Modifying a Workflow
Default ThreatQ Role: Administrative or Maintenance
Custom Role - Action Permissions: See the TQO Requirements topic.
You can update an existing workflow from the workflow builder page.
This steps covered in this section are for workflow built using the workflow builder. See the Configuring Advanced Workflows topic for steps on modifying Advanced Workflows.
Changing the Data Collection
You can change the data collection used in the workflow.
- Click on the data collection's node on the builder page.
The workflow's details will load in the right pane. You will see the current data collection selected and the objects included.
- Use the dropdown provided to select a new data collection.
You can also click on the View in Threat Library option to open the data collection in the Threat Library to make changes to the data collection's filters.
- Click on Save Changes.
The workflow will reload and the details pane will update with the new data collection.
Updating a Workflow's Run Frequency
- Click workflow's green node in the workflow builder.
The workflow's details will load in the right pane. You will see the current run frequency selected along with other details regarding the workflow.
- Select a new run frequency using the dropdown provided.
- Click on Save Changes.
Enabling Debug Option
You can enable the debug option to capture raw data response files for troubleshooting.
The Debug Option should only enabled temporarily to troubleshoot a workflow as it uses a large amount of disk space.
- Click workflow's green node in the workflow builder.
The workflow's details will load in the right pane.
- Check the Debug Option to enable it.
- Click on Save Changes.
Changing an Action in a Workflow
- Click on the action's node in the workflow builder.
- Use the dropdown provided to select a new action for the workflow.
- Click on Save Changes.
Updating an Action's Configuration for a Specific Workflow
When an action is inserted into a workflow, the default configuration for the action, set in the action's details page, are included. This can include API credentials as well as specific settings how what is done with the data. You can edit the configuration settings for an action in a specific workflow in the right pane of the workflow builder.
This will only effect the action's instance in that specific workflow and will not change the action's default configation setting or other workflows that use the action.
Example: The default context filter for an action is designed to capture Name, Link, and Classification by default. When you insert the action into a workflow, you can update the configuration settings for that specific workflow to only capture the Name and Link without change the default for the action itself.
- Click on the action's node in the workflow builder.
- Make your required edits to the configuration options available under the Configurations heading.
- Click on Save Changes.
Updating an Action's Default Configuration from the Workflow Builder
Default ThreatQ Role: Administrative or Maintenance
Custom Role - Action Permissions: See the TQO Requirements topic.
You can access and edit an action's default configuration settings from the workflow builder.
Updating the default configuration settings for an action will not update any instances of this action that have already been deployed to a workflow. This includes any workflow that you may be actively editing if you have already inserted the action.
- Click on the action's node in the workflow builder.
- Click on the vertical ellipsis next to the action's name and select Edit Default Configuration.
The action's details page will load.
- Make your required configuration settings and click Save.