Nodes are the building blocks of a workflow. This guide explains what each node does, when to use it, and what you configure in its side panel. For a compact option table, see the Node Reference.
Flow nodes
Start
Marks where execution begins.
- Use for: defining what a run receives — for example a file, a text input, or trigger data.
- Configure: the name/label and the inputs this workflow expects.
- Every workflow has exactly one Start node.
End
Marks where execution finishes and produces the run's final result.
- Use for: collecting the outputs from your final nodes as the workflow's answer/artifacts.
- Every workflow has at least one End node.
IF (condition)
Branches the path based on a comparison.
- Use for: decision points — if severity is "high", go to approval, otherwise finish.
- Configure: the value or field to check (often a field produced by the previous node, e.g. a parsed JSON key), the comparison, and a comparison value.
- Each IF node has a true and false output — connect both.
User Approve
Pauses the workflow for a human decision before continuing.
- Use for: anything risky or auditable — sending communications, changing systems, approving spend, accepting AI output.
- Configure: a label (e.g. "Approval Step") and the context the approver sees.
- While paused, the run waits in History until someone approves or rejects.
Intelligence nodes
LLM
Calls a language model with a prompt you define.
- Use for: any reasoning step — summarise, classify, generate, translate, extract.
- Configure: the model (from those available to you), a system/instruction prompt, and generation settings (endpoint and model name follow your workspace's configured connections — for example a local service or an OpenAI-compatible endpoint).
- The workhorse of most workflows.
Prompt
A node built around a saved prompt from the Prompt Library.
- Use for: reuse — apply a prompt your team already tuned and versioned, instead of re-typing instructions.
- Configure: which saved prompt to insert; additional variables fill the prompt's placeholders.
Deep Agent
A goal-driven agent that decides its own sub-steps using the tools it is given.
- Use for: open-ended tasks where you can state the objective but not script every step ("investigate this alert and report findings").
- Configure: optional instructions for the agent and the tools it may use. The agent plans, acts, and reports.
- Powerful but less predictable than scripted nodes — pair with User Approve before consequential actions.
Skills
Runs a skill from the Skills catalogue.
- Use for: encapsulating a reusable capability (a tested procedure with its own steps and tool usage) as a single node.
- Configure: which skill to run and its inputs.
Data and file nodes
Select File (Import File)
Brings a file into the workflow.
- Use for: document-processing pipelines. Choose the file, or set it to be provided per run ("auto-detected from file").
Text
Passes static or composed text into the flow.
- Use for: headers/footers, fixed context, connecting text between nodes ("Enter text to pass to the next node").
Template
Applies a saved template as a step.
- Use for: reusing an assistant's configuration inside an automated flow.
Output File
Writes the run's results to a file artifact.
- Use for: producing the deliverable — report CSV, JSON, Markdown — retrievable from run history.
Action nodes
MCP Tool
Calls a tool exposed by a connected MCP-compatible tool server.
- Use for: actions in external systems — search the web, read resources, call APIs, operate software (tool servers are registered by your administrator; see Tools).
- Configure: the server/tool (for example
search_web,read_resource) and the parameters the tool needs.
Local Tools
Calls tools available natively in the platform.
- Use for: built-in actions without an external server.
- Configure: the tool and its arguments (the side panel lists what each tool accepts).
Quality nodes
Format Check
Validates that the data passing through matches an expected structure.
- Use for: guarding model output — ensure the previous step produced valid JSON or the required fields before acting on it.
- Configure: the expected format; common patterns include requiring content shaped like an object (
^\{[\s\S]*\}$style checks).
Simulation and visualisation nodes
These support operational-security and telemetry style workflows.
Simulator
Generates simulated device or network events for testing workflows end-to-end without real infrastructure.
- Configure: the simulated device/field values and event content (the panel uses field names such as interfaces, DIMMs and result codes).
Map
Visualises geolocated events on a canvas map.
- Configure: Analysis Settings (which fields carry latitude/longitude, e.g.
systeminfo, dimm, result.code), a Marker Layer, and Custom Markers (add named markers with coordinates, e.g. site locations), plus appearance/view options. - Use for: incident/asset dashboards — see where telemetry events are originating.
Composing patterns
| Pattern | Nodes |
|---|---|
| Classify then branch | Start → Select File → LLM (classify) → IF → End |
| Guarded output | LLM → Format Check → Output File → End |
| Human-in-the-loop action | LLM (draft) → User Approve → MCP Tool (send) → End |
| Fan-out over items | Select File → Map (LLM per item) → LLM (aggregate) → End |
| Telemetry triage | Simulator → LLM (analyse) → Map (visualise) → IF → User Approve → End |
Next steps
- Workflow Builder — canvas basics
- Node Reference — compact field-by-field tables
- Workflow History — inspecting runs