Workflows

Structure and automate your security operations with AI-native flows

Agentic Workflows bring intelligent Directed Acyclic Graph (DAG) structure and automation to your security projects. Use workflows to structure multi-step actions, orchestrate investigations, and automate across data sources and connectors.

Workflows are one of the building blocks that make up an project, alongside queries, canvases, and alerts.

AI-powered workflows

Workflows combine AI-native reasoning with structured execution to overcome single prompts and old school automation limitations, bringing flexibility, transparency, and real-world resilience to your security operations.

Learn more in the Sola blog

Pricing and plans

Workflows can be created on the Free plan. Execution and automatic enablement are available on paid plans.

PricingSola Security

Workflow components

Workflows are made up of key components that define how they start, run, and deliver results.

Single-step AI block

In Sola Workflows, each AI block (step) is like an AI agent. It takes input from the previous block, uses the necessary data sources and tools, and performs the task defined in the prompt.

Trigger	Defines when a workflow starts, such as on a schedule (e.g., daily at 10 AM), in response to an event (e.g., a new alert), or manually. Defines when a workflow starts. Supported trigger types: Schedule (at a defined time or interval), Alert (when a specific alert fires), On-demand (triggered manually), or Webhook (triggered by an incoming HTTP request from an external system).
Step / Block	A single action in the workflow, such as running security queries, filtering results, performing cross-platform checks, sending notifications, or sending emails.
Prompt	The AI instruction that guides a workflow step.
Automation	The ability to automatically gather, analyze, and take action on data (e.g., find users without MFA, determine who has the most permissions, send a Slack message, send an email, or create a ticket).
Integrations	Data sources and connectors (e.g., AWS, GitHub, Slack, Jira) for coordinated actions.
Notifications and reporting	Configurable outputs at the end of a workflow to share results, alerts, or summaries with relevant stakeholders.
Execution	A single run of a workflow from trigger to completion, with all steps performed and results tracked for review.
Directed Acyclic Graph (DAG)	The structured visual representation of workflow steps, showing the order, logic, and connections without loops.

Creating workflows

Workflows enable multi-step orchestration and automations that use queries, connectors, and AI to respond to security issues, coordinate actions, and reduce manual effort. They can be used for remediation, enrichment, reporting, and other structured flows directly inside your project.

Each workflow is structured as a Directed Acyclic Graph (DAG), giving you precise control over the order, conditions, and logic of each step. Ensuring consistent, repeatable responses to security events.

To create a workflow, use Sola AI to describe the outcome you want.

Sola AI will build your workflow, adding AI blocks (steps) with prompts, connectors, and logic based on your request. You can then review and adjust each prompt, connected data sources, and actions.

Workflows can only be created with Sola AI, not by manually building steps.

Describe the workflow you need, and Sola AI will generate the blocks and logic for you, which you can adjust manually or with Sola AI.

Running and managing workflows

Workflows can be run manually, on a schedule, or triggered by events within Sola. When a workflow runs, each AI block executes in sequence according to the defined sequential logic.

To run a workflow:

• On-demand - Trigger the workflow manually from the project.

• Schedule - Run the workflow automatically at a defined time or interval.

• Alert - Start a workflow when a specific alert fires.

• Webhook - Start a workflow automatically when an external system sends an HTTP request to the workflow's webhook URL.

After a run completes, you can review the output for every step to see what actions were taken, what data was used, and the results produced. This provides visibility to validate the workflow’s effectiveness and debug issues.

To manage a workflow:

• Edit step prompts - Adjust the instructions for each step manually or with Sola AI.

• Update connectors - Change or add integrations used by the workflow.

• Adjust logic - Modify conditions, branching, or sequence to adapt to evolving needs.

Webhook trigger

The webhook trigger lets you start a workflow automatically from any external system that can send an HTTP request, such as a security tool, alerting platform, or custom script.

To set up a webhook trigger:

1. Open a workflow and click the Trigger block to open the side panel.

2. Select the Webhook trigger, name the tigger,

3. Give the trigger a name (optional).

4. Click Save. The webhook URL is generated automatically after the first save.

5. Copy the URL and configure it in your external system.

Optionally, add Advanced filters to control which incoming payloads trigger the workflow.

Rotating your webhook URL

Use Refresh token in the trigger side panel to rotate your webhook URL. Make sure to update any external systems using the old URL.

What makes Sola workflows different

AI-native, not just AI-supported Sola Workflows don’t just use AI, they are AI native. AI drives the logic, flow, and outcomes. This means they can reason and adapt dynamically, making them far more flexible and effective than traditional automations.

Resilient and adaptive execution Traditional automations fail when they hit friction such as missing data, edge cases, or unexpected inputs. Sola’s AI-led workflows adapt in real time. They’re designed to creatively solve blockers, improvise when needed, and maintain progress toward meaningful outcomes.

Deterministic where it matters Sola combines the flexibility of AI with the control of determinism. Enforcing strict and reliable logic for actions where precision is critical. Ensuring predictability and auditability.

Security intelligence built-in Every workflow is grounded in Sola’s domain expertise and understanding of security context. Instead of just executing tasks, workflows reason over identity, access, risk severity, and posture impact, turning automations into intelligent responses.

Workflow credits and usage

Workflow credits power AI usage for running agentic workflows. Each workflow run consumes workflow credits based on the number of steps and the complexity of the workflow.

Your workflow credit allowance refreshes weekly on the same day your subscription began. Workflow credits do not roll over. If you reach your weekly workflow credit limit, workflow executions pause until credits refresh.

Upgrade your plan for higher limits.

PricingSola Security

---

FAQs

Are workflows only for automating scheduled processes?

No. A single prompt can be used in most cases. However, when running complex and multiple step investigations, workflows can help create a relatively more deterministic outcome, be simpler to debug and provide more transparency into the outcome of each step in a long process.

What data sources and connectors can workflows use?

Workflows can potentially utilize any data source or connector associated with the project it is built in. To do this, data sources and connectors must be associated with the project beforehand. In addition, like the chat, workflows have the native ability to use the web for fetching specific information (with the same compliance and guardrails of the Sola chat).