Using Workflow Data from Previous Nodes

Workflows automatically store data from preceding nodes in a centralized Workflow data repository. This repository allows you to dynamically utilize data from earlier Events, Actions, Variables, and Artifacts within subsequent nodes, enhancing workflow flexibility and automation.

The Workflow data repository enables you to:

• Dynamically change the asset for an Action node from the default (the asset transmitted from the prior node) to resolved assets from previous Events or Actions.
• Incorporate asset field values from previous nodes directly into queries that return assets on which to run the Action, Dynamic Value statements, and Event conditions.

Workflow Data Repository

The Workflow data dialog provides access to stored data, categorized into the following tabs:

• Events data - Displays parsed fields specific to each Event node, including queries for extracting asset fields from the asset that initially triggered the Event.
• Actions data- Displays assets and the results of Dynamic Value statements from each Action node, along with queries for extracting relevant asset fields.
• Variables - Lists all variables that have been explicitly written to the repository.
• Artifacts data - Provides information related to artifacts generated by previous actions.

To access and manage the Workflow data:

• Expand/collapse the Workflow Data dialog by clicking the +/- icon in the header.
• Each node's data is uniquely identified by its UUID, alongside its associated Action or Event name.
• Copy data from previous nodes directly into the configuration of the current node you are working on.
• Changes made to the asset in an Action node automatically propagate to all subsequent nodes in the same Workflow path.
• Data from Bulk Action nodes is not available within the Workflow Data repository.

Using Workflow Data Fields

You can use data from previous Event, Action, and Variable nodes in your Workflow:

• Event Conditions - Use values from previous Event fields or adapter fields to create precise field-based conditions that determine when an event triggers.
• Action Configurations -
  • Use the Query Wizard within an Action node's configuration to select a different asset for the action to run on, using resolved assets in prior steps.
  • Dynamic Value statements - Integrate values from previous nodes directly into your Dynamic Value statements.

You can copy stored data from:

• Previous Event nodes - Access specific values from Event fields or directly from adapter fields that were part of the Event's data.
• Previous Action nodes - Retrieve values from Enforcement Action configuration fields (parameters defined in the action form) or from adapter fields associated with the action run.

Examples

The following are examples illustrating how to use the Workflow Data repository:

• Modify a 'ServiceNow - Create Incident' action to run on a specific Vulnerability asset. This might involve retrieving a field such as "BambooHR Subdomain" field from a preceding 'BambooHR - Suspend Employee' action (e.g., Action[06E0].form.subdomain) to enrich the incident details.

• Change an Action node's asset to a Device where the Owner field value is based on the 'Manager Name' field extracted from an earlier 'Slack Message' event.

Viewing Resolved Assets

By default, a Workflow Action (non-triggering) runs on the asset resolved from the immediately preceding node in the Workflow path. However, you can use the Workflow Data repository to configure the action to run on an asset resolved from any previous node in the Workflow, regardless of the node directly preceding it.

You can view all the resolved data from previous Event nodes (in Events Data) and Action nodes (in Actions Data).

For example, if an 'Axonius - Send Email' action resolves a Vulnerability asset, you can view the details of that specific Vulnerability asset within the Actions Data tab of the Workflow Data dialog.