deactivate the Workflow by toggling off Activate.
Using Suggested Nodes
The Axonius Workflows Recommendation engine can suggest the next node to add to your Workflow, making it easier to build complex and dynamic workflows.
- The Recommendation Engine suggests up to three relevant nodes based on the previous node in your Workflow. For example, after a Slack message action, it might suggest a response event or an action condition.
- Suggestions are currently provided only for the node following the bottommost node in the Workflow.
- The Axonius Workflow Node Recommendation engine currently supports specific interactive actions and their response events. It is continuously being improved and will support more nodes in the future.
Benefits of using suggested nodes include:
- Simplifies Workflow building - You can quickly add relevant nodes.
- Improves Workflow logic - Ensures a clear and logical workflow structure.
- Enhances Workflow dynamics - Builds more complex Workflows based on user interaction and responses.
To add a suggested node to the Workflow
-
Under the bottommost node, hover over the + icon to view suggestions.
-
In the Suggested node, click Add [event type] to add the suggested node to the Workflow. You can also choose to add a different node.
The following screen shows the response Event recommended by the system when hovering on the + sign below the Microsoft Teams - Send Message interactive action.
Supported Interactive Actions and Suggested Events
The following table lists the currently supported interactive Actions, and their suggested response Events.
Interactive Action | Suggested Event |
---|---|
Slack - Send Direct Message to a User | Slack Message Response |
Slack - Send Message via Webhook | Slack Message Response |
Microsoft Teams - Send Direct Message to a User | Teams Message Response |
Microsoft Teams - Send Message | Teams Message Response |
Microsoft Teams - Send Direct Message to Assets | Teams Message Response |
Microsoft Teams - Send Direct Message to a Channel | Teams Message Response |
Example - Scheduled Workflow with Slack Interaction
The following example shows a Workflow that begins with a scheduled Enforcement Action that sends a Slack message. Each time a user responds to the Slack message, an event occurs, and based on the response, the workflow continues.
Configure the Workflow as follows
- Set the Trigger Type to Scheduled and configure a schedule plan for the triggering action of the Workflow. The Scheduled label appears in the Trigger By node in the Workflow pane.
- Hover over the Trigger By node, click the + icon, and click Add Action
. An Action node opens; the system- generated UUID appears on the node (preceded by #). A UUID also appears on the Trigger By node.
- In the Select Action pane, select the Slack - Send Direct Message to Assets Enforcement Action as the triggering action. The action name appears in the Action node.
- In the Action Setup pane that opens, do the following:
- Select the Slack - Send Direct Message to Assets Enforcement Action as the triggering action. The action name appears in the Action node.
- Select the Module and Query Name of the query that defines the assets on which to run the Workflow, and click Apply.
- Configure the Required Fields.
- In Additional Fields, configure the predefined responses (buttons) to be added to the Slack message that is sent to each user resulting from the query.
You can also use the Slack - Send Message to Channel enforcement action, which is configured with predefined responses, in a Workflow.
- Hover over the Action node, click the + icon. The , and click
.
This interactive action is not yet supported to provide a suggested response event.
-
In the Event pane that opens, select the Slack Message Response event. The Event pane shows the Retrieved Asset from the previous node. It also shows the Retrieves information in the Event node. This event is sent each time a user responds to the Slack interactive message using the Response buttons.
-
Hover over the Event node, click the + icon, and click
.
-
In the Event Conditions pane that opens, add an Event Condition - If Response Equals Yes. This enables performing one action if the response to the Slack message is Yes (True branch), and another action if the response is other than Yes (After branch).
-
Hover over the True branch (user Response Equals Yes), click the + icon, and then click
to add a Delay node to the True branch. In the Delay pane, configure a delay of 5 hours.
-
Hover over the Delay node, click the + icon, and then click
.
-
In the Action Setup pane that opens, add an Axonius - Add Tag to Assets Enforcement Action to the True branch and configure it, including selecting related assets.
-
Click Save to save the Workflow.