# Event Workflow Actions

You can include any of the following actions in an event workflow. Each action updates one event and then passes it to the next action.

• Workflow trigger — Every workflow starts with a trigger, which defines the events that trigger the workflow.

• Drop Event action — Drop events that pass a previous filter in the workflow, such as a Time Filter.

• Extract Substring action — Extract a string from an input field using a regex and then apply the result to one or more output fields.

• Match and Update action — Search for a set of strings in a set of fields, then update a field based on the results. This is useful for normalizing events with different formats.

• Query Catalog action — Enrich your events by mapping data from a catalog to new events.

• Parse FQDN action — Parse a field with an FQDN and then copy the hostname and domain name to other fields.

• Replace String action — Replace a field with a new string.

• Set Service action — Update the service field if an event passes a previous filter.

• Set Severity action — Update the severity field if an event passes a previous filter.

• Split action — Split one field into substrings based on a character pattern and then copy the substrings to other fields.

• Template Field Action — Update a field based on the values of other fields.

• Time Filter Action —Filter events based on a specific time window or day of the week.