Set up Workflows
To use workflows, ensure your role has the appropriate privileges. You must also have the appropriate subscription. Refer to the subscription page for Elastic Cloud and Elastic Stack/self-managed for the breakdown of available features and their associated subscription tiers.
To use workflows, you must turn on the feature and ensure your role has the appropriate privileges. You must also have the appropriate subscription. Refer to the subscription page for Elastic Cloud and Elastic Stack/self-managed for the breakdown of available features and their associated subscription tiers.
The workflows feature is turned off by default. To turn it on:
- Go to the Advanced Settings management page in the navigation menu or using the global search field.
- Search for
workflows:ui:enabled. - Toggle the setting on.
- Click Save changes to turn on workflows in your space, then reload the page.
The Workflows page displays in the main navigation menu and you can search for it using the global search field.
Access to workflows is controlled by Kibana privileges. The following table describes privileges required to create, edit, run, and manage workflows.
| Action | Required privilege |
|---|---|
| Access the Workflows page | All or Read for Analytics → Workflows |
| Fully manage workflows | All for Analytics → Workflows |
| Grant access to specific workflow actions | Set sub-feature privileges for Analytics → Workflows |
Managed workflows are Elastic-shipped workflow definitions that install automatically and power product features. They are hidden from workflow experiences by default.
- Go to the Advanced Settings management page in the navigation menu or using the global search field.
- Search for
workflows:ui:showManagedWorkflowsor Show managed workflows. - Toggle the setting on.
- Click Save changes.
When the setting is on and your role includes the managed workflow read privileges, the Workflows list shows a View filter with Custom and Managed options. Custom shows workflows you author yourself. Managed shows Elastic-shipped workflows.
Managed workflow access uses additive sub-feature privileges under Analytics → Workflows → Managed Workflows Actions:
| Action | Required privilege |
|---|---|
| View managed workflow definitions | Read managed workflows |
| View executions for managed workflows | Read managed workflow execution |
| Configure the Alert analysis workflow settings | Update managed workflows |
The Template library is turned off by default. If Template library doesn't appear in the Workflows navigation, have an administrator run the following request from Dev Tools on Elastic Stack or Serverless. This is a global setting, so it applies to all spaces:
POST kbn:/internal/kibana/global_settings
{
"changes": {
"workflowsManagement:library:enabled": true
}
}
The /internal/kibana/global_settings endpoint is an internal API and might change without notice. There is currently no public equivalent.
When the request returns HTTP 200 and workflowsManagement:library:enabled has "userValue": true, reload the page. Template library appears in the Workflows navigation.
- Create and run your first workflow. Refer to Build your first workflow to learn more.
- Create or edit a workflow by describing it in plain language. Refer to Author workflows with natural language to learn more.
- Understand how to use the YAML editor in Kibana to define and run workflows. Refer to Use the YAML editor to learn more.
- Learn what managed workflows are, or configure the Security Alert analysis workflow.