Neuron Workflow Builder
Ivanti Neurons (feature) is being deprecated and replaced with the new Ivanti Neurons Bots experience. Please refer to Migrating to Neurons Bots for further information.
A Neuron workflow is made from a series of connected stages designed to automate various business processes and can be used to discover, provide insight, and take action. You can create a custom Neuron workflow from scratch or edit a pre-built one to customize it to your business needs using the Neuron Builder.
Neuron Settings
Use the Neuron Settings 
panel to configure the Neuron workflow. The settings available depend on the type of Neuron.
Neurons for Healing
Name: The name of the Neuron.
Category: Select the category from the drop-down list: Compliance, User Productivity, Business Continuity, or Resource Optimization.
Target Group: Select Custom or All Devices. If Custom, select from the drop-down list of all available public device groups. Device Groups are set up in Devices > Device Group.
Status Configuration: Toggle the status between Inactive and Active. When the Neuron is set to active the schedule settings become available for you to determine when the Neuron is to be run. Complete the following:
- Repeats: Daily or Weekly
- Frequency: Minutes or Hours
- Interval: If Hours; 1 to 24. If Minutes; 30 to 55 in 5 minute intervals.
- Start: Date and Time
- End: Date and Time
Neurons Workspace
Name: The name of the Neuron.
Status Configuration: Toggle the status between Unpublished and Published. When the Neuron is set to published the Action display name appears for you to name the action. This will appear in the Actions panel in the Device view.
My Stages
The My Stages panel on the left contains all of the default and installed stages. There are different categories of stages:
Additional queries and actions can be found in the Library and added to My Stages. For more details on the Library go to Neurons (Feature).
- Query: Used to present and filter information from devices which meet the specified criteria. For example, show devices with less than 10% free disk space. The output and context from this query stage can be passed through subsequent stages in the Neuron workflow. Each query contains a setting which allows the behavior of the Neuron to be controlled when results are not returned. By default Neuron will only continue if results are returned is selected. This means that if no results are returned from online devices, the Neuron workflow will progress no further. If this checkbox is cleared, the Neuron workflow will continue to progress, for example; this may be useful for raising an alert for positive confirmation that an issue has not been seen.
- Action: Action stages leverage Automation Fabric to perform actions such as sending email, or executing custom PowerShell on user devices. Use of variables is available for some actions. See Variables for details.
- Common: Includes:
- Filter Results: Filters the captured query information as defined by the filter properties. See Filter for details.
- Neurons Alert: Designed to generate alerts on the Neurons homepage.
- Custom: Leverage Bash Action, Custom JavaScript, PowerShell Action and Query, and osquery to allow you to create bespoke actions and queries. Any custom stages created in the Library > Stage Editor appear here once installed.
Examples of how to use osquery and PowerShell are available in Neuron Workflows Advanced Examples.
Workspace
Drag stages over to the workspace to build the Neuron workflow. Click on a stage to show the following options:
click to remove the stage from the Neuron.
click to add a connector to another stage.
click to break the connection between stages.
Stage Settings
When you drag a stage onto the workspace and it is highlighted the Stage Settings panel opens, use the settings to configure and customize each stage.
Click Stage Information to see a description of the stage and all the associated properties. These can be used as criteria to filter the query results.
Connection
Each stage must be connected to another stage so that the Neuron workflow can run. Highlight a stage and click and drag the connector arrows to the stage you want to connect it to. The Connection panel opens where you can customize the connection type and style and the line thickness and style. You can also amend the color and add a label.
Filter
You can filter query results based on customizable properties. When you connect a built-in Query stage to a Filter, the Property drop-down lists all available properties that can be selected. To view details of the properties go to the query Stage Settings panel and select Stage Information.
You can also use the Preview Query functionality to assess all targeted devices, and use the results table to view the format and range of values that can be filtered.
Custom queries such as osquery, PowerShell and BASH do not automatically populate the filter properties – These must be manually entered based on the column names returned by the query (or viewed in Preview Query).
