Triggers

Beyond manual execution, TestNet supports Cron Scheduling, Asset Event Triggers, and Run History Tracking.

---

1. Cron Scheduling

For routine security checks, continuous asset discovery, and periodic vulnerability sweeps, configure standard Cron expressions directly within your workflow definitions:

Configuration

Switch the trigger type to CRON in the workflow designer's trigger configuration panel and enter the expression, or declare the schedule right at the top of your DSL file:

kind: Workflow
metadata:
  id: daily-domain-enum
  name: Daily Domain Enumeration
  version: 1.0.0
spec:
  trigger:
    type: CRON
    enabled: true
    cron: "0 0 2 * * ?" # Automatically runs every night at 02:00 AM
    input:
      assetTypes: [DOMAIN]
  nodes:
    subfinder: # See the [DSL Reference](/en/workflow/dsl-reference) for full node definitions
      tool: subfinder
      inputs:
        target:
          from: [trigger.asset]

• Supported Cron Syntax: Spring Cron with 6 fields — Seconds, Minutes, Hours, Day of Month, Month, Day of Week (? is allowed in the day fields); the 7th Year field is not supported;
• Scheduling Cadence: A new run instance is created each time the schedule fires. Set the interval longer than the workflow's typical runtime to avoid run instances piling up.

---

2. Event-Driven Auto-Triggers

TestNet supports automatic triggering based on asset events. Once a workflow's trigger.type is set to AUTO, newly discovered assets matching the conditions immediately launch the workflow:

Common Auto-Trigger Use Cases

• New Subdomain Discovered: The moment a new subdomain is added to the graph, TestNet instantly triggers Web port scanning and fingerprint identification;
• New Web Service Exposed: Automatically launches sensitive directory brute-forcing and weak password checks against newly exposed login panels;
• New Vulnerability Recorded: Immediately fires emergency alerts via WeChat/Webhook channels while archiving PoC proof snippets.

Filter Rules

Set trigger.type to AUTO in your workflow DSL and configure the watched asset types plus an optional Aviator filter expression (validated at compile time) under trigger.input:

spec:
  trigger:
    type: AUTO
    enabled: true
    input:
      assetTypes: [SUBDOMAIN]  # Only listen for new subdomain events
      filter: "<Aviator expression>" # Optional: extra conditions on the triggering asset

TIP

The AUTO trigger's asset-type scope is defined by trigger.input.assetTypes; downstream nodes further decide whether to process a new asset via dependencies and when conditional expressions.

---

3. Workflow Run History & Execution Traces

Navigate to "Workflow Management" -> "Run History" for full visibility across all manual, scheduled, and event-driven pipeline executions:

Status & Trigger Attribution

• Execution States: Clear visual indicators for RUNNING, COMPLETED (success), PARTIAL (partial success), FAILED, and CANCELLED (aborted by user);
• Trigger Mode: Accurately tracks whether an execution originated from MANUAL (user click), CRON (scheduled timer), ASSET (auto-triggered by asset change events), or AI (triggered by AI Agent via MCP).

Step-by-Step Task Breakdown

Clicking any workflow run row expands the complete DAG task tree:

• Phase Duration: Pinpoints bottlenecks by displaying exact runtimes per step (e.g., subdomain-enum took 45s, vuln-scan took 12m);
• Live Terminal Logs: For active tasks, click to view real-time colored terminal logs;
• Failed Task Re-run: For subtasks that failed due to network interruptions or similar issues, use "Re-run" on the task in the Task List to dispatch it again.