Workflows 9.4 content — part B by benironside · Pull Request #6103 · elastic/docs-content

benironside · 2026-04-24T05:04:46Z

Summary

Adds 6 new use-case how-tos and 1 new authoring-technique page, plus targeted enhancements to two existing pages. Stacks on PR A (#6048).

Every how-to is anchored in a canonical YAML from elastic/workflows, adapted for the 9.4 cases.* namespace and modern step types where the source uses deprecated aliases. Zero fabricated examples.

New pages

Use-case how-tos (6):

Page	Source
`use-cases/security/automate-security-operations/alert-triage-with-case.md`	`security/response/traditional-triage.yaml`
`use-cases/security/automate-security-operations/ai-driven-alert-triage.md`	`security/response/ad-automated-triaging.yaml`
`use-cases/security/automate-security-operations/enrich-alert-with-threat-intel.md`	`security/enrichment/send-hash-to-virustotal.yaml` (with `ip-reputation-check.yaml` as a variant)
`use-cases/security/manage-detection-rules/run-rules-on-demand.md`	`security/detection/manually-run-rules.yaml`
`use-cases/observability/root-cause-analysis.md`	`examples/root-cause-analysis-rca-workflow.yaml`
`use-cases/ai-augmented-workflows/classify-and-route-alerts.md`	`observability/ai-steps-demo.yaml`

Authoring technique (1):

authoring-techniques/compose-workflows.md — from the PM docset's composition.mdx pattern content (refactoring signals, input/output contract design, isolation testing, fan-out with workflow.executeAsync, recursion guards, versioning). Step reference stays on steps/composition.md (shipped in PR A).

Enhanced existing pages

authoring-techniques/pass-data-handle-errors.md:
templating.md:

Parent page updates

Added How-to guides sections to the 4 use-case overviews, linking the new children; removed the % placeholder comments
Added compose-workflows.md link to authoring-techniques.md parent
Added 7 new TOC entries to explore-analyze/toc.yml

AI Disclosure

Used Claude 4.7 with Cursor

Adds 7 new how-to pages anchored in elastic/workflows canonical YAMLs, plus enhancements to pass-data-handle-errors and templating that pull in the richer error-handling and custom-filter content from the PM docset. Stacks on PR A (#6048). Made-with: Cursor

Made-with: Cursor

Aligns the seven new how-to pages added in this PR with the cumulative lifecycle convention used elsewhere in the workflows IA (preview 9.3, ga 9.4+ or ga 9.4+, depending on the page). Made-with: Cursor

github-actions · 2026-04-29T23:01:45Z

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

Sweeps the new how-to pages and PR B's edits to existing pages for the same patterns Nastasha flagged in PR A: - Replace inline-list semicolons with periods or commas (compose-workflows, classify-and-route-alerts, alert-triage-with-case, root-cause-analysis, pass-data-handle-errors). - Drop "biggest" qualifier (compose-workflows). - Replace Vale-flagged words: "retrigger" -> "trigger again", "deduplicate" -> "remove duplicate", "execute" -> "run" in prose. Made-with: Cursor

Catches a few patterns that didn't make it into Nastasha's PR A review pass: - flow-control-steps.md: replace "operator" -> "human" (2 instances) and "see [link]" -> "refer to [link]" (8 instances). - data.md: replace "see [link]" -> "refer to [link]" and "Prefer ..." -> "Use ...". - kibana.md: replace "See [Migrate ...]" -> "Refer to [Migrate ...]". - while.md: replace remaining "cap" -> "limit" for consistency with the rest of the page. Made-with: Cursor

- Replace four `external-systems-apps.md#http` references with `#http-actions` (matches the actual heading slug for `## HTTP actions`). - Replace one `/explore-analyze/ai-features/agent-builder.md` reference with `/explore-analyze/ai-features/elastic-agent-builder.md` (the page file is named `elastic-agent-builder.md`). Made-with: Cursor

`create-detection-rule.md` has been redirected; point directly to `using-the-rule-ui.md` to silence the redirect warning. Made-with: Cursor

github-actions · 2026-05-01T17:43:48Z

🔍 Preview links for changed docs

Vale Linting Results

Summary: 3 warnings, 4 suggestions found

⚠️ Warnings (3)

File	Line	Rule	Message
explore-analyze/workflows/use-cases/security/automate-security-operations/ai-driven-alert-triage.md	18	Elastic.Spelling	'triages' is a possible misspelling.
explore-analyze/workflows/use-cases/security/automate-security-operations/alert-triage-with-case.md	6	Elastic.Spelling	'triages' is a possible misspelling.
explore-analyze/workflows/use-cases/security/automate-security-operations/alert-triage-with-case.md	18	Elastic.Spelling	'triaged' is a possible misspelling.

💡 Suggestions (4)

File	Line	Rule	Message
explore-analyze/workflows/authoring-techniques/pass-data-handle-errors.md	164	Elastic.WordChoice	Consider using 'stop, cancel, end' instead of 'Abort', unless the term is in the UI.
explore-analyze/workflows/use-cases/ai-augmented-workflows/classify-and-route-alerts.md	97	Elastic.Ellipses	In general, don't use an ellipsis.
explore-analyze/workflows/use-cases/security/manage-detection-rules/run-rules-on-demand.md	75	Elastic.Ellipses	In general, don't use an ellipsis.
explore-analyze/workflows/use-cases/security/manage-detection-rules/run-rules-on-demand.md	156	Elastic.WordChoice	Consider using 'stop, cancel, end' instead of 'abort', unless the term is in the UI.

