How to use Mythic Flows

What is Mythic Flows

Mythic's Eventing system runs YAML-defined workflows in response to triggers (a new callback, a keyword, a manual start). Writing those workflows by hand gets fiddly once you add branching and tagging. Mythic Flows gives you a two-way editor: a node graph on one side, the exact YAML on the other, kept in sync. Everything you build maps to real eventing constructs — nothing proprietary.

The interface

The workspace has four regions:

Top bar

Brand and blog links, the example picker, flow statistics, and the Visual / YAML mode toggle. The primary action on the right is Generate YAML (in Visual mode) or Apply YAML (in YAML mode).

Inspector (left)

Context panel for the selected node. Edit its fields here, or use the buttons at the bottom to add new steps. Drag the divider to resize it; the inspector can be hidden entirely for more canvas room.

Canvas (centre)

The node graph. Pan by dragging the background, zoom with the wheel, and use Organize / Fit view / Node spacing to tidy the layout. A minimap and zoom controls sit in the corners.

YAML tab

The full flow as syntax-highlighted YAML with live validation. Parse errors are underlined inline with line numbers so you can fix them before applying.

Quick start

1. Open the editor. A complex example loads by default so you have something to explore.
2. Use the Examples picker in the top bar to load a bundled flow — each one mirrors a walk-through from the blog series. Filter by name, pick one, and press Open.
3. Click any node to edit it in the inspector. Start with the Flow header to set the flow name, trigger, and keywords.
4. Add steps from the inspector footer or the canvas helper — task, conditional, tag, approval, switch, or an environment variable.
5. Connect nodes by dragging from a node's right handle to the next node's left handle. Step names drive dependencies, so keep each one unique.
6. Switch to the YAML tab to read or copy the result. Edits in either mode round-trip losslessly.

Node types

Nodes are colour-coded by role — the same colours used on the canvas, the minimap, and the inspector accents.

Conditional branching

A conditional node evaluates a comparison and routes follow-up steps based on the outcome. Under the hood it runs the generic_compare.py helper (generic_compare) shipped with Hydra. In the inspector you set a left value, an operator, and a right value; you can reference task output or env.VAR values on either side.

The operator field accepts a wide set of aliases, including:

• == eq equals
• != ne not_equal
• > < >= <=
• contains not_contains in not_in
• starts_with ends_with regex matches
• case-sensitive variants: equals_cs contains_cs regex

Switch steps

A switch is a multi-gate conditional: one entry point fanning out to several destinations. Each gate has its own operator and target and is checked in order — use it instead of chaining many separate conditionals when several branches share a source. Add, remove, and reorder gates from the inspector's Switch gates section.

Callback tagging

Tagging gives callbacks durable, queryable labels — covered in Part II of the series. Two node styles work together:

Tag add step

Writes a tag (optionally with a colour) onto a callback via hydra_callback_tag.py.

Tag check step

A conditional that queries the tag store with tag_exists; the operator toggles between exists and not exists.

Together they let a flow tag a host once and have every later step branch on that tag without recomputing it.

Approval gates

An approval node inserts a human in the loop. The flow runs approve_step and pauses until an operator approves or rejects, so high-impact actions never fire unattended. This is the Part III (WIP) pattern — read the post for the server-side setup.

Environment variables

Define reusable values on the flow header and reference them anywhere as env.VAR_NAME. They're ideal for tag names, tag colours, target callback IDs, or any literal you'd otherwise repeat across steps. Add them from the header's Environment variables list or the + Environment variable button.

environment:
  HYPERV_TAG_NAME: HyperV
  HYPERV_TAG_COLOR: "#2F80ED"

# referenced from a step
inputs:
  tag: env.HYPERV_TAG_NAME
  color: env.HYPERV_TAG_COLOR

Visual ↔ YAML

The Visual and YAML tabs are two views of the same flow. Edit nodes visually and press Generate YAML; or hand-edit the YAML and press Apply to graph. Conversions are lossless, so you can move between them freely. The YAML editor highlights syntax and flags parse errors inline with line numbers — the Apply button stays disabled until the document parses cleanly.

Keyboard shortcuts

The full list is also available from the Shortcuts button in the editor's top bar.

Tips & troubleshooting

• Start from a bundled example rather than a blank canvas — it's faster and the examples mirror the post walk-throughs.
• Keep step names unique. Dependencies and follow-up links resolve by name, and duplicates are flagged in the inspector.
• Use Organize and the Node spacing slider to keep large graphs readable.
• If a node looks wrong, open the Raw tab in the inspector to edit its underlying step block directly.
• Lost your work? Drafts persist in local storage — Clear draft resets to a clean slate, and Starter flow loads a minimal template.

Resources

• Part I — Building Conditional Red Team Workflows
• Part II — Automatic Callback Tagging
• Part III — Operator Approval Gates WIP
• r4ulcl/Mythic-Advanced-Eventing — repository
• MythicAgents/Hydra — eventing helpers
• Mythic docs — Eventing reference