Set up Workflows

Serverless Stack 9.4+

To use workflows, ensure your role has the appropriate privileges. You must also have the appropriate subscription. Refer to the subscription page for Elastic Cloud and Elastic Stack/self-managed for the breakdown of available features and their associated subscription tiers.

Stack Preview 9.3+

To use workflows, you must turn on the feature and ensure your role has the appropriate privileges. You must also have the appropriate subscription. Refer to the subscription page for Elastic Cloud and Elastic Stack/self-managed for the breakdown of available features and their associated subscription tiers.

Enable workflows

The workflows feature is turned off by default. To turn it on:

Go to the Advanced Settings management page in the navigation menu or using the global search field.
Search for workflows:ui:enabled.
Toggle the setting on.
Click Save changes to turn on workflows in your space, then reload the page.

The Workflows page displays in the main navigation menu and you can search for it using the global search field.

Manage access to workflows

Access to workflows is controlled by Kibana privileges. The following table describes privileges required to create, edit, run, and manage workflows.

Action	Required privilege
Access the Workflows page	`All` or `Read` for Analytics → Workflows
Fully manage workflows	`All` for Analytics → Workflows
Grant access to specific workflow actions	Set sub-feature privileges for Analytics → Workflows

Show managed workflows

Managed workflows are Elastic-shipped workflow definitions that install automatically and power product features. They are hidden from workflow experiences by default.

Turn on the View filter

Go to the Advanced Settings management page in the navigation menu or using the global search field.
Search for workflows:ui:showManagedWorkflows or Show managed workflows.
Toggle the setting on.
Click Save changes.

When the setting is on and your role includes the managed workflow read privileges, the Workflows list shows a View filter with Custom and Managed options. Custom shows workflows you author yourself. Managed shows Elastic-shipped workflows.

Managed workflow privileges

Managed workflow access uses additive sub-feature privileges under Analytics → Workflows → Managed Workflows Actions. For the full list, refer to Workflows sub-feature privileges.

Enable the Template library

The Template library is turned off by default. If Template library doesn't appear in the Workflows navigation, have an administrator run the following request from Dev Tools on Elastic Stack or Serverless:

POST kbn:/internal/kibana/global_settings
{
  "changes": {
    "workflowsManagement:library:enabled": true
  }
}

Note

The /internal/kibana/global_settings endpoint is an internal API and might change without notice.

When the request returns HTTP 200 and workflowsManagement:library:enabled has "userValue": true, reload the page. Template library appears in the Workflows navigation. Note that the workflowsManagement:library:enabled setting is global, so turning it on applies to all spaces.

What's next

Create and run your first workflow. Refer to Build your first workflow to learn more.
Create or edit a workflow by describing it in plain language. Refer to Author workflows with natural language to learn more.
Understand how to use the YAML editor in Kibana to define and run workflows. Refer to Use the YAML editor to learn more.
Learn what managed workflows are, or configure the Security Alert analysis workflow.