Triggers
Manual Trigger
Starts a workflow manually. Configure runtime inputs to collect data (files, text, etc.) when triggered.
Supported input types:
file, text, number, json, array
Example use cases:
- Collect uploaded scope files before running security scans
- Prompt operators for target domains or API keys
Webhook
Sends JSON payloads to external HTTP endpoints with retries and timeouts.
Example use cases:
- Send scan results to Slack or Teams
- POST assets to a custom API
File Operations
File Loader
Loads file content from storage for use in workflows.Text Splitter
Splits text into an array of strings by separator.
Example: Split newline-delimited subdomains before passing to scanners.
Text Joiner
Joins array elements into a single string.Secrets
Secret Loader
Fetches secrets from the ShipSec-managed secret store.Secret values are automatically masked in all logs and terminal output.
Data Transformation
Array Pick
Extracts specific items from an array by index.Array Pack
Combines multiple values into a single array.Console Log
Outputs data to workflow logs for debugging.Storage Destinations
Artifact Writer
Writes workflow artifacts to ShipSec storage.File Writer
Writes content to a file in workflow storage.Destination S3
Uploads files to an S3-compatible bucket.AWS Credentials
Provides AWS credentials for S3 operations.Analytics
Analytics Sink
Indexes workflow output data into OpenSearch for analytics dashboards, queries, and alerts. Connect theresults port from upstream security scanners.
How it works:
- Each item in the input array becomes a separate document
- Workflow context is added under
shipsec.*namespace - Nested objects are serialized to JSON strings (prevents field explosion)
- All documents get the same
@timestamp
- Index Nuclei scan results for trend analysis
- Store TruffleHog secrets for tracking over time
- Aggregate vulnerability data across workflows
See Workflow Analytics for detailed setup and querying guide.