{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44150,"path":"security-management/obtain-WMI-retrieval-workflow.md","title":"Security Operations System Command Integration- Get Running Processes flow","bundle":null,"doc_type":null,"release":"australia","body":"\n# Security Operations System Command Integration- Get Running Processes flow\n\nThe Security Operations System Command Integration - Get Running Processes flow retrieves the running processes of a configuration item when added or updated to a Windows or Unix-based security incident in the **Analysis** state.\n\n## Before you begin\n\nRole required: sn\\_si.analyst\n\n## About this task\n\nFor new security incidents, the flow runs automatically when you submit the incident with a selected configuration item, when the state automatically changes to **Analysis**. If it remains in the **Draft** state, then it does not run.\n\nExisting security incidents are automatically updated when you are in the **Analysis** state and you add a new configuration item.\n\nThe flow process actions include:\n\n-   [Get Configuration Item FQDN Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/get-config-FQDN-activity.md)\n-   [Determine Shell Script by OS activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/determine-shell-script-by-os-activity.md)\n-   [Legacy: Execution Tracking - Begin Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/execution-tracking-begin.md)\n-   [Get Running Processes via PowerShell](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/get-running-processes-via-pwrshell-activity.md)\n-   [Execute Shell Script activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/execute-shell-script-activity.md)\n-   [Legacy: Capability Execution Tracking- Failure Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/capability-execution-tracking-failure.md)\n-   [Extract Shell Script from MID Script activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/extract-shell-script-mid-script-activity.md)\n-   [Combine Results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/combine-results-activity.md) and return values in an array\n-   [Create Enrichment Data records Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/create-enrich-data-records.md)\n-   [Legacy: Capability Execution Tracking - Complete Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/capability-execution-tracking-complete.md)\n\n\\[Omitted image \"get-running-processes-flows.png\"\\] Alt text: Security Operations System Command Integration- Get Running Processes flow\n\n## Procedure\n\n1.  Open a security incident.\n\n2.  Update the **State** to **Analysis**, if necessary.\n\n3.  Add a configuration item \\(computer, server, or similar\\).\n\n4.  Click **Update**.\n\n    Security Incident Response Orchestration provides running process information in the **Related Link** > **Security Incident Enrichments**tab. For more information, see [Security Operations enrichment data mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/enrichment-data-mapping.md).\n\n    Actions specific to this flow are described here. For more information on other actions, see [Common Security Operations integration flows and orchestration activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/common-wf-activities.md).\n\n\n-   **[Combine results activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/combine-results-activity.md)**  \nThe Combine results workflow activity merges the results from third-party integrations to use in the workflow.\n-   **[Execute Shell Script activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/execute-shell-script-activity.md)**  \nThe Execute Shell Script workflow activity runs a MID server shell script within the workflow.\n-   **[Extract Shell Script from MID Script activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/extract-shell-script-mid-script-activity.md)**  \nThe Extract Shell Script from MID script workflow activity pulls a MID server shell script to use with in the workflow.\n-   **[Get Running Processes via PowerShell activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/get-running-processes-via-pwrshell-activity.md)**  \nThe Get Sensor ID workflow activity gathers running processes using PowerShell to use in the workflow.\n\n**Parent Topic:**[Security Operations Integration- Get Running Processes capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/get-running-processes-capability.md)\n\n"}}