{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44528,"path":"security-management/security-incident-response/get-running-services-workflow.md","title":"Security Incident Response - Get Running Services workflow","bundle":null,"doc_type":null,"release":"australia","body":"\n# Security Incident Response - Get Running Services workflow\n\nThe **Security Incident Response - Get Running Services workflow** retrieves a list of running services from Windows-based, ServiceNow, configuration items \\(CIs\\). This workflow is used for incident enrichment during investigations.\n\n## Before you begin\n\nRole required: sn\\_si.analyst\n\n## About this task\n\nThe **Security Incident Response - Get Running Services workflow** runs automatically when you add a new configuration item to a Windows security incident after the state changes to **Analysis**. The information this workflow obtains appears on the **Show Enrichment Data** tabs for the security incident.\n\n**Note:** If the security incident remains in the **Draft** state, the **Security Incident Response - Get Running Services workflow** workflow does not run.\n\nWorkflow activities include:\n\n-   Audit Log Enrichment Script activity\n-   [Get Configuration Item FQDN Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/get-config-FQDN-activity.md)\n-   [Determine Shell Script by OS activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/determine-shell-script-by-os-activity.md)\n-   Is Execution via PowerShell activity\n-   [Get Running Services - WMI Enrichment activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/get-running-services-via-pwrshell-activity.md)\n-   [Create Enrichment Data records Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/create-enrich-data-records.md)\n\n## Procedure\n\n1.  Open a security incident.\n\n2.  Update the **State** to **Analysis**, if necessary.\n\n3.  Add a Windows-based configuration item \\(server, laptop, or similar\\).\n\n4.  Select **Update**.\n\n    Security Incident Response provides running services information in the **Related Links** > **Security Incident Enrichments**tab. For more information, see [Security Operations enrichment data mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/enrichment-data-mapping.md).\n\n\n-   **[Determine Shell Script by OS activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/determine-shell-script-by-os-activity.md)**  \nThe Determine Shell Script by OS workflow activity determines which operating system to use in the workflow\n-   **[Get Running Services - WMI Enrichment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/get-running-services-via-pwrshell-activity.md)**  \nThe **Security Incident Response - Get Running Services** workflow gathers running services on a configuration item added to a security incident.\n\n**Parent Topic:**[Security Incident Response Orchestration workflows and activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/sec-inc-resp-orchestration-workflows.md)\n\n**Related topics**  \n\n\n[Create Lookup Request for IoC Changes workflow]()\n\n[Security Incident Response- Get Network Statistics flow]()\n\n[Run procdump flow]()\n\n[Security Incident - Evaluate response task outcome workflow]()\n\n"}}