elastic · benironside · Apr 20, 2026 · Apr 16, 2026 · Apr 16, 2026 · Apr 17, 2026
@@ -34,7 +34,7 @@ Before you begin:
 * Familiarize yourself with the core concepts of [Elastic Workflows](/explore-analyze/workflows.md).
 * Enable the Workflows feature in **Advanced settings**.
 * Ensure you have the correct privileges to create and run workflows.
-* For details, refer to [Set up workflows](/explore-analyze/workflows/setup.md).
+* For details, refer to [Set up workflows](/explore-analyze/workflows/get-started/setup.md).
 * Create at least one workflow.
 
 ## Use the `ai.agent` step

@@ -25,7 +25,7 @@ This page explains how to trigger a workflow in an agent conversation. If you wa
 Before you begin:
 
 * Familiarize yourself with the core concepts of [Elastic Workflows](/explore-analyze/workflows.md).
-* [Set up workflows](/explore-analyze/workflows/setup.md): Enable the Workflows feature and ensure you have the correct privileges to create and run workflows.
+* [Set up workflows](/explore-analyze/workflows/get-started/setup.md): Enable the Workflows feature and ensure you have the correct privileges to create and run workflows.
 * Create at least one workflow.
 
 ## Add a Workflow tool

@@ -449,9 +449,25 @@ toc:
       - file: cases/cases-as-data.md
   - file: workflows.md
     children:
-      - file: workflows/setup.md
       - file: workflows/get-started.md
-      - file: workflows/core-components.md
+        children:
+          - file: workflows/get-started/setup.md
+          - file: workflows/get-started/build-your-first-workflow.md
+      - file: workflows/use-cases.md
+        children:
+          - file: workflows/use-cases/security.md
+            children:
+              - file: workflows/use-cases/security/automate-security-operations.md
+              - file: workflows/use-cases/security/manage-detection-rules.md
+          - file: workflows/use-cases/observability.md
+          - file: workflows/use-cases/ai-augmented-workflows.md
+      - file: workflows/authoring-techniques.md
+        children:
+          - file: workflows/authoring-techniques/use-yaml-editor.md
+          - file: workflows/authoring-techniques/pass-data-handle-errors.md
+          - file: workflows/authoring-techniques/monitor-workflows.md
+          - file: workflows/authoring-techniques/manage-workflows.md
+      - file: workflows/reference.md
         children:
           - file: workflows/triggers.md
             children:
@@ -463,21 +479,15 @@ toc:
               - file: workflows/steps/action-steps.md
                 children:
                   - file: workflows/steps/elasticsearch.md
-                  - file: workflows/steps/kibana.md                  
+                  - file: workflows/steps/kibana.md
                   - file: workflows/steps/external-systems-apps.md
               - file: workflows/steps/flow-control-steps.md
                 children:
                   - file: workflows/steps/if.md
                   - file: workflows/steps/foreach.md
                   - file: workflows/steps/wait.md
               - file: workflows/steps/ai-steps.md
-      - file: workflows/data.md
-        children:
-          - file: workflows/data/templating.md
-      - file: workflows/author-workflows.md
-      - file: workflows/monitor-troubleshoot.md
-      - file: workflows/manage-workflows.md
-      - hidden: workflows/use-cases.md
+          - file: workflows/templating.md
       - file: workflows/templates.md
   - file: numeral-formatting.md
   - hidden: explore-and-visualize.md

@@ -45,7 +45,7 @@ Some key concepts to understand while working with workflows:
 
 * **Triggers**: The events or conditions that initiate a workflow. Refer to [](/explore-analyze/workflows/triggers.md) to learn more.
 * **Steps**: The individual units of logic or action that make up a workflow. Refer to [](/explore-analyze/workflows/steps.md) to learn more.
-* **Data**: How data flows through your workflow, including inputs, constants, context variables, step outputs, and Liquid templating for dynamic values. Refer to [](/explore-analyze/workflows/data.md) to learn more.
+* **Data**: How data flows through your workflow, including inputs, constants, context variables, step outputs, and Liquid templating for dynamic values. Refer to [](/explore-analyze/workflows/authoring-techniques/pass-data-handle-errors.md) to learn more.
 
