Flow FAQ¶

Common questions about triggers, publishing, activation, and executions.

Triggers¶

What's the difference between a Flow and a Trigger?¶

A Flow is the overall automation pipeline, while a Trigger determines when the Flow starts, such as on a schedule, after an operation completes, when an anomaly is detected, or manually.

Can a Flow have more than one trigger?¶

No. Each Flow has exactly one trigger. To run the same actions from a different trigger, clone the Flow and configure the clone's trigger.

Why didn't my Anomaly Detected Flow run for an anomaly?¶

Only open anomalies trigger the Flow. Anomalies recorded as duplicates or resolved by the scan do not trigger it, and the anomaly must match the trigger's filter conditions, such as tags, datastores, check rule types, and anomaly impact: all of them with Match all, or at least one with Match any. The datastores filter always applies.

What happened to my Flow's Anomaly Severity filter?¶

Flows that filtered on the earlier numeric anomaly severity now use the Anomaly Impact filter with the same comparison. The level depends on the old number:

The old number and the new level measure different things, so the mapping is only a starting point. Review the filter and pick the level that fits the Flow. See Anomaly Impact.

Publishing and Editing¶

I saved my changes. Why doesn't the Flow behave differently?¶

Saving a node only stores the edit as an unpublished change, marked with a CHANGED badge. The Flow keeps running its last published version until you click Publish. See How a Flow Works.

How do I discard edits I don't want to keep?¶

Click Discard in the You have unpublished changes banner. The canvas restores the last published version of the Flow and the badges clear.

Why can't I edit my Flow right now?¶

While the Flow has executions in progress, its canvas is read-only. Wait for them to finish or abort them first.

Why is a Flow read only for me?¶

Managing a Flow needs the Editor team permission on every datastore it relates to. When one of them is a datastore you don't edit, the side panel shows Read only and the canvas offers no editing controls. Open Related datastores in the Flow editor to see which datastores are read only for you. A Flow that reaches every datastore needs the Editor team permission on all of them. See Flow Permissions.

Why must I pick a datastore for the trigger?¶

An event trigger with no Datastores filter fires on events from every datastore, and an anomaly action with no datastore filter acts on anomalies from every datastore. Saving either needs the Editor team permission on every datastore, so unless you are an Admin or hold it on all of them, the filter is required and only lists the datastores you edit.

Activation¶

What happens if I deactivate a Flow?¶

Once deactivated, the Flow's triggers stop starting it until you reactivate it. Executions already running are not affected, and the Flow's configuration is kept.

Does deactivating a scheduled Flow lose its schedule?¶

No. The schedule's cron expression is kept, and reactivating the Flow resumes the same schedule. If a schedule was deactivated before May 7, 2026 and doesn't run after reactivation, re-enter its cron expression once to restore it.

Executions¶

Can I see what an action's configuration was when a past execution ran?¶

Yes. On the execution's page, click the action node to open its Historical Configuration: the settings exactly as they were at the moment the Flow ran, even if the Flow has been edited afterward.

What does the Skipped state mean?¶

The action did not run, either because an upstream action failed or because it had nothing to act on (for example, a ticket update when the anomaly has no linked tickets). Actions still pending when a run is aborted show as Aborted instead. See Flow Executions for all six states.

What happens to operations when I abort an execution?¶

Aborting stops the running execution, its remaining actions, and the operations the execution started. Results captured before the abort are preserved.