Skip to main content
The Workflow Editor is the core visual interface for building automated security workflows in Blink. It allows you to create custom workflows by combining Blink actions with actions from third-party integrations —enabling you to automate routine tasks, respond to incidents, and standardize security processes across your organization. The Workflow Editor lets you go from idea to automation in seconds. With a visual, no-code interface and low-code flexibility when needed, you can quickly build and customize workflows to match your exact security needs. Drag and drop actions, configure triggers, and define logic—all without writing code. And when you do want to go deeper, the Builder Copilot is there to help generate and build workflows so your team can automate faster, smarter, and with confidence.
The new workflow editor is in it’s beta phase of testing. You can switch between the classic and new editor at any time by clicking the ‘Try New Editor’ button in the top-right corner of the workflow editor.

​
The Workflow Editor’s Interface

The following image illustrates the Workflow Editor’s Interface and it’s core components.
Note: This image is provided as an example of the Workflow Editor interface. The appearance of your own workflow may vary depending on how you configure your triggers, steps, and actions.
These components are as described in the following table:
ComponentDescription
1The Action PanelThis panel on the left lists all available integrations and their respective actions. You can search or scroll to explore actions and drag them into your workflow steps.
2Builder CopilotThe ‘Builder Copilot’ icon opens Builder Copilot. By entering a prompt, the Copilot will assist in reconstructing the entire workflow to align as closely as possible with the provided instructions.
3Test Parameters and Test Run ButtonUse the “Test Parameters” button to provide inputs when testing on-demand workflows and event-based workflows. Click “Test Run” to execute the workflow in test mode, ideal for validating logic before publishing.
4The Editor Tab and the The Run Log TabSwitch between the ‘Editor’ for designing your workflow and the ‘Run Log’ to view past executions, inspect inputs/outputs, and troubleshoot errors.
5’All changes saved’ indicator and the Publish and Activate ButtonThe “All changes saved” indicator confirms that your workflow is being autosaved and provides access to the version history. The “Publish & Activate” button is used to publish and activate your workflow the first time. Subsequent publishes will update the version without reactivating the workflow.
6Trigger ConfigurationTriggers define the conditions under which a workflow is initiated. In this section, you can configure the trigger type selected for the workflow. In the example shown, an Event-Based Trigger is used, which activates the workflow in response to a specific event—such as a Splunk query result.
7Steps and ActionsSteps are the building blocks of a Workflow and are arranged in a logical order to complete a workflow. Actions are added to step and performs a defined task based on integration capabilities.
8The Inline Action PanelThe ‘Inline Action Panel’ appears when adding a new step. It provides quick access to available actions, categorized by integrations, and allows for fast step configuration.
9OutputsOutputs refer to the final results or data generated by a workflow after it runs. These outputs can be used in various ways—for example, passed into subflows, displayed in the Self-Service Portal, or reviewed in the execution run logs for debugging purposes.
10ToolbarThis toolbar on the right lets you zoom in/out of the canvas and quickly navigate through complex workflows. It includes reset, zoom controls, and undo/redo buttons.
11Blink Support Chat BotLocated in the bottom-right corner, the chat bot connects you with Blink’s support team. Use it to get help, report bugs, or ask product-related questions.

​
Adding Actions to Steps

In the editor, you can add actions to a step in of the two ways.

Drag and Drop

To create a step using drag and drop, select an action from the Action Panel on the left and drag it onto the canvas.

Inline Adding

Alternatively, click the icon in the center of the canvas to open the inline action panel, choose and action and it to a step. You can choose from flow control actions, subflow or use the search bar to find a specific action across all integrations.

To learn more about how steps work in the Workflow Editor—including their logic, configuration, and behavior—refer to the steps documentation.

​
Understanding the Inline Action Panel

Click the button, to view all available options in the Action Panel.

When you click the icon in the center of the canvas, the Action Panel opens. This panel lets you add new steps to your workflow and is divided into the following sections:
  1. Search Bar – Quickly locate a specific action by typing its name into the search bar.
  2. The Builder Copilot - Your AI assistant for building step logic. Use Builder Copilot to describe what you want to achieve in the step, and it will suggest the right action for you. You can add a single step or multiple steps.
    In the Blink Builder, while you can use the Copilot at the workflow level, we recommend adding dedicated step(s) instead. Using Copilot at the workflow level applies changes globally, which can override downstream behavior and lead to unintended results—especially in complex workflows. For a more modular and iterative approach, use Copilot to add logic at the step level, where changes are more targeted and controlled.
  3. Actions
    A categorized list of all available actions you can use in your workflow:
    • All Actions: Browse the complete library of Blink’s built-in actions.
    • Utility Actions: General-purpose actions like formatting text, transforming data, or waiting for a specified duration.
    • Subflows:
      • Subflows are reusable on-demand workflows that can be called as a step from other workflows. They help modularize your automation logic, reduce duplication, and simplify maintenance.
  4. Agents- All your custom built Agents
    Agent features are available in the action panel only if they have been enabled for your workspace. This configuration can be performed by users with the Tenant Admin user role.
  5. Flow Control Actions
    • These actions help define the logic and structure of your workflow. Use them to add conditions, loops, parallel branches, or control how and when different parts of your workflow are executed.

​
Workflow Editor Settings

In the top-right corner of the Workflow Editor, you can access the setting by clicking on the menu and choosing from the following

  1. Edit Yaml- Open the YAML view of your workflow and make any desired changes.
  2. Download YAML- Download your workflow in YAML format.
  3. Settings - This opens the Workflow Overview page. Manage workflow-level settings such as its name, description, tags, or visibility settings.
  4. Version History- View and manage the workflow’s version history. You can compare changes, see timestamps, and restore previous versions if needed.

​
Autosave Workflow Draft

When you edit your workflow in the workflow editor, your changes are automatically saved by the system. To view the timestamp of your most recent updates, hover over the All Changes Saved link in the top-right corner. Clicking this link will open the version history of your workflow, where you can review previous versions or restore them if needed. If the workflow fails to save—such as in the case of a lost internet connection—the autosave indicator will display as Not Saved. Hovering over this indicator will provide additional details, if available.
Note: To avoid conflicts or potential loss of work, please be aware that concurrent editing is restricted. If a user is currently working in the editor, others will be unable to edit the same workflow to ensure a seamless process.

​
Published Workflows Vs Unpublished Workflows

When managing workflows, it is essential to differentiate between published and unpublished workflow versions. Unpublished workflows represent draft versions with changes that haven not been published yet, while published workflows are finalized and ready for execution. You can identify the status of a workflow in multiple places: the workflow list, the workflow overview page, or the workflow editor.
To learn more about how to control the availability of a published workflow, check out the documentation here.
You can distinguish between a published and an unpublished workflow by looking at the:
The Workflow Editor: Within the Workflow Editor, hover over the Published button. If there are unpublished changes, a notification will appear, stating that certain changes are not included in the published version. You can also access the Version History to review all changes made to the workflow.

Workflow Page: A yellow dot () appears on the left-hand side of any workflow with unpublished changes. This serves as a quick visual indicator that a newer draft version exists.

The Workflow Overview Page: To view more details, select the workflow and click the Overview button. On the Workflow Overview page, you will see a notification at the bottom highlighting that unpublished changes exist. Additionally, you’ll find an option to view the latest draft of the workflow for further details.

Triggers

Configure triggers to start workflows based on events.

Steps

Define and organize actions within a workflow.

Conditions

Add logic to control workflow execution paths.

Creating a Workflow

Build a new workflow from scratch in Blink.
⌘I