You have the ability to join multiple queries together in sequence. If this is done, all results are combined and available to filter upon, or use in action stages such as Send Email and Create ISM ticket. You can change the comparison behavior of the connected filter so that it either applies either AND or the OR logic to determine the results.
Variables
Variables can be used to pass information between stages and pass the output of an action into another action. Variables can be used for the following stages:
- Neurons Alert
- Send Email
- Create Ticket (ISM)
Inserting Variables
To insert a variable open the Stage Settings for one of the appropriate stages; Neurons Alert, Send Email, Create Ticket (ISM). In the relevant fields use the keyboard shortcut (Ctrl+Space) to open the drop-down list of available variables and select the one you want to use:
- Neuron Name: [[Workflow.Name]] - the name of the Neuron e.g. Blacklisted Software
- Group Name: [[Workflow.Assistant]] - the name of the Neurons category the Neuron lives under e.g. Compliance
- NeuronURL: [[Workflow.Url]] - a link to the unique Run # instance for the Neuron
- Initiation User: [[Initiation.User]] - the name of the user that ran the manual instance
- Initiation User ID: [[Initiation.UserId]] - the ID of the user that ran the manual instance
- All Device Names: ${Ivanti.Devices} - a list of device names that were returned by the query separated by comma
- All Device Data: ${Ivanti.Results} - a list of all device data that was returned by the query
- Device Count: ${Ivanti.Results.length} - the number of devices that were returned by the query
- Coverage - Responded: the number of devices that responded
- Coverage - Errors: the number of devices that failed to respond, with errors
- Coverage - Percent: the percentage of devices that responded
There are ready to use templates using the variables. For more complex requirements the fields in Neurons Alerts and Emails support javascript but this uses handlebarsjs
Example
As an example, to return a list of devices in an email, you can use the following:
<ul class="devicelist">
{{#each Ivanti.Results}}
<li>{{this.deviceName}}</li>
{{/each}}
</ul>
Managing errors
Ideally, all of your Neurons will run successfully on all of the devices you target every time. However, sometimes not everything will succeed. Neurons workflows include some features to improve the success rate, and there are some design decisions and configuration settings you can make to improve the success rate and help you to manage any errors that do happen.
Timeouts
There is a balance to be made between waiting for a workflow to complete and not leaving it to continue long after it has failed. Appropriate timeouts are applied to each stage of a workflow. Query stages have a timeout of 15 seconds, Actions 5 minutes, and Targeted Actions 25 minutes.
Skipping runs
Scheduled runs start only if the previous run has completed. The Run Log for a Neuron indicates a skipped run with 
.
Error branching
When a stage runs, the workflow records on which devices the stage was successful and on which it failed. You can see these results in the Stage Output. If the stage is successful on only some of the targeted devices, both the stage and the run are marked as partially successful 
and the workflow progresses for just those devices that the stage succeeded for. You can improve your workflow design to more proactively handle this situation by adding error branches.
To add an error branch:
- Open the required workflow.
- From the My Stages panel, in the Common section, add a Filter Results stage below an Action stage.
- Connect the Action stage to the Filter Results stage.
- Click the Filter Results stage.
- In the Stage Settings panel, set Logic to AND, Property to Action Status, Comparison to Equals and Value to Failed.
- Connect a similar Filter Results stage to the same Action stage but with the Value set to Completed.
You now have an error branch that separates successful devices from failed devices. - Under the Completed Filter Results stage, complete your workflow design.
- Under the Failed Filter Results stage, add a Send Email action stage to report the failures, or add another appropriate action to try to progress the workflow.
Neuron Workflows Advanced Examples
The following examples demonstrate how you can build up a Neuron workflow and make use of the custom queries and actions:
Example 1: Heal Low Disk
This out of the box Neuron checks devices for low disk space and attempts an auto clean up. It then re-assesses the disk space and if it’s still problematic it will create a Service Manager ticket with the affected device names for a technician to take a look at:
Example 2: Heal High Uptime
This out of the box Neuron automatically reboots devices that have been online for more than a week.
