Creating Workflows

Prev Next

This section explains how to create and configure workflows within Axonius.

Workflow Interface

The workflow configuration page is divided into two panes:

  • Workflow canvas (left pane) - Visually represents the workflow structure.
  • Configuration (right pane) - Displays settings for the selected node.

A workflow consists of:

  • Trigger node (top) - Initiates the workflow (Event, Scheduled, or Manual).
    • For Event type: The triggering Event is in the top node.
    • For Scheduled and Manual types: The triggering Action is in the second node.
  • Routes and sub-routes - Sequences of actions, conditions, events, and delays.

Learn how to adjust your view of the new Workflow page, as required.

Creating a New Workflow

To create a Workflow

  1. In the left navigation panel, click the Enforcement Center EC_Icon icon, and then click the Workflows tab.

  2. In the All Workflows page that opens, click Create Workflow.

  3. A new, activated workflow is created with a default name. Optionally, change the workflow name or deactivate it via the Workflow Settings.

Selecting a Trigger Type

To select the Workflow trigger type

  1. In the Trigger Type pane, select one of the following:
    • Event (the default) - Workflow starts when a specified event occurs. In the Workflow pane, the top node displays the system-generated UUID (preceded by #) as well as an Event label. When the selected triggering Event occurs, the Workflow begins running.
    • Scheduled - Automatically runs a triggering action according to a configured schedule. This starts the Workflow run.
    • Manual - Runs a triggering action on demand (by clicking Save and Run). This starts the Workflow run.

Configuring the Trigger

To configure the trigger

  1. Select and set up the trigger:
Note:

When you select Trigger Type = Scheduled or Manual, the only button available directly below it is Add Action AddActionButton, as in the second node you need to select the triggering action.

Adding Nodes to the Workflow

This section describes how to add nodes to the Workflow one at a time, as required.

To add nodes

  1. Hover over the + icon to add nodes.
  2. Choose from:

Saving and Running/Activating the Workflow

When you have completed building the Workflow, save it and run or activate it.

To save and run/activate the Workflow

  • For an Event triggered Workflow - Click Save and Activate.
  • For a Scheduled/Manual trigger - Click Save and Run.

The All Workflows folder opens with the newly added Workflow on top of the table. The Workflow is saved to the Drafts (if configuration is incomplete) or Shared Workflows (if configuration is complete) folder.

Note:
  • Click Save at any time during the configuration to save changes without running/activating.
  • Conditions and actions must be fully configured to save and activate/run. If not, the Save/Save and Activate/Save and Run buttons are disabled.
  • It is possible to Save a Workflow with a Delay node configured with an invalid Delay time. However, the delay time must be valid to Save and Run or Save and Activate the Workflow.

Configuring Workflow Settings

A newly created Workflow is assigned a default name and is in Activate mode. This section describes how to assign the Workflow another unique name or deactivate it. When you deactivate the Workflow, its configuration remains in the system, but it doesn't run even when its triggering criteria are met.

To configure the Workflow Settings (optional)

  1. In the left canvas pane of the New Workflow screen that opens, click the Workflow Settings icon WorkflowSettingsIcon.
    WFSettings

  2. In the right pane of the Workflow Settings drawer that opens:

    • In Workflow name, change the Workflow name. The new name appears in the Workflow canvas pane.
    • Deactivate the Workflow by toggling off Activate.

Using Suggested Nodes

The Axonius Workflows Recommendation engine can suggest the next node to add to your Workflow, making it easier to build complex and dynamic workflows.

  • The Recommendation Engine suggests up to three relevant nodes based on the previous node in your Workflow. For example, after a Slack message action, it might suggest a response event or an action condition.
  • Suggestions are currently provided only for the node following the bottommost node in the Workflow.
  • The Axonius Workflow Node Recommendation engine currently supports specific interactive actions and their response events. It is continuously being improved and will support more nodes in the future.

Benefits of using suggested nodes include:

  • Simplifies Workflow building - You can quickly add relevant nodes.
  • Improves Workflow logic - Ensures a clear and logical workflow structure.
  • Enhances Workflow dynamics - Builds more complex Workflows based on user interaction and responses.

To add a suggested node to the Workflow

  1. Under the bottommost node, hover over the + icon to view suggestions.

  2. In the Suggested node, click Add [event type] to add the suggested node to the Workflow. You can also choose to add a different node.

The following screen shows the response Event recommended by the system when hovering on the + sign below the Microsoft Teams - Send Message interactive action.

SuggestedEventNode.png

Supported Interactive Actions and Suggested Events

The following table lists the currently supported interactive Actions, and their suggested response Events.

Interactive Action Suggested Event
Slack - Send Direct Message to a User Slack Message Response
Slack - Send Message via Webhook Slack Message Response
Microsoft Teams - Send Direct Message to a User Teams Message Response
Microsoft Teams - Send Message Teams Message Response
Microsoft Teams - Send Direct Message to Assets Teams Message Response
Microsoft Teams - Send Direct Message to a Channel Teams Message Response

Example - Scheduled Workflow with Slack Interaction

The following example shows a Workflow that begins with a scheduled Enforcement Action that sends a Slack message. Each time a user responds to the Slack message, an event occurs, and based on the response, the workflow continues.

Configure the Workflow as follows

  1. Set the Trigger Type to Scheduled and configure a schedule plan for the triggering action of the Workflow. The Scheduled label appears in the Trigger By node in the Workflow pane.
  2. Hover over the Trigger By node, click the + icon, and click Add Action AddActionButton. An Action node opens; the system- generated UUID appears on the node (preceded by #). A UUID also appears on the Trigger By node.
  3. In the Select Action pane, select the Slack - Send Direct Message to Assets Enforcement Action as the triggering action. The action name appears in the Action node.
  4. In the Action Setup pane that opens, do the following:
    1. Select the Slack - Send Direct Message to Assets Enforcement Action as the triggering action. The action name appears in the Action node.
    2. Select the Module and Query Name of the query that defines the assets on which to run the Workflow, and click Apply.
    3. Configure the Required Fields.
      ExampleActionRequiredFields
    • In Additional Fields, configure the predefined responses (buttons) to be added to the Slack message that is sent to each user resulting from the query.
      ExampleActionAdditionalFields
Note:

You can also use the Slack - Send Message to Channel enforcement action, which is configured with predefined responses, in a Workflow.

  1. Hover over the Action node, click the + icon. The , and click AddEventButton.
Note:

This interactive action is not yet supported to provide a suggested response event.

  1. In the Event pane that opens, select the Slack Message Response event. The Event pane shows the Retrieved Asset from the previous node. It also shows the Retrieves information in the Event node. This event is sent each time a user responds to the Slack interactive message using the Response buttons.
    WFExampleEvent

  2. Hover over the Event node, click the + icon, and click AddConditionButton.

  3. In the Event Conditions pane that opens, add an Event Condition - If Response Equals Yes. This enables performing one action if the response to the Slack message is Yes (True branch), and another action if the response is other than Yes (After branch).
    ExampleEventCond

  4. Hover over the True branch (user Response Equals Yes), click the + icon, and then click AddDelayButton to add a Delay node to the True branch. In the Delay pane, configure a delay of 5 hours.

  5. Hover over the Delay node, click the + icon, and then click AddActionButton.

  6. In the Action Setup pane that opens, add an Axonius - Add Tag to Assets Enforcement Action to the True branch and configure it, including selecting related assets.

  7. Click Save to save the Workflow.
    WFExampleImage5