Global Artifact questions

InsightConnect Workflows
,
1

Global Artifact questions:

  1. Is there a defined max size? I was thinking about something that will be around 10,000 entries
  2. Once a Global Artifact is created, I do not see a way to add Attributes. Am I correct in the only way to do this would be to recreate? If so, any plans on allowing this in the future, or is there a reason for it?
  3. I see that you can export a Global Artifact as a CSV, but is there any way to Import one or fill an existing Global Artifact from a CSV?
2

Good questions!

  1. There is no defined max size on how many entries can be added to the Global Artifact BUT when doing a lookup from a workflow only the most recent 1000 entries will be queryable
  2. You are correct, once a Global Artifact is created the schema is locked and cannot be edited. This was to limit potentially breaking changes for workflows where the workflow might expect a certain data format but if that is changed it would start failing. Were you just trying to add a new field to your Global Artifact?
  3. Right now you cannot import as a CSV, but I can mark that as a feature request for us to look into!
3

Thank you, I might have to rethink my use case, I was going to use one as a holding tank of things to loop through and track progress so when there is an issue I don’t have to start from the beginning.
#2 was thinking about scalability, if I’m tracking something now and I want to add to it later. I understand not wanting to break existing Workflows, maybe not allowing to change what is already in there but have the ability to add new fields?
#3 might be nice for things like IOC feeds or transitioning from another source

4

So I am understanding the use case, would it be active incidents you would store in the Global Artifact?

Thats makes sense for #2, we can look at that as a request as well.

As a workaround for #3 I have seen users set up a mini workflow that could accept a CSV as a trigger, parse the CSV and automatically add all of the entries to the Global Artifact.

5

Yeah, that would work for #3