Creating a Database
Let the platform detect structured output from your workflows and turn it into a live, auto-updating database table.
On this page9
Overview
The platform automatically detects when a workflow node produces JSON Lines output. Structured output is any node output where each line is a valid JSON object. When this is detected, you can create a Live Table directly from that output without defining a schema manually.
Live Tables are updated after every workflow run, so your database always reflects the latest results.
How Detection Works
After a workflow run completes, the platform inspects node outputs for JSON Lines format. Each detected output appears as a candidate in the Database tab under Detected from workflow, along with a preview of the fields found and sample values from the actual output.
Creating a Live Table
Navigate to your workflow and click the Database tab. If any node outputs have been detected as structured JSON Lines, they appear under the Detected from workflow section.
Click Create Live Table next to the output you want to use as a data source. A configuration panel opens with a preview of the detected fields and sample data from the last run.
Enter a name for the table. Use a name that reflects the content (e.g., open_ports, discovered_subdomains).
Review the list of detected fields. For each field you want to include as a column:
- Toggle the field on to include it in the table.
- Set the data type for the column.
| Type | Use for |
|---|---|
text | Hostnames, URLs, strings |
int | Ports, counts, numeric scores |
int64 | Large integers exceeding standard int range |
float | Decimal numbers |
float64 | High-precision decimal numbers |
bool | True/false flags |
uuid | Identifiers |
datetime | Timestamps |
data | Raw or complex values |
The sample data preview updates as you make changes, so you can verify the column will be populated correctly.
Toggle Primary key on for at least one column. You can select multiple columns to form a composite primary key.
Choosing a good primary key:
- Use fields that are stable and unique per logical record (e.g.,
hostnamefor assets,ip + portfor services). - Avoid high-cardinality fields that change between runs if you want to track changes over time rather than create new rows.
Click Create Live Table. The table is created immediately and populated with data from the last run.
How Live Tables Are Updated
After each workflow run, the platform writes new output to all connected Live Tables using the following logic:
- Primary key match found: the non-key columns for that record are updated with the new values.
- No primary key match: a new row is inserted.
- Row not present in new output: the existing row is left unchanged until you act on it (see Schema and data changes below).
This means your table accumulates all discovered records over time, with non-key fields always reflecting the most recent values seen.
Schema and Data Changes
As workflows evolve, the output structure may change between runs. The platform handles two cases:
New field detected
If a run produces a JSON object with a field that does not exist as a column in the table, the platform notifies you. You can choose to:
- Add the column to the table with a chosen data type.
- Ignore the field, in which case it is excluded from future imports until you act on it.
Field no longer present
If a field that previously existed in the output is no longer found in a run's data, the platform flags the column as missing from the source. You can choose to:
- Keep the column as-is. Existing values are preserved; new rows will have no value for that column.
- Delete the column from the table entirely, which removes all stored values for that field.