Run a workflow from a case

When investigating a case, you may want to manually trigger a workflow that is available in the workspace but will not be automatically triggered as part of the case lifecycle. You can also use actions to selectively enable specific workflows for particular cases. The first three actions created for a case will be presented as shortcutsfor executing the associated workflows.

One example is creating a Jira ticket from a case - you can automate this process to have the workflow available for when an analyst decides the incident is relevant for a different team in the organization.

When a workflow is triggered from a case, the case ID is available in the workflow metadata so the case can be updated with the workflow execution progress and output.

1. To make a workflow available in case management:
   • The workflow must have an on-demand trigger.
   • Make sure the workflow has a published version. The latest published version is the one that will be executed.
   • To make the workflow available to all cases, select the Expose in cases option in the trigger (see image below). Otherwise, use actions.
2. Trigger a workflow from a case:
   1. Run a workflow: run one of the published workflows in the workspace that are exposed in cases.
   2. Actions : run workflows that were suggested for the case.

Run a workflow 

1. Go to the Cases page and select the relevant case.
2. Select Run a workflow.
3. Select a workflow from the list. 
4. The workflow is executed within the context of the case.

Actions

Use actions to selectively enable specific workflows that aren't necessarily exposed to all cases for a case. The first three actions created for the case will be presented as shortcuts for executing the associated workflows. For example, an action with the title "Enrich IP addr" to run a workflow that enriches IP addresses can be created for all IAM cases. If it's one of the first three actions to be created for the case, the case assignee will be able to easily see there is a workflow available and suggested for this operation.

1. Go to the Cases page and select the relevant case.
2. If actions were configured for the case, the first three will appear at the top of the case timeline. The rest of the actions will be available when selecting Run a workflow together with all workflows exposed to cases.
3. When an action is selected, the workflow it's based on is executed within the context of the case.

How to configure actions

1. Add the Create an action for a case step to a workflow.
2. Provide the ID of the case to which you want to add the action.
3. Enter a meaningful title for the action. The title will help the user understand what will happen when they select the action.
   Note

   The action title length can be between 2 and 20 characters.
4. Enter the ID of the workflow the action is based on. The published version of this workflow will be executed when the user selects the action.

In the example below, actions are added to the case when it's created. A variable containing a JSON object of action title and workflow name pairs is being used as input for the Create an action for a case step.

Workflow execution within the context of a case

1. The case ID is available in the workflow metadata to use during the execution: {{ $.metadata.case.id }}. Use the Get case details step to retrieve more information about the case.
2. The workflow execution status is automatically updated in the case timeline. The entry will include the workflow name, which you can click to get to the execution run log.
3. You can use the Add comment to case step to update the case timeline with important findings during the workflow execution.
   
4.  Timeline entries added by the workflow will include a link to the workflow execution run log.