Core components

Workflows are composed of three core elements that make workflow automation possible: triggers, steps, and connectors. Together, these components define when workflows run, what they do, and where they can reach.

Triggers

Triggers define when a workflow runs. A trigger is an event or condition that initiates a workflow, such as an alert firing or a scheduled time occurring. Every workflow begins with a trigger.

Examples of triggers include:

A user initiates a workflow on-demand
A specific time or interval is reached
A detection alert is generated

For more information, refer to Triggers.

Steps

Steps define what a workflow does. A step is an individual unit of logic or action within a workflow. Steps control how data moves, how decisions are made, and what results are produced. Workflows can contain one or more steps, executed in sequence.

For more information, refer to [Steps].

Connectors

Connectors define where workflows can reach. A connector is the interface between Kibana and an external system, enabling workflows to act on or respond to events and services outside of Kibana.

For more information, refer to [Connectors].