Workflows let you set up event-driven automations that fire when something happens in your workspace — a new finding is discovered, an asset appears, or a report is generated. Use them to push notifications to Slack, Discord, or email without leaving Odin.Documentation Index
Fetch the complete documentation index at: https://docs.borghq.io/llms.txt
Use this file to discover all available pages before exploring further.
Events
Every workflow starts with an event trigger:| Event | Fires when |
|---|---|
| New Finding | A finding is created (by Mjolnir, black-box testing, or manual triage) |
| New Asset Discovered | A new domain, subdomain or IP is added to your attack surface |
| New Report | A pentest report or findings summary is generated |
Conditions
Conditions let you filter which events actually trigger the workflow. Each condition compares a variable path (e.g.severity.cvss, asset.type) against a value using one of three operators:
| Operator | Behaviour |
|---|---|
| Equals | Exact match — the variable must equal the specified value |
| Includes | The variable contains the specified value (useful for arrays or partial matches) |
| Not Includes | The variable does not contain the specified value |
| Greater Than | The variable is greater than the specified value |
| Less Than | The variable is less than the specified value |
required or not required. If a required condition fails, the whole workflow will fail. Conditions that are not required will not fail the workflow, as long as another condition passes.
You must have a condition.
Variables
Variables are matched against the specified value, to allow for filtering actions.| Variable | Description | Available for |
|---|---|---|
| Severity Label | The finding’s severity rating — LOW, MEDIUM, HIGH, or CRITICAL | New Finding |
| Severity CVSS | CVSS base score from 0.1 to 10 | New Finding |
| Content Title | The finding title from the latest revision (substring match) | New Finding |
| Affected Assets | Matches if any affected asset’s display name contains the value | New Finding |
| Type | The asset type — SUBDOMAIN, DOMAIN, or IP | New Asset Discovered |
| Response Time | HTTP response time in milliseconds from the latest recon scan | New Asset Discovered |
| Status Code | HTTP status code (100–599) from the latest recon scan | New Asset Discovered |
| Root Domain | The root domain the asset belongs to (not applicable for IP assets) | New Asset Discovered |
New Report events do not use variables or conditions. The workflow fires automatically whenever a report is delivered.
Actions
When an event passes your conditions, one or more actions execute.Webhook
Send an HTTP POST to an external URL. Three presets are available:- Slack — sends a formatted message to a Slack incoming webhook
- Discord — sends a formatted message to a Discord webhook
- Custom — sends a JSON payload to any URL you specify
{{variable}} template syntax is available in all three fields.
Creating a workflow
Add a condition (optional)
Drag a condition node onto the canvas and configure the variable path, operator, and value.
Configure the action
Fill in the webhook URL or email details, using
{{variable}} placeholders where needed.Managing workflows
From the Workflows page you can:- Enable / disable — toggle a workflow on or off without deleting it
- Rename — click the workflow name to edit it
- Delete — remove a workflow permanently
- Execution count — see how many times a workflow has fired