Need any help with creating a Workflow? Feel free to submit an issue or join our Slack and we will help with that.
A Workflow in Keep is a YAML-based configuration file designed to manage, automate, and enrich alerts. Once uploaded to Keep, the workflow can run based on three different types of triggers: manual, alert, or interval. In this document, we’ll look into each of these components in detail.

In this section we will review the Workflow components.


When you run alert with the CLI using keep run, the CLI run the alert regardless of the triggers.
A trigger is an event that starts the workflow. It could be a manual trigger, an alert, or an interval depending on your use case. Keep support three types of triggers:

Manual trigger

# run manually
  - type: manual

Alert trigger

# run every time alert from cloudwatch triggered
  - type: alert
      - key: source
        value: cloudwatch

Interval trigger

# run every 10 seconds
  - type: interval
    value: 10


Steps are optional and define a sequence of actions that fetch or compute data. They are used to add data to the workflow, which can be used in other steps or actions.


An action defines what to do when a workflow is triggered. Actions usually rely on providers for executing specific tasks, like sending a Slack message.


A condition sets the rules under which an action should be performed. For example, you can set a condition to only trigger an action if certain criteria are met.