> ## Documentation Index
> Fetch the complete documentation index at: https://docs.borghq.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Workflows

> Automate notifications and actions when key events happen in your workspace

Workflows let you set up event-driven automations that fire when something happens in your workspace: a finding is published, new assets are discovered, or a report is delivered. Use them to push notifications to Slack, Discord, custom webhooks, or email.

Open the Workflows page from **Management > Workflows** in the sidebar.

<Info>
  Workflows is enabled per organisation. If it isn't in your sidebar, check **Billing** or ask your Borg contact to enable it.
</Info>

## Events

Every workflow starts with a single event node:

| Event                    | Fires when                                                                                                                                                       |
| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **New Finding**          | A finding is published, or an already-published finding is republished with a new revision                                                                       |
| **New Asset Discovered** | An asset record is added or updated during recon. Asset events are batched per organisation over a 60-second window and delivered as one aggregated notification |
| **New Report**           | A report is marked as delivered                                                                                                                                  |

## Conditions

Conditions filter which events actually trigger the workflow. Each condition compares a variable from the event payload against a value using an operator. A workflow with no conditions fires on every matching event.

### Operators

| Operator                         | Behaviour                                                                                              |
| -------------------------------- | ------------------------------------------------------------------------------------------------------ |
| **equals**                       | The variable equals the value. Numbers are compared numerically, text case-insensitively               |
| **includes**                     | The variable contains the value: a case-insensitive substring for text, or a matching entry for a list |
| **greater than** / **less than** | Numeric comparison                                                                                     |

The operators offered depend on the variable you pick, so the choice is narrower than the operator list in the left sidebar. Pick the variable first: if the operator you dragged in isn't valid for it, the panel resets to one that is.

### Required and optional conditions

Each condition node is either **Required** or **Optional**, and the two groups combine:

* Every **required** condition must pass (AND).
* If any **optional** conditions exist, at least one of them must pass (OR).

So to catch findings scoring above 7 that are labelled either High or Critical, make the CVSS condition required and the two severity-label conditions optional.

<Note>
  **New Report** workflows can't use conditions at all. Connect the event node straight to an action. Switching an existing workflow's event to New Report removes its condition nodes.
</Note>

## Variables

| Variable            | Description                                                       | Operators                       | Event                |
| ------------------- | ----------------------------------------------------------------- | ------------------------------- | -------------------- |
| **Severity Label**  | The finding's severity: Low, Medium, High, or Critical            | equals                          | New Finding          |
| **Severity CVSS**   | CVSS base score, above 0 and up to 10                             | equals, greater than, less than | New Finding          |
| **Content Title**   | The finding title from the latest revision                        | includes                        | New Finding          |
| **Affected Assets** | Matches when any affected asset's display name contains the value | includes                        | New Finding          |
| **Type**            | The asset type: Subdomain, Domain, or IP                          | equals                          | New Asset Discovered |
| **Response Time**   | HTTP response time in milliseconds from the latest recon scan     | greater than, less than         | New Asset Discovered |
| **Status Code**     | HTTP status code (100 to 599) from the latest recon scan          | equals                          | New Asset Discovered |
| **Root Domain**     | The root domain the asset belongs to. Doesn't apply to IP assets  | equals                          | New Asset Discovered |

**Affected Assets** and **Root Domain** come with a picker that loads values from your own asset inventory, so you don't have to type them exactly. For Affected Assets you can also type a fragment to match on instead.

For New Asset Discovered, conditions run against each asset individually before it joins the batch. Assets that fail the conditions are left out of the notification entirely.

## Actions

When an event passes your conditions, the action node runs.

### Webhook

Send an HTTP POST to an external URL. Three presets are available:

* **Slack**: posts a formatted message to a Slack incoming webhook
* **Discord**: posts a formatted message to a Discord webhook
* **Custom**: posts a JSON payload to any URL you specify

Add a custom message and it's included alongside the event details.

<Tip>
  The webhook URL must be `http` or `https` and must resolve to a public address. Odin rejects URLs that resolve to private, loopback, or otherwise reserved IP ranges.
</Tip>

### Email

Send an email to one recipient address. Odin writes the subject and body itself from the event, with the finding's severity badge, the relevant detail rows, and a link back into Odin. Your custom message, if you add one, appears at the end of that email.

### Delivery and retries

Odin retries a failed webhook or email with exponential backoff, up to five attempts. Anything still failing after that is moved to a dead-letter queue rather than dropped silently, so a webhook endpoint that's briefly down won't lose you a notification.

## Creating a workflow

<Steps>
  <Step title="Open the Workflows page">
    Go to **Management > Workflows** in the sidebar and click **New**.
  </Step>

  <Step title="Drag an event node onto the canvas">
    Pick the event type that should trigger your workflow. A workflow takes one event node.
  </Step>

  <Step title="Add condition nodes (optional)">
    Drag an operator from the sidebar onto the canvas, then click the node to choose its variable, operator, comparison value, and whether it's required or optional.
  </Step>

  <Step title="Drag an action node">
    Choose Webhook or Email, then fill in the webhook URL or recipient address and any custom message.
  </Step>

  <Step title="Connect the nodes">
    Drag from one node's output handle to the next node's input handle, running event to conditions to action.
  </Step>

  <Step title="Save and enable">
    Click **Save**, then **Enable**. The workflow starts firing on the next matching event.
  </Step>
</Steps>

## Managing workflows

The toolbar at the top of the page shows how many automations you have and how many are currently activated. From there you can:

* **Switch workflows**: pick another workflow from the dropdown to edit it
* **Enable / disable**: toggle a workflow off without deleting it
* **Rename**: use the **...** menu next to the workflow name
* **Delete**: also in the **...** menu, with a confirmation prompt. Deleting can't be undone
* **Undo**: step back through unsaved canvas edits
* **Execution count**: the line under the toolbar shows how many notifications this workflow has sent