 ## Workflow structure [workflow-structure]
 
@@ -116,5 +116,17 @@ steps:
 
 ## Learn more
 
-- To create and run your first workflow, refer to [](/explore-analyze/workflows/get-started.md).
-- Understand how to use the YAML editor in {{kib}} to define and run your workflows. Refer to [](/explore-analyze/workflows/author-workflows.md) to learn more.
+Start here:
+
+- [Set up Workflows](/explore-analyze/workflows/get-started/setup.md): Turn on the feature and configure role-based access.
+- [Build your first workflow](/explore-analyze/workflows/get-started/build-your-first-workflow.md): A hands-on tutorial using sample data.
+
+Explore what you can automate:
+
+- [Use cases](/explore-analyze/workflows/use-cases.md): Browse security, observability, and AI-augmented patterns you can build with workflows today.
+
+Reference and authoring:
+
+- [Workflow authoring techniques](/explore-analyze/workflows/authoring-techniques.md): How to use the YAML editor, pass data between steps, and handle errors.
+- [Reference](/explore-analyze/workflows/reference.md): Triggers, steps, and templating engine reference.
+- [Workflow templates](/explore-analyze/workflows/templates.md): Pre-built workflows you can adapt.
@@ -0,0 +1,27 @@
+---
+navigation_title: Workflow authoring techniques
+applies_to:
+  stack: preview 9.3
+  serverless: preview
+description: Techniques for authoring, running, monitoring, and organizing Elastic Workflows.
+products:
+  - id: kibana
+  - id: cloud-serverless
+  - id: cloud-hosted
+  - id: cloud-enterprise
+  - id: cloud-kubernetes
+  - id: elastic-stack
+---
+
+# Workflow authoring techniques [workflows-authoring-techniques]
+
+Techniques that apply across workflow types, regardless of which outcome you're automating. Use this section when you're building or maintaining a workflow and need guidance on the mechanics.
+
+- [Use the YAML editor](/explore-analyze/workflows/authoring-techniques/use-yaml-editor.md): Author and run workflows in the YAML editor in {{kib}}.
+- [Pass data and handle errors](/explore-analyze/workflows/authoring-techniques/pass-data-handle-errors.md): Move data between steps, use dynamic templating, and make workflows resilient with `on-failure`.
+- [Monitor workflow execution](/explore-analyze/workflows/authoring-techniques/monitor-workflows.md): Track runs, review execution history, and troubleshoot failures.
+- [Manage and organize workflows](/explore-analyze/workflows/authoring-techniques/manage-workflows.md): Find, edit, duplicate, enable, and disable workflows from the **Workflows** page.
+
+% Ben Ironside Goldstein, 2026-04-16: Follow-up PRs per Vision doc Section 7 will split pass-data-handle-errors.md
+% into separate how-tos (Pass data between steps, Handle errors and retries, Use constants and inputs)
+% and add Use conditional logic, Iterate over results with Foreach, Test and debug a workflow.
@@ -1,8 +1,9 @@
 ---
+navigation_title: Manage and organize workflows
 applies_to:
   stack: preview 9.3
   serverless: preview
-description: Learn how to view, organize, and manage your workflows.
+description: Find, edit, duplicate, enable, disable, and run workflows from the Workflows page in Kibana.
 products:
   - id: kibana
   - id: cloud-serverless
@@ -12,12 +13,12 @@
   - id: elastic-stack
 ---
 
-# Manage workflows [workflows-manage]
+# Manage and organize workflows [workflows-manage]
 
 The **Workflows** page allows you to view and manage all your workflows. From the page, you can create, edit, duplicate, delete, and more with your workflows. To find the **Workflows** page, use the navigation menu or the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
 
 ::::{admonition} Requirements
-To use workflows, you must turn on the feature and ensure your role has the appropriate privileges. Refer to [](setup.md) for more information.
+To use workflows, you must turn on the feature and ensure your role has the appropriate privileges. Refer to [](/explore-analyze/workflows/get-started/setup.md) for more information.
 
 You must also have the appropriate subscription. Refer to the subscription page for [Elastic Cloud](https://www.elastic.co/subscriptions/cloud) and [Elastic Stack/self-managed](https://www.elastic.co/subscriptions) for the breakdown of available features and their associated subscription tiers.
 ::::
@@ -33,15 +34,15 @@
 
 ### Create a workflow [workflow-create]
 
-Click **Create a new workflow** to open the YAML editor. Refer to [](/explore-analyze/workflows/author-workflows.md) to learn how to use the editor.
+Click **Create a new workflow** to open the YAML editor. Refer to [](/explore-analyze/workflows/authoring-techniques/use-yaml-editor.md) to learn how to use the editor.
 
 ### Search and filter [workflow-search-filter]
 
 Use the search bar to filter workflows by name, description, or tag. You can also use the **Enabled** filter to only show workflows that are turned on (enabled) or off (disabled), and the **Created By** filter to only show workflows created by the specified user.
 
