# Workflows

**Agentic Workflows** bring intelligent Directed Acyclic Graph (DAG) structure and automation to your security apps. Use workflows to structure multi-step actions, orchestrate investigations, and automate across [data sources](/integrations/data-sources.md) and [connectors](/integrations/connectors.md).

Workflows are one of the building blocks that make up an [app](/workspace/apps.md), alongside [queries](/workspace/apps/queries.md), [canvases](/workspace/apps/canvases.md), and [alerts](/workspace/apps/alerts.md).

<figure><img src="/files/ORnQMPUCCWM8w4BEGrqM" alt="Agentic Workflows"><figcaption><p>AI-powered workflows</p></figcaption></figure>

{% hint style="success" %}
Workflows combine **AI-native reasoning** with **structured execution** to overcome single prompts and old school automation limitations, bringing flexibility, transparency, and real-world resilience **to your security operations**.

<p align="right"><img src="/files/u9RHZRvhr64TfNP6IjXP" alt=""> <a href="https://sola.security/blog/agentic-workflows-security-operations/"><strong>Learn more in the Sola blog</strong></a> </p>
{% endhint %}

{% hint style="info" %}
**Pricing and plans**

Workflows can be created on the Free plan.\
Execution and automatic enablement are available on [paid plans](https://sola.security/pricing/).
{% endhint %}

{% embed url="<https://sola.security/pricing/>" %}

## Workflow components

Workflows are made up of key components that define how they start, run, and deliver results.

{% hint style="info" %}
**Single-step AI block**

In Sola Workflows, each **AI block (step)** is like an AI agent. It takes input from the previous block, uses the necessary data sources and tools, and performs the task defined in the prompt.
{% endhint %}

<table data-header-hidden><thead><tr><th width="177.31640625">Component</th><th>Description</th></tr></thead><tbody><tr><td><strong>Trigger</strong></td><td><p>Defines when a workflow starts, such as on a schedule (e.g., daily at 10 AM), in response to an event (e.g., a new alert), or manually.</p><p><br>Defines when a workflow starts. Supported trigger types: <strong>Schedule</strong> (at a defined time or interval), <strong>Alert</strong> (when a specific alert fires), <strong>On-demand</strong> (triggered manually), or <a href="#webhook-trigger"><strong>Webhook</strong></a> (triggered by an incoming HTTP request from an external system).</p></td></tr><tr><td><strong>Step / Block</strong></td><td>A single action in the workflow, such as running security queries, filtering results, performing cross-platform checks, sending notifications, or sending emails.</td></tr><tr><td><strong>Prompt</strong></td><td>The AI instruction that guides a workflow step.</td></tr><tr><td><strong>Automation</strong></td><td>The ability to automatically gather, analyze, and take action on data (e.g., find users without MFA, determine who has the most permissions, send a Slack message, send an email, or create a ticket).</td></tr><tr><td><strong>Integrations</strong></td><td><a href="/pages/vYlag84wtwlnfmuULiEh">Data sources</a> and <a href="/pages/rbkjXI8u4MU5mYr6onVw">connectors</a> (e.g., AWS, GitHub, Slack, Jira) for coordinated actions.</td></tr><tr><td><strong>Notifications and reporting</strong></td><td>Configurable outputs at the end of a workflow to share results, alerts, or summaries with relevant stakeholders.</td></tr><tr><td><strong>Execution</strong></td><td>A single run of a workflow from trigger to completion, with all steps performed and results tracked for review.</td></tr><tr><td><strong>Directed Acyclic Graph (DAG)</strong></td><td>The structured visual representation of workflow steps, showing the order, logic, and connections without loops.</td></tr></tbody></table>

## Creating workflows

Workflows enable multi-step orchestration and automations that use queries, [connectors](/integrations/connectors.md), and AI to respond to security issues, coordinate actions, and reduce manual effort. They can be used for remediation, enrichment, reporting, and other structured flows directly inside your app.

Each workflow is structured as a Directed Acyclic Graph (DAG), giving you precise control over the order, conditions, and logic of each step. Ensuring consistent, repeatable responses to security events.

**To create a workflow**, use [Sola AI](/getting-started/sola-ai.md) to describe the outcome you want.&#x20;

Sola AI will build your workflow, adding AI blocks (steps) with **prompts**, **connectors**, and **logic** based on your request. You can then review and adjust each prompt, connected data sources, and actions.

