Workflow Engine overview

Use event workflows to enrich or normalize event data to create more useful or meaningful alerts.

Event workflow triggers use event field values at the time when the event is ingested. Because event workflows change event information before it is used to create alerts, they can change the way events deduplicate and form alerts. Event workflows behaviors focus on changing individual data fields, discarding irrelevant events, and generally ensuring the data is relevant for creating alerts.

For more information, see Event workflow configuration example.

Alert workflows allow you to work with and modify alerts prior to correlation. Use alert workflows to manipulate the way incidents are formed, or simply to manage your alerts. For example, you can increase the severity of an alert based on the source or service, or drop alerts with certain properties so that they are never correlated into incidents. You can assign alerts to groups or individual users to ensure accountability. You can modify the alert description so that the correlated incident includes the information. Alert workflow gives you access to the properties of alerts to help automate alert management and additional ways to customize correlation. Alert workflows can be triggered by the creation of new alerts, or when an existing alert updates, or both. The alert workflow also gives you the option of choosing to trigger for Changes from anywhere, or only Changes from deduplication (when a new event is added to an existing alert via deduplication).

For more information, see Alert workflow configuration example.

Incident workflows let you manipulate data at the incident level. They are triggered by either the creation of an incident or a change to an incident. Qualifying "changes" which can trigger incident workflows include:

Changes occurring due to event deduplication (adding a new event to an alert, changing severity) are not incident changes, however, and will not trigger a workflow with either a New or changed incidents or a Changed incidents only trigger.

Incident workflows manipulate data fields (at the incident level), but also include incident-specific activities, like user and group assignments, sending the incident to external systems, and delayed incident processing. Incident workflows make it possible to:

For configuration information, see Incident workflow configuration example. Refer to Workflow action reference for supported actions and examples. You can also watch a video showing how to set up an incident workflow.

Event, alert, and incident workflows have many common elements and are configured in a similar way. The alert and incident workflow tabs allow you to select between Data Pipeline Workflows and Standalone Workflows, while all event workflows are data pipeline workflows by default.

The headings for the Event Workflows and Data Pipeline Workflows tabs are as follows:

The headings for the Standalone Workflows tab are as follows:

To add a new workflow, click Add Workflow at the top of the table.

Refer to Event workflow configuration example, Alert workflow configuration example, and Incident workflow configuration example for specific instructions on creating data pipeline workflows.

Data catalogs include information you can add to events and incidents via workflow using the Query Catalog action.

Each row on the Data Catalog page represents a separate catalog. A catalog includes column headings, which identify the type of data stored in the column, and rows, which are individual records (documents) of data. This data can be referenced via workflow and transferred to event and incident data fields.

See Create data catalogs for further details.