# Create Your First Workflow

This guide walks you through creating and executing your first security workflow with Vaultace SecureFlow.

## Overview

We'll create a simple vulnerability scanning workflow that:
1. Scans your project for vulnerabilities
2. Generates a security report
3. Sends notifications to your team
4. Creates tracking tickets for high-severity issues

## Prerequisites

- Vaultace CLI installed ([Installation Guide](./installation.md))
- Authenticated with Vaultace platform
- Basic familiarity with command line

## Step 1: Explore Available Templates

Start by exploring the available workflow templates:

```bash
# List all security workflow templates
vaultace workflow templates

# Filter by category
vaultace workflow templates --category vulnerability_management
```

Expected output:
```
🔄 Vaultace SecureFlow Templates

Vulnerability Management:
  cve_response              - Automated CVE vulnerability patching
  zero_day_response         - Emergency zero-day response
  supply_chain_security     - Dependency security validation
  automated_patching        - Safe patch deployment

Incident Response:
  data_breach_response      - GDPR/HIPAA compliant breach response
  ransomware_response       - Comprehensive ransomware recovery
  insider_threat_response   - Sensitive investigation workflow
  apt_response             - Advanced persistent threat response
```

## Step 2: Create a Vulnerability Scan Workflow

Let's create our first workflow using the CVE response template:

```bash
# Create workflow from template
vaultace workflow create --template cve_response
```

Expected output:
```
✅ Workflow created: wf_cve_response_vulnerability_1641234567890
Template: cve_response
Name: CVE Response & Patching
Steps: 9
Run with: vaultace workflow run wf_cve_response_vulnerability_1641234567890
```

## Step 3: Understand the Workflow

Let's examine what this workflow does:

```bash
# List your workflows
vaultace workflow list
```

The CVE response workflow includes these steps:
1. **CVE Assessment** - Analyze vulnerability details
2. **Impact Analysis** - Evaluate business impact
3. **Security Team Notification** - Alert stakeholders
4. **Automated Patch Application** - Apply fixes safely
5. **Post-Patch Testing** - Validate fixes
6. **Staging Deployment** - Test in staging environment
7. **Production Approval** - Human approval gate
8. **Production Deployment** - Deploy to production
9. **Compliance Documentation** - Generate audit trails

## Step 4: Configure Workflow Triggers

Set up automated triggers for this workflow:

```bash
# The workflow will automatically trigger when:
# - New critical/high CVE vulnerabilities are detected
# - CVSS score >= 7.0
# - Patches are available
```

The trigger configuration is built into the template:
```json
{
  "trigger": {
    "type": "vulnerability_detected",
    "condition": {
      "severity": ["high", "critical"],
      "cve_score": 7.0
    }
  }
}
```

## Step 5: Execute Your First Workflow

Now let's run the workflow manually to test it:

```bash
# Execute the workflow with sample data
vaultace workflow run wf_cve_response_vulnerability_1641234567890 \
  --trigger-data '{
    "cve": {
      "id": "CVE-2024-1234",
      "severity": "high",
      "cvss_score": 8.5,
      "affected_packages": ["lodash@4.17.20"],
      "description": "Example vulnerability for testing"
    }
  }'
```

Expected output:
```
✅ Workflow execution initiated
Execution ID: exec_a1b2c3d4e5f6
Monitor with: vaultace workflow monitor exec_a1b2c3d4e5f6
```

## Step 6: Monitor Workflow Execution

Monitor your workflow in real-time:

```bash
# Follow execution in real-time
vaultace workflow monitor exec_a1b2c3d4e5f6 --follow
```

Expected output:
```
Following execution exec_a1b2c3d4e5f6...
Press Ctrl+C to stop following

Step 1: CVE Assessment - ✅ Completed
Step 2: Impact Analysis - ✅ Completed
Step 3: Security Team Notification - ✅ Completed
Step 4: Automated Patch Application - 🔄 Running
Step 5: Post-Patch Testing - ⏳ Pending
...

Execution completed
```

## Step 7: View Detailed Results

Get detailed execution results:

```bash
# View execution details
vaultace workflow monitor exec_a1b2c3d4e5f6 --detailed
```

This shows:
- Execution timeline
- Step-by-step results
- Performance metrics
- Any errors or warnings

## Step 8: Create a Custom Workflow

Now let's create a simple custom workflow:

```bash
# Start interactive workflow builder
vaultace workflow create --interactive
```