 ### Run a workflow [workflow-run]
 
-To instantly run a workflow, click the **Run** icon {icon}`play` for a workflow, or open the **All actions** menu ({icon}`boxes_vertical`) and click **Run**. The workflow manually runs regardless of its specified triggers. To learn about monitoring workflow runs, refer to [](/explore-analyze/workflows/monitor-troubleshoot.md).
+To instantly run a workflow, click the **Run** icon {icon}`play` for a workflow, or open the **All actions** menu ({icon}`boxes_vertical`) and click **Run**. The workflow manually runs regardless of its specified triggers. To learn about monitoring workflow runs, refer to [](/explore-analyze/workflows/authoring-techniques/monitor-workflows.md).
 
 ### Edit a workflow [workflow-edit]
 

@@ -1,8 +1,9 @@
 ---
+navigation_title: Monitor workflow execution
 applies_to:
   stack: preview 9.3
   serverless: preview
-description: Learn how to monitor Elastic workflows executions and troubleshoot errors.
+description: Track workflow runs in real time, review execution history, and troubleshoot workflow failures in Kibana.
 products:
   - id: kibana
   - id: cloud-serverless
@@ -12,12 +13,12 @@ products:
   - id: elastic-stack
 ---
 
-# Monitor and troubleshoot workflows [workflows-monitor-troubleshoot]
+# Monitor workflow execution [workflows-monitor-troubleshoot]
 
 After you run a workflow, you can track its progress in real time, review past executions, and diagnose any failures. This page explains how to use the execution panel and logs on the **Executions tab** to understand what happened during a workflow run.
 
 ::::{admonition} Requirements
-To use workflows, you must turn on the feature and ensure your role has the appropriate privileges. Refer to [](setup.md) for more information.
+To use workflows, you must turn on the feature and ensure your role has the appropriate privileges. Refer to [](/explore-analyze/workflows/get-started/setup.md) for more information.
 
 You must also have the appropriate subscription. Refer to the subscription page for [Elastic Cloud](https://www.elastic.co/subscriptions/cloud) and [Elastic Stack/self-managed](https://www.elastic.co/subscriptions) for the breakdown of available features and their associated subscription tiers.
 ::::

@@ -1,8 +1,9 @@
 ---
+navigation_title: Pass data and handle errors
 applies_to:
   stack: preview 9.3
   serverless: preview
-description: Learn how data flows through workflows, use dynamic templating, and handle errors gracefully.
+description: Pass data between workflow steps with templating, reference inputs and constants, and handle step failures with retries and fallbacks.
 products:
   - id: kibana
   - id: cloud-serverless
@@ -12,7 +13,7 @@ products:
   - id: elastic-stack
 ---
 
-# Data and error handling [workflows-data]
+# Pass data and handle errors [workflows-data]
 
 A key feature of workflows is the ability to pass data between steps and handle failures gracefully. This page explains the mechanisms for controlling data flow and building resilient, fault-tolerant automations.
 
@@ -64,7 +65,7 @@ steps:
 In this example:
 
 1. The `find_user_by_id` step searches an index for a document.
-2. The `create_case_for_user` step uses the output of the first step to enrich a new [{{elastic-sec}} case](../../solutions/security/investigate/security-cases.md).
+2. The `create_case_for_user` step uses the output of the first step to enrich a new [{{elastic-sec}} case](/solutions/security/investigate/security-cases.md).
 3. The `description` field accesses `steps.find_user_by_id.output.hits.hits[0]._source.user.fullName` to dynamically include the user's full name in the case description.
 
 ## Error handling [workflows-error-handling]
@@ -194,10 +195,10 @@ Template variables are the data sources you can reference inside template expres
 
