> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/workflows/create-a-workflow.md). # Create a workflow Automated workflows help to monitor, control and remediate data access across your SaaS applications. In DoControl's drag-and-drop canvas, you can create these types of workflows:

Workflow type	Description
Playbook	Create a workflow from a predefined template
Event-based	Create a workflow that's triggered by a single event in a specific SaaS app
Scheduled	Create a workflow that's triggered by a future date. Note that scheduled workflows is a beta feature available by customer request.
Aggregated	Create a workflow that's triggered by multiple events for the same actor occurring within a 30-second timeframe
Import	Import an existing workflow as a JSON file

{% hint style="info" %} * You can create and maintain up to 100 workflows at a given time. * You can add up to 40 action steps to a workflow. {% endhint %} #### To create a new workflow: 1. Click **Workflows** in the left navigation bar.

2. Create a new workflow in one of these ways: * Click the **Playbooks** button to choose a predefined playbook, OR * Click the **New workflow** button, select one of these workflow types, and click **Create workflow**: * Event-based * Aggregated * Scheduled * OR click the **Import**

button to import a workflow as a JSON file. ## Playbooks Playbooks are predefined workflows for use cases based on well known threat models. Playbooks are set with specific event fields, but they can be customized. Some playbooks are ready to be used, others require the user to enter some values.

Use any workflow from a set a predefined playbooks

#### To create a workflow from a playbook: 1. Go to **Workflows** > **Playbooks**. The predefined playbooks are displayed according to threat model category. Click **Show more** to see more playbooks in each category. 2. You can filter playbooks by: * **App** - SaaS apps that are integrated with DoControl. * **Category** - [Threat model use cases](/docontrol-user-guide/risk-management/threat-model-coverage.md), such as encryption key sharing, external collaborator sharing, and public sharing. * **Type** - Characteristic of playbook: alert-related, aggregated, or inventory action. 3. Select a playbook. The workflow appears with the trigger and actions partially defined. 4. Select the workflow mode: active or inactive. 5. Click **Save workflow**. The workflow now appears in the Workflow list. {% hint style="info" %} * Playbooks with an **Inventory action** tag are used to support on-demand remediation actions (such as, Remove public sharing, and Remove collaborator). * For more information on editing workflows, see [trigger settings](/docontrol-user-guide/workflows/define-workflow-settings/trigger-settings.md) and [action settings](/docontrol-user-guide/workflows/define-workflow-settings/action-settings.md). {% endhint %} ## Event-based workflow An event-based workflow is triggered by a single event in a specific SaaS app. 1. Click **Workflows** in the left navigation bar. 2. Click **New workflow** > **Event-based**.

3. Enter a name for the workflow. 4. Click **Create workflow**. 5. Select the workflow mode: active or inactive. 6. Define the [trigger settings](/docontrol-user-guide/workflows/define-workflow-settings/trigger-settings.md). 7. Define the [action settings](/docontrol-user-guide/workflows/define-workflow-settings/action-settings.md). 8. Click **Save workflow**. The workflow now appears in the Workflow list. ## Aggregated workflow An aggregated workflow is triggered by multiple events for the same actor that occur within a 30-second timeframe. DoControl processes these multiple events in a single workflow execution. You can leverage aggregated workflows when a single user action produces multiple event triggers. For example: * When sharing a folder in Google Drive, multiple events are usually triggered for sharing each of the files in the folder. An aggregated workflow consolidates all those file shares into a single event, with one DoControl notification. * If a user shares 100 files, an event is usually triggered for each file share. An aggregated workflow consolidates all those events into a single event, with one DoControl notification. {% hint style="warning" %} * Aggregated workflows can be executed for all events of a specific actor in a 30-second timeframe for up to 5000 events. * If there are more than 5000 events, a separate execution will be run with the same rules. * The execution log is available after the 30-second period. {% endhint %} {% hint style="info" %} When the event aggregation is enabled, although the triggering event is triggered once, other actions in the workflow referring to the event produce multiple executions for each of the aggregated events. For example, the **Remove public sharing** remediation action produces executions for each of the files in the folder. {% endhint %} #### To create a workflow with event aggregation: 1. Click **Workflows** in the left navigation bar. 2. Click **New workflow** > **Aggregated.**

icon. 3. Click the **Plus**![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FK0ncZjipARsUpRD6bFVT%2Fimage.png?alt=media\&token=84249afd-6933-41c7-b9e4-85ca1d78fa4e)icon and add the files, or drag the JSON files to the gray area. 4. Click **Import**. The imported workflows appear in the Workflow list.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/workflows/create-a-workflow.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.