# Workflows

The workflow library is every runnable investigation across the graph, grouped by what you are trying to do.

## 1. The library

Each card is a workflow: Attack Path and Connection Finder, Attack-Surface Mapper, Threat Investigation, Indicator Enrichment, and more, each showing the graph layers it uses.

![The Workflows library, shown with demo data: featured and categorized workflow cards such as Attack Path and Connection Finder, Attack-Surface Mapper, Threat Investigation, and Indicator Enrichment, each with layer tags and a docs link.](/docs/shots/workflows-gallery.png)

*The library: every runnable workflow, grouped by area, each card showing the graph layers it uses. Demo data.*

## 2. Filter the library

Filter by use case, persona, task, or graph layer, each with a live count.

![The Workflows filter facets: use case, persona, task, and layer, each value with a live count.](/docs/shots/workflows-filters.png)

*Filter by use case, persona, task, or graph layer, each with a live count.*

## 3. Run a workflow

Open a workflow, set its parameters, give it an indicator, and run it. The same run is available from [Investigate](/docs/investigate) and over [MCP](/docs/connect-mcp).

![A workflow detail view, shown with demo data: a title and description, a search box with sample indicators, a parameters section, layer tags, and related workflows.](/docs/shots/workflow-detail.png)

*Open a workflow, set its parameters, give it an indicator, and run it. Demo data.*