---
title: Managed workflows
description: Understand managed workflows — Elastic-shipped workflow definitions that install automatically and power product features.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7697/explore-analyze/workflows/managed-workflows
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud Serverless
  - Elastic Cloud on Kubernetes
  - Elastic Stack
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available since 9.5
---

# Managed workflows
A *managed workflow* is a workflow definition that Elastic ships and installs automatically. Managed workflows power product features. They are distinct from the workflows you author yourself.

|                        | Managed workflow                                                  | User-authored workflow      |
|------------------------|-------------------------------------------------------------------|-----------------------------|
| Who creates it         | Elastic (installed automatically)                                 | You                         |
| Who maintains the YAML | Elastic                                                           | You                         |
| Editing and deleting   | YAML is read-only; you can't delete the workflow                  | Full edit and delete        |
| Typical use            | Back product functionality (for example, Security alert analysis) | Custom automation you build |

Managed workflows appear with a **Managed** badge in Kibana. By default they are hidden from the Workflows list. To show them, turn on [**Show managed workflows**](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/advanced-settings#kibana-workflows-settings) in Advanced Settings and grant the managed workflow read privileges. Refer to [Set up Workflows > Show managed workflows](/elastic/docs-content/pull/7697/explore-analyze/workflows/get-started/setup#workflows-managed-visibility) for more information.
Configure managed workflows from the settings for the feature that owns them, not by editing their YAML on the **Workflows** page. For example, configure Attack Discovery's managed workflows from [Attack discovery settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7697/solutions/security/ai/attack-discovery/configure-alert-retrieval-from-attacks-page) on the **Attacks** view. You can't edit or delete managed workflow YAML.
<important>
  Turning a managed workflow off on the **Workflows** page can stop the feature that depends on it from running. For example, disabling an Attack Discovery generation or retrieval managed workflow can break or interrupt Attack Discovery runs that rely on it.
</important>