Using Workflow Data from Previous Nodes

Workflows automatically store data from preceding nodes in a centralized Workflow data repository. This repository allows you to dynamically utilize data from earlier Events and Actions within subsequent nodes, enhancing workflow flexibility and automation.

The Workflow data repository enables you to:

• Dynamically change the asset for an Action node from the default asset (transmitted from the prior node) to resolved assets from previous Events or Actions.
• Incorporate asset field values from previous nodes into queries that return assets on which to run the Action, Dynamic Value statements, and Event conditions.

Workflow Data Repository

The Workflow data dialog provides access to stored data, organized into the following tabs:

• Events Data - Displays parsed fields per Event, including queries for extracting asset fields from the asset that triggered the Event.
• Actions Data- Displays assets and Dynamic Value statement results from each Action, including queries for extracting asset fields.
• Artifacts Data - Displays information related to artifacts from previous actions.

Access and manage the Workflow data as follows:

• Expand/collapse the Workflow Data dialog by clicking the +/- icon in the header.
• Each node's data is uniquely identified by its UUID, alongside the Action name.
• Copy Event and Action data from previous nodes into the current Action node.
• Changing the asset in an Action node propagates the change to all subsequent nodes in the same path.
• Bulk Action nodes are not available in the Workflow Data repository.

Using Workflow Data Fields

You can use data from previous Event and Action nodes in:

• Event Conditions - Within field condition based on event criteria.
• Action Configurations -
  • Query Wizard used to select a different asset for the action to run on.
  • Dynamic Value statements.

You can copy stored data from:

• Previous Event nodes -
  • Values from Event fields.
  • Values from adapter fields.
• Previous Action nodes -
  • Values from Enforcement Action configuration fields (action form field).
  • Values from adapter fields.

Examples

• Modify a "ServiceNow - Create Incident" action to run on a Vulnerability asset using the "BambooHR Subdomain" field from a "BambooHR - Suspend Employee" action (e.g., Action[06E0].form.subdomain).

• Change an Action's asset to Device with an Owner field value based on the 'Manager Name' field from a 'Slack Message' event.

Viewing Resolved Assets

By default, a Workflow Action (non-triggering) runs on the asset resolved from the previous node in the Workflow. However, you can configure the action to run on an asset resolved from any previous node in the Workflow.

You can view all the resolved data from previous Event nodes (in Events Data) and Action nodes (in Actions Data).

For example, you can view the Vulnerability asset resolved by the 'Axonius - Send Email' action within the Actions Data tab.