Steps and Actions

Steps and actions are the building blocks of workflows in Keep Workflow Engine. While they share a similar structure and syntax, the difference between steps and actions is mostly semantic:

Steps: Focused on querying data or triggering fetch-like operations from providers (e.g., querying databases, fetching logs, or retrieving information).
Actions: Geared toward notifying or triggering outcomes, such as sending notifications, updating tickets, or invoking external services.

Together, steps and actions allow workflows to both gather the necessary data and act upon it.

General Structure

Both steps and actions are defined using a similar schema:

Steps

Used for querying or fetching data. Step uses the _query method of each provider.

steps:
  - name: <step-name>
    provider:
      type: <provider-type>
      config: <provider-config>
      with:
        <provider-specific-parameters>

Actions

Used for notifications or triggering effects. Action uses the _notify method of each provider.

actions:
  - name: <action-name>
    provider:
      type: <provider-type>
      config: <provider-config>
      with:
        <provider-specific-parameters>

Examples

Fetch data from a MySQL database

steps:
  - name: get-user-data
    provider:
      type: mysql
      config: "{{ providers.mysql-prod }}"
      with:
        query: "SELECT * FROM users WHERE id = 1"
        single_row: true

Retrieve logs from Datadog

steps:
  - name: get-service-logs
    provider:
      type: datadog
      config: "{{ providers.datadog }}"
      with:
        query: "service:keep and @error"
        timeframe: "1h"

Query Kubernetes for running pods

steps:
  - name: get-pods
    provider:
      type: k8s
      config: "{{ providers.k8s-cluster }}"
      with:
        command_type: get_pods

Send an email

actions:
  - name: send-email
    provider:
      type: email
      config: "{{ providers.email }}"
      with:
        to: "[email protected]"
        subject: "Account Updated"
        body: "Your account details have been updated."

Send a Slack Message

actions:
  - name: notify-slack
    provider:
      type: slack
      config: "{{ providers.slack-demo }}"
      with:
        message: "Critical alert received!"

Create a ticket in ServiceNow

actions:
  - name: create-servicenow-ticket
    provider:
      type: servicenow
      config: "{{ providers.servicenow }}"
      with:
        table_name: INCIDENT
        payload:
          short_description: "New incident created by Keep"
          description: "Please investigate the issue."

Combining Steps and Actions

A workflow typically combines steps (for querying data) with actions (for notifications or outcomes). Here’s few examples:

Query and Notify

workflow:
  id: query-and-notify
  description: "Query a database and notify via Slack"
  steps:
    - name: get-user-data
      provider:
        type: mysql
        config: "{{ providers.mysql-prod }}"
        with:
          query: "SELECT email FROM users WHERE id = 1"
          single_row: true

  actions:
    - name: send-notification
      provider:
        type: slack
        config: "{{ providers.slack-demo }}"
        with:
          message: "User email: {{ steps.get-user-data.results.email }}"

Alert and Incident Management

workflow:
  id: alert-management
  description: "Handle alerts and create incidents"
  steps:
    - name: get-alert-details
      provider:
        type: datadog
        config: "{{ providers.datadog }}"
        with:
          query: "service:keep and @alert"
          timeframe: "1h"

  actions:
    - name: create-incident
      provider:
        type: servicenow
        config: "{{ providers.servicenow }}"
        with:
          table_name: INCIDENT
          payload:
            short_description: "Alert from Datadog: {{ steps.get-alert-details.results.alert_name }}"
            description: "Details: {{ steps.get-alert-details.results.alert_description }}"

Error Handling and Retries

Both steps and actions support error handling to ensure workflows can recover from failures.

steps:
  - name: fetch-data
    provider:
      type: http
      with:
        url: "https://api.example.com/data"
    on-failure:
      retry:
        count: 3
        # Retry every 5 seconds
        interval: 5

Continue on error

By default, if a step or action fails the workflow stops immediately and reports a failure. Set continue_on_error: true on any step or action to swallow its failure and continue executing the remaining steps/actions — similar to continue-on-error in GitHub Actions.

steps:
  - name: optional-enrichment
    continue_on_error: true
    provider:
      type: http
      config: "{{ providers.some-api }}"
      with:
        url: "https://api.example.com/optional-data"

  - name: always-runs
    provider:
      type: slack
      config: "{{ providers.slack-demo }}"
      with:
        message: "Runs even if optional-enrichment failed"

The same attribute works on actions:

actions:
  - name: best-effort-ticket
    continue_on_error: true
    provider:
      type: servicenow
      config: "{{ providers.servicenow }}"
      with:
        table_name: INCIDENT
        payload:
          short_description: "Automated incident"

  - name: fallback-slack
    provider:
      type: slack
      config: "{{ providers.slack-demo }}"
      with:
        message: "Ticket creation may have failed, check ServiceNow"

When continue_on_error: true is set, the step/action failure is logged as a warning but does not mark the overall workflow execution as failed.

Overview

AIOps

Alerts

Incidents

Workflow Automation

Alert Evaluation Engine

Providers

Deployment

Development

Keep CLI

Steps and Actions

General Structure

Steps

Actions

Examples

Fetch data from a MySQL database

Retrieve logs from Datadog

Query Kubernetes for running pods

Send an email

Send a Slack Message

Create a ticket in ServiceNow

Combining Steps and Actions

Query and Notify

Alert and Incident Management

Error Handling and Retries

Continue on error

​General Structure

​Steps

​Actions

​Examples

​Fetch data from a MySQL database

​Retrieve logs from Datadog

​Query Kubernetes for running pods

​Send an email

​Send a Slack Message

​Create a ticket in ServiceNow

​Combining Steps and Actions

​Query and Notify

​Alert and Incident Management

​Error Handling and Retries

​Continue on error

General Structure

Steps

Actions

Examples

Fetch data from a MySQL database

Retrieve logs from Datadog

Query Kubernetes for running pods

Send an email

Send a Slack Message

Create a ticket in ServiceNow

Combining Steps and Actions

Query and Notify

Alert and Incident Management

Error Handling and Retries

Continue on error