 | Variable type | Syntax | Description |
 |---------------|--------|-------------|
-| Step outputs | `steps.<step_name>.output` | Data produced by each step during execution. Access results from previous steps to chain operations together. Refer to [Reference outputs](./data/templating.md#workflows-ref-step-outputs) for more details. |
-| Constants | `consts.<constant_name>` | Reusable values defined once at the workflow level using the `consts` block. Refer to [Reference constants](./data/templating.md#workflows-ref-constants) for more details. |
-| Inputs | `inputs.<input_name>` | Parameters defined in the `inputs` block that can be provided when the workflow is triggered. Refer to [Reference inputs](./data/templating.md#workflows-ref-inputs) for more details. |
-| Context variables | `execution.id`, `event`, `foreach.item` | Data automatically provided by the workflow engine at runtime, including execution metadata, trigger data, and loop state. Refer to [Context variables reference](./data/templating.md#workflows-context-variables) for more details. |
+| Step outputs | `steps.<step_name>.output` | Data produced by each step during execution. Access results from previous steps to chain operations together. Refer to [Reference outputs](/explore-analyze/workflows/templating.md#workflows-ref-step-outputs) for more details. |
+| Constants | `consts.<constant_name>` | Reusable values defined once at the workflow level using the `consts` block. Refer to [Reference constants](/explore-analyze/workflows/templating.md#workflows-ref-constants) for more details. |
+| Inputs | `inputs.<input_name>` | Parameters defined in the `inputs` block that can be provided when the workflow is triggered. Refer to [Reference inputs](/explore-analyze/workflows/templating.md#workflows-ref-inputs) for more details. |
+| Context variables | `execution.id`, `event`, `foreach.item` | Data automatically provided by the workflow engine at runtime, including execution metadata, trigger data, and loop state. Refer to [Context variables reference](/explore-analyze/workflows/templating.md#workflows-context-variables) for more details. |
 
 #### Choose between constants and inputs [workflows-constants-or-inputs]
 
@@ -215,7 +216,7 @@ Use template expressions to insert template variables into your workflow. The te
 | `{{ }}` | Insert values as strings | `"Hello, {{user.name}}"` |
 | `${{ }}` | Preserve data types (arrays, objects, numbers) | `${{steps.search.output.hits}}` |
 
-For syntax details and examples, refer to [Templating engine](./data/templating.md).
+For syntax details and examples, refer to [Templating engine](/explore-analyze/workflows/templating.md).
 
 ## Quick reference [workflows-data-quick-reference]
 

@@ -1,8 +1,9 @@
 ---
+navigation_title: Use the YAML editor
 applies_to:
   stack: preview 9.3
   serverless: preview
-description: Reference guide for the workflow YAML editor interface.
+description: Author, test, and run workflows in the Kibana YAML editor, and understand the difference between test runs and production runs.
 products:
   - id: kibana
   - id: cloud-serverless
@@ -12,12 +13,12 @@ products:
   - id: elastic-stack
 ---
 
-# Author workflows [workflows-yaml-editor]
+# Use the YAML editor [workflows-yaml-editor]
 
-The YAML editor is the primary interface for creating and editing workflows. This page describes the editor's components and features.
+The YAML editor is the primary interface for creating and editing workflows. This page describes the editor's components and features, and explains how test runs and production runs differ.
 
 ::::{admonition} Requirements
-To use workflows, you must turn on the feature and ensure your role has the appropriate privileges. Refer to [](setup.md) for more information.
+To use workflows, you must turn on the feature and ensure your role has the appropriate privileges. Refer to [](/explore-analyze/workflows/get-started/setup.md) for more information.
 
 You must also have the appropriate subscription. Refer to the subscription page for [Elastic Cloud](https://www.elastic.co/subscriptions/cloud) and [Elastic Stack/self-managed](https://www.elastic.co/subscriptions) for the breakdown of available features and their associated subscription tiers.
 ::::
@@ -35,10 +36,10 @@ The editor layout is composed of the following elements:
 | Component | Description |
 |-----------|-------------|
 | **Editor pane** | The main area for writing and editing workflows. To learn more about the expected workflow structure, refer to [](/explore-analyze/workflows.md). |
-| **Actions menu** | A quick-add menu for pre-formatted [triggers](triggers.md) and [step types](steps.md).  |
+| **Actions menu** | A quick-add menu for pre-formatted [triggers](/explore-analyze/workflows/triggers.md) and [step types](/explore-analyze/workflows/steps.md). |
 | **Save button** | Saves the current workflow. |
 | **Run button** | Manually runs the entire workflow or an individual step. <br> - Entire workflow: Click the **Run** icon {icon}`play` (next to **Save**).  <br> - Individual step: Select the step in the editor pane, then click the **Run** icon {icon}`play`.   |
-| **Executions tab** | Shows [execution history](monitor-troubleshoot.md) and real-time logs. |
+| **Executions tab** | Shows [execution history](/explore-analyze/workflows/authoring-techniques/monitor-workflows.md) and real-time logs. |
 | **Validation logs** | Shows validation successes and failures. Some common validation errors include: <br> - Invalid YAML syntax because of incorrect indentation or formatting <br> - Missing a required field or property (for example, `name`, `type`) <br> - The step type is unknown or doesn't match a valid action <br> - Invalid template syntax because of malformed template expression.|
 
 :::{tip}