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

nastasha-solomon

Looks great! I love the choice to put the high level explanation (how it works) before the steps for building the workflow. Great job!

nastasha-solomon · 2026-05-01T19:04:09Z

+
+::::{step} Enrich the alert with threat intel
+
+Call the VirusTotal connector to score the file hash. Wrap the call in retry + continue so a transient VirusTotal outage doesn't fail the whole workflow.


Suggested change

Call the VirusTotal connector to score the file hash. Wrap the call in retry + continue so a transient VirusTotal outage doesn't fail the whole workflow.

Call the VirusTotal connector to score the file hash. Wrap the call in `retry + continue` so a transient VirusTotal outage doesn't fail the whole workflow.

Adds 4 new reference pages under a new Concepts sub-parent of Reference (cheat sheet, step type index, context variables, Liquid filters) and 1 new troubleshooting page under Authoring techniques. Enhances alert and scheduled trigger pages. Thins context-variables tables in pass-data-handle-errors.md and templating.md to point at the new canonical reference. Stacks on PR B (#6103). Made-with: Cursor

## Summary - Adds the `workflow-authoring` built-in skill (technical preview, gated by `agentBuilder:experimentalFeatures`) and its 11 `platform.workflows.*` inline tools to the Agent Builder built-in skills reference. - Adds `platform.core.sml_search` and `platform.core.sml_attach` to the built-in tools reference — the SML tools the skill uses to discover existing workflows. - Tightens descriptions of the existing `platform.core.get_workflow_execution_status` (9.3+) and `platform.core.resume_workflow_execution` (9.4+) tools so they link to the Workflows landing page and the `waitForInput` step. - Uncomments the `observability.rca` skill entry now that it's confirmed Experimental in 9.4. Closes elastic/docs-content-internal#1054. Stacks on the 9.4 Workflows PRs (#6048, #6103, #6104) — forward-references `human-in-the-loop.md` from #6048. --------- Co-authored-by: Liam Thompson <leemthompo@gmail.com>

benironside self-assigned this Apr 24, 2026

benironside marked this pull request as ready for review April 24, 2026 05:07

benironside requested review from a team as code owners April 24, 2026 05:07

benironside mentioned this pull request Apr 24, 2026

Workflows 9.4 content — part C (PR C-1) #6104

Open

Base automatically changed from workflows-9.4-step-categories to main April 29, 2026 22:02

benironside added 3 commits April 29, 2026 16:00

Move json_parse/json inverse note above iterate-keys example

357422b

Made-with: Cursor

Apply ga 9.4+ lifecycle convention to new how-to pages

20f8980

Aligns the seven new how-to pages added in this PR with the cumulative lifecycle convention used elsewhere in the workflows IA (preview 9.3, ga 9.4+ or ga 9.4+, depending on the page). Made-with: Cursor

benironside force-pushed the workflows-9.4-use-case-how-tos branch from e2aaedd to 20f8980 Compare April 29, 2026 23:01

charlotte-hoblik mentioned this pull request Apr 30, 2026

[9.4] Document Agent Builder workflow management capabilities #6216

Merged

benironside added 4 commits April 30, 2026 19:28

Update redirected detection rule link

7afc392

`create-detection-rule.md` has been redirected; point directly to `using-the-rule-ui.md` to silence the redirect warning. Made-with: Cursor

Merge branch 'main' into workflows-9.4-use-case-how-tos

ce242c3

nastasha-solomon approved these changes May 1, 2026

View reviewed changes

Merge branch 'main' into workflows-9.4-use-case-how-tos

c33d4b3

benironside enabled auto-merge (squash) May 1, 2026 21:54

benironside disabled auto-merge May 1, 2026 21:54

incorporates Stash's review

b688c41

benironside merged commit 2fb395f into main May 1, 2026
11 checks passed

benironside deleted the workflows-9.4-use-case-how-tos branch May 1, 2026 22:13

github-actions Bot deployed to docs-preview May 1, 2026 22:13 View deployment

benironside mentioned this pull request May 4, 2026

[Internal]: Workflows 9.4 docs — PR C-2 follow-up content #6254

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Workflows 9.4 content — part B#6103

Workflows 9.4 content — part B#6103
benironside merged 10 commits intomainfrom
workflows-9.4-use-case-how-tos

benironside commented Apr 24, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 29, 2026

Uh oh!

github-actions Bot commented May 1, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 1, 2026 •

edited

Loading

Uh oh!

nastasha-solomon left a comment

Uh oh!

nastasha-solomon May 1, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		::::{step} Enrich the alert with threat intel

		Call the VirusTotal connector to score the file hash. Wrap the call in retry + continue so a transient VirusTotal outage doesn't fail the whole workflow.

Conversation

benironside commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

New pages

Enhanced existing pages

Parent page updates

AI Disclosure

Uh oh!

github-actions Bot commented Apr 29, 2026

Elastic Docs AI PR menu

Uh oh!

github-actions Bot commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

github-actions Bot commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Vale Linting Results

Uh oh!

nastasha-solomon left a comment

Choose a reason for hiding this comment

Uh oh!

nastasha-solomon May 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

benironside commented Apr 24, 2026 •

edited

Loading

github-actions Bot commented May 1, 2026 •

edited

Loading

github-actions Bot commented May 1, 2026 •

edited

Loading