Managed workflows
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
9.5+
Generally available since 9.5
A managed workflow is a workflow definition that Elastic ships and installs automatically. Managed workflows power product features. They are distinct from the workflows you author yourself.
| Managed workflow | User-authored workflow | |
|---|---|---|
| Who creates it | Elastic (installed automatically) | You |
| Who maintains the YAML | Elastic | You |
| Editing and deleting | YAML is read-only; you can't delete the workflow | Full edit and delete |
| Typical use | Back product functionality (for example, Security alert analysis) | Custom automation you build |
Managed workflows appear with a Managed badge in Kibana. By default they are hidden from the Workflows list. To show them, turn on Show managed workflows in Advanced Settings and grant the managed workflow read privileges. Refer to Set up Workflows > Show managed workflows for more information.
Configure managed workflows from the settings for the feature that owns them, not by editing their YAML on the Workflows page. For example, configure Attack Discovery's managed workflows from Attack discovery settings on the Attacks view. You can't edit or delete managed workflow YAML.
Turning a managed workflow off on the Workflows page can stop the feature that depends on it from running. For example, disabling an Attack Discovery generation or retrieval managed workflow can break or interrupt Attack Discovery runs that rely on it.