Skip to main content
Flows in Guardian Ops have different operational states that determine whether they process events or cases and whether they can be modified. These states apply to both inbound processing flows and playbook flows, with some differences in how they’re managed.

​
Draft

When you create a new flow, it starts in draft state. This is the initial state where you can modify the flow configuration freely. Key characteristics:
  • Events or cases are not processed by draft flows
  • Full editing capabilities available
  • Allows you to build and test configurations without affecting live processing
  • Can be saved and modified multiple times before activation
Draft state gives you the freedom to experiment with your flow design without impacting production workflows.

​
Active (Live)

Once you activate a flow, it enters the active state and begins processing incoming events or cases. Key characteristics:
  • Processes events or cases in real-time
  • Read-only - cannot be edited once activated
  • To make changes, you must duplicate the configuration or create a new flow
  • Activating a new flow automatically transitions the previous flow to draining state
Differences by flow type: Inbound Processing:
  • Only one inbound processing flow version can be active at a time
Playbooks:
  • Multiple playbooks can exist simultaneously
  • Each playbook can have multiple versions
  • One version per playbook can be live/active at a time
  • Playbooks only execute when attached to a case group

​
Draining

When you activate a new flow that replaces an existing active flow, the previous flow enters the draining state. Key characteristics:
  • Continues to process any remaining events or cases from the previous configuration
  • Automatically deactivates once all remaining items are processed
  • Ensures no events or cases are lost during the transition to a new flow
  • Applies to both inbound processing flows and playbook versions
Differences by flow type:
  • Inbound Processing: When a new flow is activated, the previous flow drains remaining events
  • Playbooks: When a new version is activated, the previous version drains cases already in progress
The draining state provides a smooth transition between flow versions, ensuring data integrity during configuration changes.

​
Inactive

When a flow has finished draining, it is set to inactive and kept. Guardian Ops keeps references that have run through past flows so you can go back and investigate why and where something happened, if necessary.

​
State Transitions

Draft → Active/Live (via activation)
Active → Draining (when a new flow is activated)
Draining → Inactive (automatically when processing completes)
For inbound processing, the flow lifecycle ensures continuous event processing while allowing configuration updates. For playbooks, there is an additional layer: you can have multiple playbooks, each connected to multiple case groups. Each playbook can have one active version.

​
Activating Flows

Activating a flow transitions it from draft state to live processing, allowing it to handle events or cases in real-time.

​
Activation Steps

  1. Complete your flow configuration - Ensure all required nodes are connected and configured
  2. Name your version - Provide a descriptive name and an optional description
  3. Save your draft - Click the Save button to persist your changes
  4. Click the Activate button - Located in the top right of the editor
  5. The flow becomes active and begins processing
Once activated, flows cannot be edited. You must duplicate the configuration or create a new version to make changes.

​
Key Differences by Flow Type

Inbound Processing:
  • Only one flow can be active at a time
  • When you activate a new flow, the previous flow enters draining state
  • Events already in the previous flow continue processing until completion
  • No events are lost during the transition
Playbooks:
  • Multiple playbooks can be live simultaneously
  • Each playbook can have multiple versions, with one version active per playbook
  • Activating a new version replaces the previous live version for that playbook only
  • Must be attached to a case group to execute - playbooks without case group assignments won’t process any cases
For playbooks: Ensure you have case groups configured in your inbound processing and that your playbook is attached to a case group before activation.

​
Making Changes After Activation

Since active flows are read-only, you can: Duplicate and Modify:
  • Click Duplicate (inbound processing) or New Version (playbooks)
  • Make your changes in the new draft
  • Activate when ready
Start Fresh:
  • Create a new flow or version from scratch
  • Build your desired configuration
  • Activate the new version