Skip to content

[Workflows] Event-driven triggers GA in 9.5 and entity store triggers - #7568

Open
natasha-moore-elastic wants to merge 4 commits into
mainfrom
issue-1449
Open

[Workflows] Event-driven triggers GA in 9.5 and entity store triggers#7568
natasha-moore-elastic wants to merge 4 commits into
mainfrom
issue-1449

Conversation

@natasha-moore-elastic

@natasha-moore-elastic natasha-moore-elastic commented Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Updates the Workflows event-driven triggers docs for the 9.5 release:

  • Promote the event-driven triggers concept to GA for 9.5. The workflows.failed trigger is now GA; other trigger families keep their own maturity.
  • Add the entity store trigger family (asset criticality updated, risk score changed) with schemas, event payloads, and KQL filter examples, and add them to the triggers overview and the cheat sheet.
  • Document loop-control filtering, including how to control whether workflow-generated events can fire a trigger.
  • Document testing an event-driven workflow against a real event, and how the execution view shows what triggered each run.
  • Clarify the difference between alert triggers and alert lifecycle triggers.
  • Note that the alerting lifecycle triggers appear only when the experimental alerting system is enabled.
  • Document how the editor's Actions menu groups triggers by family.

Resolves elastic/docs-content-internal#1449

Related docs PRs

The cases and alerting-system trigger families were already documented in earlier PRs, so they aren't part of this PR:

@natasha-moore-elastic @cursoragent
Document event-driven triggers GA and entity store triggers for 9.5
002a5c3 
Co-authored-by: Cursor <cursoragent@cursor.com>
@natasha-moore-elastic
natasha-moore-elastic requested a review from a team as a code owner July 24, 2026 14:25
@github-actions

github-actions Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

  • Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

@github-actions

github-actions Bot commented Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🔍 Preview links for changed docs

@github-actions

github-actions Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

@natasha-moore-elastic natasha-moore-elastic changed the title [Security] Event-driven triggers GA in 9.5 and entity store triggers [Workflows] Event-driven triggers GA in 9.5 and entity store triggers Jul 24, 2026
ymao1
ymao1 approved these changes Jul 24, 2026
View reviewed changes

@ymao1 ymao1 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM for entity store trigger changes

florent-leborgne
florent-leborgne approved these changes Jul 27, 2026
View reviewed changes

@florent-leborgne florent-leborgne left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Very clear, nice

Comment thread explore-analyze/workflows/triggers/event-driven-triggers.md Outdated
Comment thread explore-analyze/workflows/triggers/event-driven-triggers.md Outdated
Comment thread explore-analyze/workflows/triggers/event-driven-triggers.md

| Field | Contains |
|---|---|
| `event.entityId` | The unique identifier (EUID) of the entity whose asset criticality changed. |

@florent-leborgne florent-leborgne Jul 27, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also a nit: EUID = Entity Unique ID I'm guessing :D This is not the common meaning of this acronym, but maybe it's obvious enough like this, or maybe move (EUID) to just after "entity"?

@natasha-moore-elastic natasha-moore-elastic Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've tried placing it after entity, but I feel that makes it sound like the acronym refers to the entity, not the identifier, so I'd prefer to keep it as is.

@natasha-moore-elastic @florent-leborgne
Update explore-analyze/workflows/triggers/event-driven-triggers.md
fb276c1 
Co-authored-by: Florent LB <florent.leborgne@elastic.co>
yngrdyn
yngrdyn reviewed Jul 27, 2026
View reviewed changes
Comment thread explore-analyze/workflows/triggers/event-driven-triggers.md
| Field | Contains |
|---|---|
| `event.entityId` | The unique identifier (EUID) of the entity whose asset criticality changed. |
| `event.entityType` | The entity type (`host`, `user`, or `service`). |

@yngrdyn yngrdyn Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

generic is missing here, is it intentional?

@natasha-moore-elastic natasha-moore-elastic Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @yngrdyn, good question. I recently discussed the availability of the generic entity type with @CAWilson94 when I was working on a different Entity Analytics docs issue. We agreed to generally not include it in the docs since it's gated behind a flag that's off by default, and isn't exposed in the Entity Analytics UI. But if we should treat these docs differently, let me know.
cc @ymao1

@ymao1 ymao1 Jul 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's fine to exclude here given your discussion with Charlotte. I'm not sure what the future of generic is so we can add it to the docs in the future if needed

yngrdyn
yngrdyn reviewed Jul 27, 2026
View reviewed changes
Comment thread explore-analyze/workflows/triggers/event-driven-triggers.md
@@ -343,13 +341,126 @@ triggers:
condition: 'event.owner: "securitySolution"'
```

@yngrdyn yngrdyn Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You'll get an extra blank line here, I don't know if this will affect the rendering of this .md file

@natasha-moore-elastic natasha-moore-elastic Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey, not sure I understand – the blank line is just between the code example and the next section. You can see a preview of how it renders here, LMK if anything looks off.

yngrdyn
yngrdyn approved these changes Jul 27, 2026
View reviewed changes

@yngrdyn yngrdyn left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just some minor comments, LGTM 👑

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ymao1 ymao1 ymao1 approved these changes
@yngrdyn yngrdyn yngrdyn approved these changes
@florent-leborgne florent-leborgne florent-leborgne approved these changes
@tinnytintin10 tinnytintin10 Awaiting requested review from tinnytintin10

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@natasha-moore-elastic @yngrdyn @florent-leborgne @ymao1