> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usekestrel.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Workflows Quickstart

> Build your first workflow automation in seconds

Kestrel Workflows let you automate incident response, cloud resource provisioning, CI/CD pipelines, developer requests, and more — with AI-powered workflows that build themselves. Chain actions across 15+ integrations, triggered by Kubernetes signals, AWS cloud signals, Slack `/kestrel-workflow` requests, PagerDuty incidents, PostHog events, Vercel deployment events, custom webhooks, or on-demand runs. Build workflows with the Workflow Agent using natural language, a drag-and-drop canvas, the CLI, SDK, or MCP.

## Prerequisites

* A Kestrel account at [platform.usekestrel.ai](https://platform.usekestrel.ai)
* At least one integration connected (see [Integrations](https://docs.usekestrel.ai/integrations/kubernetes.md))

## Create Your First Workflow

**1. Navigate to Workflows**

From the Kestrel dashboard, go to **Workflows → New Workflow**.

You can start from a blank canvas or choose a template. Templates cover common use cases like incident response, cloud provisioning, and CI/CD automation.

**2. Describe your workflow in natural language**

Type a plain-English description of what you want automated. The **Workflow Agent** generates the workflow steps for you.

**Example:**

> When a pod crashes in the payments namespace, trigger root cause analysis, send a Slack message with the root cause to #incidents, and create a Jira ticket assigned to the payments team.

The Workflow Agent assembles the trigger, actions, and connections. Review the generated workflow on the canvas and adjust as needed.

> [!TIP]
>
> You can also build workflows entirely with the drag-and-drop canvas — add trigger and action nodes, connect them, and configure each step manually.

**3. Configure the trigger**

Every workflow starts with a trigger. Select the event source that kicks off the workflow:

| Trigger Type | Trigger Blocks |
| - | - |
| **Kubernetes Signals** | Deployment Replicas Failing, Nodes Unavailable, Pod CrashLoopBackOff, Pod ImagePullBackOff, Pod OOMKilled, Pods Failing, Pods Restarting, StatefulSet Replicas Failing, Node Memory Pressure, Node Disk Pressure, DaemonSet Failing, Any Kubernetes Incident |
| **AWS Cloud Signals** | IAM Security Event, Root Account Activity, KMS Key Change, Secrets Manager Event, Security Hub Finding, S3 Bucket Change, EC2 Instance Issue, Lambda Function Issue, ECS/EKS Container Issue, RDS Database Issue, DynamoDB Issue, VPC/Network Change, CloudWatch Alarm, Application Log Errors, Config Rule Non-Compliant, AWS Service Health Event, Any AWS Cloud Incident, Cost Anomaly Detected, Budget Threshold Exceeded |
| **Slack Requests** | Create K8s Resource, Edit K8s Resource, General Kubernetes Request, Create AWS Resource, Edit AWS Resource, General Cloud Request, Any Slack `/kestrel-workflow` Request |
| **PagerDuty** | Incident Triggered, Incident Acknowledged, Incident Resolved, Any PagerDuty Incident, High Urgency Incident |
| **PostHog** | Session Error/Exception, Console Error, Rage Click, Any PostHog Event, Log Error Alert |
| **Vercel** | Deployment Failed, Deployment Succeeded, Deployment Created, Error Anomaly, Usage Anomaly, Domain Issue, Firewall Attack Detected, Deployment Checks Failed, Production Rollback |
| **Jenkins** | Build Failed, Build Unstable, Build Succeeded, Build Completed, Build Started |
| **CircleCI** | Workflow Failed, Workflow Succeeded, Workflow Completed, Job Failed |
| **Terraform Cloud** | Run Created, Run Planning, Run Needs Attention, Run Applying, Run Completed, Run Errored, Drift Detected, Assessment Check Failed |
| **Pulumi Cloud** | Update Succeeded, Update Failed, Preview Failed, Destroy Succeeded, Deployment Started, Deployment Succeeded, Deployment Failed, Drift Detected, Drift Run Failed, Policy Violation, Stack Created, Stack Deleted |
| **HashiCorp Vault** | Vault Sealed, Vault Unsealed, Health Degraded, Secret Version Created, Secret Stale, Policy Created/Deleted, Auth Method Enabled/Disabled |
| **Infisical** | Secret Created, Secret Updated, Secret Deleted, Approval Requested, Secret Sync Failed, Identity Created |
| **Custom Webhook** | Any HTTP POST to your workflow's unique webhook endpoint with HMAC signature verification |

Configure trigger-specific filters to control when the workflow fires — for example, limit a K8s trigger to a specific namespace, cluster, or set of AWS accounts.

**4. Configure actions and template variables**

Add action steps to your workflow. Each action targets an integration and performs a specific operation — sending a Slack message, creating a Jira ticket, running an RCA, applying a Kubernetes manifest, and so on.

Use the **variable picker** to insert dynamic values from the trigger or from previous action outputs into any field. Variables use the `{{variable_name}}` syntax and are type-checked at build time.

> [!NOTE]
>
> Actions execute sequentially by default. Use parallel branches on the canvas to run actions concurrently.

**5. Set cooldown and save**

Configure a **cooldown period** to prevent the same trigger from firing the workflow repeatedly in a short window. For example, set a 5-minute cooldown so a pod crash-looping every 30 seconds doesn't generate dozens of duplicate tickets. You can also select "No cooldown" for workflows that should fire on every event.

Click **Save** to activate the workflow.

**6. Test the workflow**

Use the **Test** button to simulate a trigger event and trace the workflow execution step by step. Each action shows its input, output, and execution time.

> [!TIP]
>
> You can also trigger a test run from the CLI with `kestrel workflow test <workflow-id>`.

## Example Workflows

| Use Case | Trigger | Actions |
| - | - | - |
| Self-healing K8s incident | Pod CrashLoopBackOff | RCA → Slack alert → Apply fix → Jira ticket |
| Cloud provisioning via Slack | Slack `/kestrel-workflow` request | Parse request → Provision AWS resource → Confirm in thread |
| CI/CD automation | GitHub PR merged | ArgoCD sync → Run tests → Notify Slack on failure |
| Cost anomaly response | AWS cost spike detected | Investigate resources → Slack alert to #finops → Linear ticket |
| Vercel deployment failure | Vercel Deployment Failed | Get build logs → AI investigation → Slack notification |
| Jenkins build failure RCA | Jenkins Build Failed | Get console log → AI investigation → Slack alert to #ci → Jira ticket |
| CircleCI flaky-build retry | CircleCI Workflow Failed | Rerun from failed → Wait for pipeline → PagerDuty page if it fails again |
| Vault stale-secret rotation | Vault Secret Stale | Get secret metadata → Slack approval → Rotate static role → Confirm new version |
| Infisical sync recovery | Infisical Secret Sync Failed | Slack approval → Trigger secret sync → Notify #secrets on result |
| Terraform apply approval | Terraform Run Needs Attention | Get run plan summary → Slack approval → Apply or Discard run |
| Pulumi update failure retry | Pulumi Update Failed | AI investigation → Slack approval → Run deployment (update) → Wait for result |
| PostHog exception alert | PostHog Session Error | Session summary → Slack alert → Jira ticket if critical |

## What's Next

* [Create Custom Integrations](https://docs.usekestrel.ai/workflows/custom-integrations.md) — build custom HTTP action blocks and webhook triggers for any API or service
* [Workflow Observability](https://docs.usekestrel.ai/workflows/observability.md) — monitor execution history, latency, and failure rates
* [Set Up Integrations](https://docs.usekestrel.ai/workflows/setup-integrations.md) — connect the tools your workflows need


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.