The Data Repository - Using Data from Previous Steps

Workflows automatically store data from preceding steps in a centralized workflow data repository. This repository enables you to dynamically utilize data from previous events, actions, variables, and artifacts within subsequent nodes, thereby enhancing workflow flexibility and automation.

The workflow data repository enables you to:

• Dynamically change the asset for an Action node from the default (the asset transmitted from the prior node) to resolved assets from previous Events or Actions.
• Use asset field values from previous nodes directly in queries that return assets on which to run the Action, Dynamic Value statements, and Event conditions.

Accessing the Workflow Data Repository

You access data in the data repository using the Workflow Data dialog. It provides access to previously stored data, categorized into the following tabs:

• Events data - Displays parsed fields specific to each Event node, including queries for extracting asset fields from the asset that initially triggered the Event.

• Actions data- Displays assets and the results of Dynamic Value statements from each Action node, along with queries for extracting relevant asset fields.

• Variables - Lists all variables that have been explicitly written to the repository.

  📘

  Note

  Variables store data across runs within the same workflow.

  

• Artifacts data - Provides information related to artifacts generated by previous actions.

To access and manage workflow data:

• Expand/collapse the Workflow Data dialog by clicking the +/- icon in the header.
• Each node's data is uniquely identified by its UUID, alongside its associated Action or Event name.
• Copy data from previous nodes directly into the configuration of the current node you are working on.
• Changes made to the asset in an Action node automatically propagate to all subsequent nodes in the same workflow path.
• Data from Bulk Action nodes is not available within the Workflow Data repository.

Using Workflow Data Fields

You can use data from previous Event, Action, and Variable nodes in your workflow:

• Event Conditions - Use values from previous Event fields or adapter fields to create precise field-based conditions that determine when an event triggers.
• Action Configurations -
  • Use the Query Wizard within an Action node's configuration to select a different asset for the action to run on, using resolved assets in prior steps.
  • Dynamic Value statements - Integrate values from previous nodes directly into your Dynamic Value statements.

You can copy stored data from:

• Previous Event nodes - Access specific values from Event fields or directly from adapter fields that were part of the Event's data.
• Previous Action nodes - Retrieve values from Enforcement Action configuration fields (parameters defined in the action form) or from adapter fields associated with the action run.

Data Type Indicators in the Workflow

When building a workflow, the data type is indicated by an icon next to the field name wherever data is used. This provides clear type indicators everywhere fields are selected or inspected within a workflow, including Data Bank, Dynamic Value Wizard, autocomplete, and the debugging node inspector. This includes showing array vs. single-value, object vs. simple types, and preferred vs. aggregated types. Database names appear only on hover or when copied. See The Data Repository - Using Data from Previous Steps for more about using stored data in workflows.

The following table shows the data type icons for each type:

Icon	Data Type
	String
	Numeric
	Float
	Date
	Boolean
	Complex
	IP
	List
	Unknown type

Examples

The following are examples illustrating how to use the Workflow Data repository:

• Modify a 'ServiceNow - Create Incident' action to run on a specific Vulnerability asset. This might involve retrieving a field such as "BambooHR Subdomain" field from a preceding 'BambooHR - Suspend Employee' action (e.g., Action[06E0].form.subdomain) to enrich the incident details.

• Change an Action node's asset to a Device where the Owner field value is based on the 'Manager Name' field extracted from an earlier 'Slack Message' event.

Viewing Resolved Assets

By default, a Workflow Action (non-triggering) runs on the asset resolved from the immediately preceding node in the Workflow path. However, you can use the Workflow Data repository to configure the action to run on an asset resolved from any previous node in the Workflow, regardless of the node directly preceding it.

You can view all the resolved data from previous Event nodes (in Events Data) and Action nodes (in Actions Data).

For example, if an 'Axonius - Send Email' action resolves a Vulnerability asset, you can view the details of that specific Vulnerability asset within the Actions Data tab of the Workflow Data dialog.