Skip to main content
Workflows let you set up event-driven automations that fire when something happens in your workspace: a finding is published, new assets are discovered, or a report is delivered. Use them to push notifications to Slack, Discord, custom webhooks, or email. Open the Workflows page from Management > Workflows in the sidebar.
Workflows is enabled per organisation. If it isn’t in your sidebar, check Billing or ask your Borg contact to enable it.

​
Events

Every workflow starts with a single event node:

​
Conditions

Conditions filter which events actually trigger the workflow. Each condition compares a variable from the event payload against a value using an operator. A workflow with no conditions fires on every matching event.

​
Operators

The operators offered depend on the variable you pick, so the choice is narrower than the operator list in the left sidebar. Pick the variable first: if the operator you dragged in isn’t valid for it, the panel resets to one that is.

​
Required and optional conditions

Each condition node is either Required or Optional, and the two groups combine:
  • Every required condition must pass (AND).
  • If any optional conditions exist, at least one of them must pass (OR).
So to catch findings scoring above 7 that are labelled either High or Critical, make the CVSS condition required and the two severity-label conditions optional.
New Report workflows can’t use conditions at all. Connect the event node straight to an action. Switching an existing workflow’s event to New Report removes its condition nodes.

​
Variables

Affected Assets and Root Domain come with a picker that loads values from your own asset inventory, so you don’t have to type them exactly. For Affected Assets you can also type a fragment to match on instead. For New Asset Discovered, conditions run against each asset individually before it joins the batch. Assets that fail the conditions are left out of the notification entirely.

​
Actions

When an event passes your conditions, the action node runs.

​
Webhook

Send an HTTP POST to an external URL. Three presets are available:
  • Slack: posts a formatted message to a Slack incoming webhook
  • Discord: posts a formatted message to a Discord webhook
  • Custom: posts a JSON payload to any URL you specify
Add a custom message and it’s included alongside the event details.
The webhook URL must be http or https and must resolve to a public address. Odin rejects URLs that resolve to private, loopback, or otherwise reserved IP ranges.

​
Email

Send an email to one recipient address. Odin writes the subject and body itself from the event, with the finding’s severity badge, the relevant detail rows, and a link back into Odin. Your custom message, if you add one, appears at the end of that email.

​
Delivery and retries

Odin retries a failed webhook or email with exponential backoff, up to five attempts. Anything still failing after that is moved to a dead-letter queue rather than dropped silently, so a webhook endpoint that’s briefly down won’t lose you a notification.

​
Creating a workflow

1

Open the Workflows page

Go to Management > Workflows in the sidebar and click New.
2

Drag an event node onto the canvas

Pick the event type that should trigger your workflow. A workflow takes one event node.
3

Add condition nodes (optional)

Drag an operator from the sidebar onto the canvas, then click the node to choose its variable, operator, comparison value, and whether it’s required or optional.
4

Drag an action node

Choose Webhook or Email, then fill in the webhook URL or recipient address and any custom message.
5

Connect the nodes

Drag from one node’s output handle to the next node’s input handle, running event to conditions to action.
6

Save and enable

Click Save, then Enable. The workflow starts firing on the next matching event.

​
Managing workflows

The toolbar at the top of the page shows how many automations you have and how many are currently activated. From there you can:
  • Switch workflows: pick another workflow from the dropdown to edit it
  • Enable / disable: toggle a workflow off without deleting it
  • Rename: use the … menu next to the workflow name
  • Delete: also in the … menu, with a confirmation prompt. Deleting can’t be undone
  • Undo: step back through unsaved canvas edits
  • Execution count: the line under the toolbar shows how many notifications this workflow has sent