> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# New Conclusion

> Trigger a workflow automatically when an AI SOC agent records a new conclusion in Blink case management.

This trigger runs a workflow for every new agent conclusion. Each event is the new record from the `conclusions` table.

<Note>
  **Note**: This trigger requires the AI SOC solution, which provides the `conclusions` table.
</Note>

<Note>
  **Note**: Workflows based on this trigger will search for new events **every minute**.
</Note>

## Sample Event

```json theme={"dark"}
{
	"agent_execution_id": "0f2b5f5f-4f0a-4c3a-9b0d-8b1a4b9a2c11",
	"agent_id": "b7c1f2d3-4e5a-4b6c-8d7e-9f0a1b2c3d4e",
	"auto_id": 42,
	"case_ids": [
		"bb2a5fcc-423b-4536-8b7a-63a547216579"
	],
	"conclusion_id": "CON-00042",
	"created_at": 1755500123456,
	"created_by": "test@blinkops.com",
	"id": "3f9a1c62-2f4b-4a1e-9d2b-6c5f7e8a9b01",
	"rating": null,
	"rating_free_text": null,
	"reasoning_details": "The alert was raised for an encoded PowerShell command spawned by WINWORD.EXE on WIN-SRV-01. The parent-child relationship, the encoded payload, and the outbound connection to a known-bad IP together indicate a successful phishing-driven execution.",
	"reasoning_summary": "Encoded PowerShell spawned by Word, beaconing to a known-bad IP.",
	"risk": 3,
	"selected_labels": null,
	"severity": 3,
	"severity_change": "Maintained",
	"title": "Malicious PowerShell execution confirmed on WIN-SRV-01",
	"updated_at": 1755500123456,
	"updated_by": "test@blinkops.com",
	"verdict": "Malicious",
	"verdict_confidence_score": 92
}
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.