Interactive prompts:
```
? Workflow name: My Security Scan
? Description: Custom security scanning workflow
? Category: custom_security
? Priority: medium

? Add steps (select multiple):
 ✓ Vulnerability scan
 ✓ Generate report
 ✓ Send notification

? Configure vulnerability scan:
? Scan target: current_directory
? Include dependencies: yes
? Severity threshold: medium

✅ Custom workflow created: wf_my_security_scan_1641234567890
```

## Step 9: Test Custom Workflow

Execute your custom workflow:

```bash
# Run custom workflow
vaultace workflow run wf_my_security_scan_1641234567890

# Monitor execution
vaultace workflow monitor <execution-id> --follow --detailed
```

## Understanding Workflow Components

### Security Events
Workflows are triggered by security events:

```javascript
// Example security events that trigger workflows
{
  "type": "vulnerability_detected",
  "data": {
    "cve": "CVE-2024-1234",
    "severity": "critical",
    "package": "lodash",
    "version": "4.17.20"
  }
}
```

### Step Functions
Each workflow step is a secure, reusable function:

- **Scan Steps**: Vulnerability scanning, compliance checks
- **Fix Steps**: Automated remediation, patching
- **Test Steps**: Security testing, validation
- **Deploy Steps**: Safe deployment with rollback
- **Notify Steps**: Team communication, alerts
- **Audit Steps**: Compliance documentation

### State Management
All workflow state is encrypted and persisted:

- **Execution State**: Current workflow progress
- **Step Results**: Output from each step
- **Context Data**: Workflow variables and secrets
- **Audit Trail**: Complete execution history

## Advanced Features

### Conditional Execution

Workflows support conditional logic:

```yaml
steps:
  - name: "Check Severity"
    type: "audit"
    condition: "severity === 'critical'"

  - name: "Emergency Response"
    type: "fix"
    condition: "previous_step.severity === 'critical'"

  - name: "Standard Response"
    type: "fix"
    condition: "previous_step.severity !== 'critical'"
```

### Parallel Execution

Run multiple steps concurrently:

```yaml
steps:
  - name: "Security Scan"
    type: "scan"
    parallel_group: "assessment"

  - name: "Compliance Check"
    type: "audit"
    parallel_group: "assessment"

  - name: "Process Results"
    type: "fix"
    depends_on: ["assessment"]
```

### Error Handling

Built-in retry and recovery:

```yaml
steps:
  - name: "Deploy Patch"
    type: "deploy"
    retry_policy:
      max_attempts: 3
      backoff: "exponential"
    rollback_on_failure: true
```

## Next Steps

Congratulations! You've created and executed your first SecureFlow workflow. Here's what to explore next:

### 🚀 Immediate Next Steps
1. **[Browse Templates](../templates/README.md)** - Explore pre-built workflows
2. **[Learn Core Concepts](../concepts/README.md)** - Understand SecureFlow architecture
3. **[Set Up Monitoring](../guides/monitoring.md)** - Configure dashboards and alerts

### 🎯 Common Use Cases
- **[Vulnerability Response](../templates/vulnerability.md)** - Automate CVE patching
- **[Incident Response](../templates/incident.md)** - Breach response workflows
- **[Compliance Automation](../templates/compliance.md)** - SOC2, GDPR, HIPAA workflows

### 🔧 Advanced Topics
- **[Custom Step Functions](../concepts/steps.md)** - Build reusable workflow components
- **[API Integration](../api-reference/rest-api.md)** - Integrate with existing tools
- **[Security Best Practices](../guides/security.md)** - Secure workflow design

## Troubleshooting

### Common Issues

**Workflow fails to start:**
```bash
# Check authentication
vaultace auth status

# Verify workflow exists
vaultace workflow list
```

**Execution gets stuck:**
```bash
# Check step status
vaultace workflow monitor <execution-id> --detailed

# Stop if needed
vaultace workflow stop <execution-id>
```

**Permission errors:**
```bash
# Verify permissions
vaultace auth permissions

# Check role assignments
vaultace auth role list
```

### Getting Help

- **Documentation**: [Troubleshooting Guide](../guides/troubleshooting.md)
- **Community**: [GitHub Discussions](https://github.com/vaultace/vaultace-cli/discussions)
- **Support**: [Help Center](https://help.vaultace.com)

## Summary

You've successfully:
✅ Created your first security workflow
✅ Executed it with sample data
✅ Monitored real-time execution
✅ Built a custom workflow
✅ Learned core concepts

Your workflow is now ready to automate security operations and keep your applications secure!

---

**Quick Reference:**
```bash
# Essential commands you'll use daily
vaultace workflow templates         # Browse templates
vaultace workflow create           # Create workflow
vaultace workflow run <id>         # Execute workflow
vaultace workflow monitor <exec>   # Monitor execution
vaultace workflow list             # List workflows
```