{% hint style="info" %}
Workflows can only be created with Sola AI, not by manually building steps.

Describe the workflow you need, and Sola AI will generate the blocks and logic for you, which you can adjust manually or with Sola AI.
{% endhint %}

## Running and managing workflows

Workflows can be run manually, on a schedule, or triggered by events within Sola. When a workflow runs, each AI block executes in sequence according to the defined sequential logic.

**To run a workflow**:

* **On-demand** - Trigger the workflow manually from the app.
* **Schedule** - Run the workflow automatically at a defined time or interval.
* **Alert** - Start a workflow when a specific alert fires.
* **Webhook** - Start a workflow automatically when an external system sends an HTTP request to the workflow's webhook URL.

After a run completes, you can review the output for every step to see what actions were taken, what data was used, and the results produced. This provides visibility to validate the workflow’s effectiveness and debug issues.

**To manage a workflow**:

* **Edit step prompts** - Adjust the instructions for each step manually or with Sola AI.
* **Update connectors** - Change or add integrations used by the workflow.
* **Adjust logic** - Modify conditions, branching, or sequence to adapt to evolving needs.

### Webhook trigger

The webhook trigger lets you start a workflow automatically from any external system that can send an HTTP request, such as a security tool, alerting platform, or custom script.

To set up a webhook trigger:

1. Open a workflow and click the Trigger block to open the side panel.
2. Select the Webhook trigger, name the tigger,&#x20;
3. Give the trigger a name (optional).
4. Click Save. The webhook URL is generated automatically after the first save.
5. Copy the URL and configure it in your external system.

Optionally, add Advanced filters to control which incoming payloads trigger the workflow.

{% hint style="info" %}
**Rotating your webhook URL**

Use Refresh token in the trigger side panel to rotate your webhook URL. Make sure to update any external systems using the old URL.
{% endhint %}

## What makes Sola workflows different

![](/files/u9RHZRvhr64TfNP6IjXP) **AI-native, not just AI-supported**\
Sola Workflows don’t just use AI, they are AI native. AI drives the logic, flow, and outcomes. This means they can reason and adapt dynamically, making them far more flexible and effective than traditional automations.

![](/files/u9RHZRvhr64TfNP6IjXP) **Resilient and adaptive execution**\
Traditional automations fail when they hit friction such as missing data, edge cases, or unexpected inputs. Sola’s AI-led workflows adapt in real time. They’re designed to creatively solve blockers, improvise when needed, and maintain progress toward meaningful outcomes.

![](/files/u9RHZRvhr64TfNP6IjXP) **Deterministic where it matters**\
Sola combines the flexibility of AI with the control of determinism. Enforcing strict and reliable logic for actions where precision is critical. Ensuring predictability and auditability.

![](/files/u9RHZRvhr64TfNP6IjXP) **Security intelligence built-in**\
Every workflow is grounded in Sola’s domain expertise and understanding of security context. Instead of just executing tasks, workflows reason over identity, access, risk severity, and posture impact, turning automations into intelligent responses.

## Workflow credits and usage

Workflow credits power AI usage for running agentic workflows. Each workflow run consumes workflow credits based on the number of steps and the complexity of the workflow.

**Your workflow credit allowance refreshes weekly** on the same day your subscription began. Workflow credits do not roll over. If you reach your weekly workflow credit limit, workflow executions pause until credits refresh.

[**Upgrade your plan for higher limits.**](https://sola.security/pricing/)

{% embed url="<https://sola.security/pricing/>" %}

***

## FAQs

### Are workflows only for automating scheduled processes?

No. A single prompt can be used in most cases. However, when running complex and multiple step investigations, workflows can help create a relatively more deterministic outcome, be simpler to debug and provide more transparency into the outcome of each step in a long process.

### What data sources and connectors can workflows use?

Workflows can potentially utilize any data source or connector associated with the app it is built in. To do this, data sources and connectors must be associated with the app beforehand. In addition, like the chat, workflows have the native ability to use the web for fetching specific information (with the same compliance and guardrails of the Sola chat).<br>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.sola.security/workspace/apps/workflows.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.