Simplifying InsightConnect Workflows Using Join Step

When building workflows in InsightConnect that contain branching paths resulting from Decisions Steps or ChatOps Interactive Messages, you may find yourself creating and maintaining duplicate steps along those paths. To help simplify your workflows, we are excited to announce the release of the Join Paths Step. This will reduce your duplicate steps and help keep your workflow linear by allowing you to reconnect those paths. We would love to hear your feedback on this new addition, but first, let’s look at a simple example of this step type in action!

The Workflow

Let’s imagine members of our team want to be able to post various indicators such as URLs, IPs, domains, and file hashes into Slack channels where a workflow can then take those indicators, enrich them, and post the results back into the Slack channel. Thinking this through, you will need to add a Decision into your workflow with a path for each indicator type and then you will need to add steps to perform the enrichment on these indicators and your workflow could look something like this:

Using The Join Paths Step

Now the next step I want in my workflow is to be able to post the results of this enrichment back to the Slack channel where it was originally submitted. I could add a separate ChatOps Post Message Step on each of my four paths, but to keep this workflow simple I am going to use my Join Paths Step.

I will start by clicking a “+” at the end of one of my branches and I will choose the Join Paths Step and then I will drag each of my paths to the join point.

Now we can use the Join Paths Step to create variable mappings for each of these paths so that we can use those variables later in the workflow.

And finally, I can add in my Post Message Step using these newly created variables.

Have you created any workflows that use Join Paths Steps? I would love to hear about more examples or any feedback that you have in the comments!

3 Likes

I started converting a lot of my workflows over to use this, great way to manage final actions like common Artifacts or returning results to ChatOps without duplicate steps across paths. The only gotcha that I found is that the Join Path can only join paths under the same decision.

2 Likes

Glad to hear that you have been using the new step! We are actually working on an enhancement to allow joining of paths across multiple decisions that should be released shortly.

I just thought of a nice use case for a Join Path that I wanted to share.

There are times where in a Decision Step you will have multiple scenarios that meet the criteria to follow one path vs. another, in my example of “Is the User Allowed to Run the Workflow” if the User is an allowed Service Account or a Member of a Group then the Workflow would continue else it would stop.

Traditionally you would use OR logic in your Decision Step for the one path, but you wouldn’t see what criteria they matched on. With a Join Path you can show this .

In my example the two Decision Steps are brought back together to the same path, but when the Job runs you know what matched.

What the Workflow looks like
Workflow

The different Paths in the Decision
Decision

And a nice clear output in the Job

User is a ServiceAccount
Flow
Outcome
Artifact

User is a Member of a Group
Flow 2
Different Outcome
Artifact

User Doesn’t meet the criteria to run the Workflow
Flow 3
Stop Outcome
Artifact 2

I always like to be explicitly clear as to why something was done (help a lot when working with auditors) and using this Join Step allows me to do it in a nice visible way

7 Likes

@brandon_mcclure This post is incredible! Thank you :heart_eyes:

I don’t know if this is intentional or a happy hack.
I found if you put in a Join Step then put in a Decision Step above it, you have the results of a Join Path across multiple decisions.
This Workflow is working as expected until you release this officially
image

2 Likes

Nice find. We’ve got a fix in for this now to allow for proper joining across decisions.

1 Like

Just saw this in action and it is working Perfectly!

2 Likes