Example 3: Parameterization
Parameterization of queries is supported to make it easier to repurpose them in Neurons. This is supported when using the editor and saving as a reusable library node:
Osquery uses SQL syntax e.g. select * from processes where name = myprocess.exe
Which is familiar to most admins.
If we use the above query as an example, we can specify this as:
select * from processes where name = __Name__
The double underscores indicate to Neurons that this should be parameterized, so when saved and the query is selected, there will be a Name input box in the settings panel:
You can also populate a drop-down of values to choose by inserting an options variable
In the editor, type op and press tab:
Replace with your preferred text and options, then save as a reusable library node:
These options will now be available as a drop-down:
Example 4: osquery subselect
Osquery queries are grouped into tables, but what if you want to combine results from multiple tables into one query?
Example: You want to use the registry table to retrieve a registry value:
But you also want the hardware vendor and model from system_info
Type your osquery in Neurons like this:
SELECT hardware_vendor,hardware_model,
(
SELECT data FROM registry
WHERE key = 'HKEY_LOCAL_MACHINE\Software\Ivanti\Neurons'
)
temp
FROM system_info
This returns as follows:
You could then connect a filter results stage to take an action when the registry value matches a certain value:
And optionally filter on hardware vendor
Or use the results to create a formatted table in an email:
To do this:
- Start with the Low Disk Space template.
- Edit the section in <th> tags with the preferred column names.
- Edit the section with the corresponding <td> tags to use the column names from preview, always prefixed with this. start with lower case, no spaces between words, and subsequent words are capitalized.
e.g. If a column is called My Devices, in the <td> section it would be this.myDevices
Example 5: PowerShell Query
It is possible to use PowerShell to query devices (Windows only). However, the query needs to return results as an array, and then be piped into ConvertTo-Json.
Example: Get-TimeZone would return results as an array like this:
PS C:\Users\Joe.Bloggs> get-timezone
Id : GMT Standard Time
DisplayName : (UTC+00:00) Dublin, Edinburgh, Lisbon, London
StandardName : GMT Standard Time
DaylightName : GMT Summer Time
BaseUtcOffset : 00:00:00
SupportsDaylightSavingTime : True
But when piped into ConvertTo-Json (PowerShell 3.0 and above) it looks like this:
PS C:\Users\Joe.Bloggs> get-timezone | convertto-json
{
"Id": "GMT Standard Time",
"DisplayName": "(UTC+00:00) Dublin, Edinburgh, Lisbon, London",
"StandardName": "GMT Standard Time",
"DaylightName": "GMT Summer Time",
"BaseUtcOffset": {
"Ticks": 0,
"Days": 0,
"Hours": 0,
"Milliseconds": 0,
"Minutes": 0,
"Seconds": 0,
"TotalDays": 0,
"TotalHours": 0,
"TotalMilliseconds": 0,
"TotalMinutes": 0,
"TotalSeconds": 0
},
"SupportsDaylightSavingTime": true
This allows Neurons to build the data into a table:
Tip: If Preview Query isn’t working – make sure all devices in the group are able to return the query (Windows devices with at least PowerShell 3). You can choose the Target Group in the Neuron Settings .
Once you have the results from the query, you can connect a filter stage to specify the conditions that need to be met for the stage to continue. Note: You will need to manually type the column names as filter Properties:
Example 6: Powershell Action
Neurons can execute PowerShell on endpoints by leveraging the Ivanti Neurons agent and automation fabric engine. Actions can be run in the security context of the end user or as System.
Like osquery, PowerShell actions can also be parameterized, e.g. if you wanted a reusable action that could uninstall a problematic Windows update, you could use the PowerShell editor to create a reusable library node with the following code:
wusa /uninstall /kb:__KBNumber__/quiet /norestart
the __KBNumber__ would be parameterized as an option where you can just type the number of the update you want to remove:
You can remove custom actions and queries from the editor by deleting from the library:
Example 7: BASH Query/Action
The BASH query/action functions in exactly the same way as PowerShell with the following exception, Bash does not have a built in ConvertTo-Json feature, so you must create the query to return results in JSON so it can be interpreted by Neurons.