Nebulock · Arazzo Workflow

Run a Nebulock hunt and generate a report

Version 1.0.0

Create a hunt, add a follow-up directive, then generate and fetch its report.

1 workflow 1 source API 1 provider
View Spec View on GitHub CompanySecurityThreat HuntingThreat DetectionSecurity OperationsDetection EngineeringAI AgentsSIEMArazzoWorkflows

Provider

nebulock

Workflows

runHuntAndReport
Create a hunt, drive it with a directive, and generate a report.
5 steps inputs: followup, query outputs: huntId, reportId
1
createHunt
create_hunt_v2
2
getHunt
get_hunt_v2
3
addDirective
add_directive_v2
4
generateReport
generate_hunt_report_v2
5
fetchReport
get_hunt_report

Source API Descriptions

openapi
nebulock https://raw.githubusercontent.com/api-evangelist/nebulock/refs/heads/main/openapi/nebulock-openapi.yml

Arazzo Workflow Specification

Raw ↑ 
arazzo: 1.0.1
info:
  title: Run a Nebulock hunt and generate a report
  version: 1.0.0
  summary: Create a hunt, add a follow-up directive, then generate and fetch its report.
sourceDescriptions:
- name: nebulock
  url: ../openapi/nebulock-openapi.yml
  type: openapi
workflows:
- workflowId: runHuntAndReport
  summary: Create a hunt, drive it with a directive, and generate a report.
  inputs:
    type: object
    properties:
      query:
        type: string
      followup:
        type: string
  steps:
  - stepId: createHunt
    operationId: create_hunt_v2
    requestBody:
      contentType: application/json
      payload:
        query: $inputs.query
    outputs:
      huntId: $response.body#/hunt_id
  - stepId: getHunt
    operationId: get_hunt_v2
    parameters:
    - name: hunt_id
      in: path
      value: $steps.createHunt.outputs.huntId
  - stepId: addDirective
    operationId: add_directive_v2
    parameters:
    - name: hunt_id
      in: path
      value: $steps.createHunt.outputs.huntId
    requestBody:
      contentType: application/json
      payload:
        query: $inputs.followup
  - stepId: generateReport
    operationId: generate_hunt_report_v2
    parameters:
    - name: hunt_id
      in: path
      value: $steps.createHunt.outputs.huntId
    outputs:
      reportId: $response.body#/hunt_report_id
  - stepId: fetchReport
    operationId: get_hunt_report
    parameters:
    - name: hunt_report_id
      in: path
      value: $steps.generateReport.outputs.reportId
  outputs:
    huntId: $steps.createHunt.outputs.huntId
    reportId: $steps.generateReport.outputs.reportId