Managed workflows
A managed workflow is a workflow definition that Elastic ships and installs automatically. Managed workflows power product features. They are distinct from the workflows you author yourself.
| Managed workflow | User-authored workflow | |
|---|---|---|
| Who creates it | Elastic (installed automatically) | You |
| Who maintains the YAML | Elastic | You |
| Editing and deleting | YAML is read-only; you can't delete the workflow | Full edit and delete |
| Typical use | Back product functionality (for example, Security alert analysis) | Custom automation you build |
Managed workflows appear with a Managed badge in Kibana. By default they are hidden from the Workflows list. To show them, turn on Show managed workflows in Advanced Settings and grant the managed workflow read privileges. Refer to Set up Workflows > Show managed workflows for more information.
Configure managed workflows from the settings for the feature that owns them, not by editing their YAML on the Workflows page. For example, configure Attack Discovery's managed workflows from Attack discovery settings on the Attacks view. You can't edit or delete managed workflow YAML.
Turning a managed workflow off on the Workflows page can stop the feature that depends on it from running. For example, disabling an Attack Discovery generation or retrieval managed workflow can break or interrupt Attack Discovery runs that rely on it.