Workflow Automation

Workflow Automation

The workflow engine lets you chain any combination of scanners, replay sessions, auth flows, and graph queries into automated attack pipelines. Workflows run reactively in response to events (a new finding, a completed scan, an auth session update) or can be triggered manually.

Triggers

Kind	Fires when
event	An EventBus event matches the configured type pattern (fnmatch glob)
finding	A finding matching severity + type glob is created
manual	POST /api/workflows/definitions/{id}/run is called
chain	Another workflow completes successfully

Steps

Kind	What it does
scan	Start a scan job, wait for completion, capture findings
replay	Execute a saved replay session, capture result
auth	Verify or refresh an auth session
wait	Sleep for N seconds
graph_query	Query the attack surface graph
correlation	Run the correlation engine
condition	Evaluate an expression; run then_steps or else_steps

Template substitution

Step fields support {{context.key}} substitution. The context starts with trigger data and accumulates save_as outputs from each step:

steps:
  - kind: scan
    target_url: "{{event.data.url}}"
    scanners: [sqli, xss]
    save_as: scan_result

  - kind: condition
    expression: "context['scan_result']['findings_count'] > 0"
    then_steps:
      - kind: replay
        session_id: "{{event.data.session_id}}"

Built-in examples

Seven example workflows are seeded automatically on first startup:

• Endpoint Discovered → Full Scan — fire on graph node creation
• Critical Finding → Replay + Correlate — auto-replay confirmed criticals
• SQLi Detection → Extraction Chain — multi-step sqli exploitation workflow
• Auth Session Ready → Authenticated Scan — re-scan with fresh auth when a session updates
• XSS → CSRF Mutation Replay — mutation chain for XSS-confirmed endpoints
• Scan Finished → Graph Harvest — run graph correlation after every scan
• Full Engagement Sweep (Manual) — complete recon-to-exploit chain, manually triggered

Seed them manually:

curl -X POST http://localhost:8000/api/workflows/examples/seed

Workflow API

Method	Path	Description
GET	/api/workflows/definitions	List workflow definitions
POST	/api/workflows/definitions	Create workflow definition
POST	/api/workflows/definitions/{id}/run	Trigger a workflow manually
GET	/api/workflows/runs	List workflow run history
GET	/api/workflows/examples	Built-in example workflows
POST	/api/workflows/examples/seed	Seed the database with examples