{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44697,"path":"security-management/security-incident-response/obtain-network-statistics-workflow.md","title":"Security Incident Response- Get Network Statistics flow","bundle":null,"doc_type":null,"release":"australia","body":"\n# Security Incident Response- Get Network Statistics flow\n\nThe **Security Incident Response** > **Get Network Statistics** flow retrieves the network statistics for an affected Windows-based resource when added to a security incident in the **Analysis** state.\n\n## Before you begin\n\nRole required: sn\\_si.analyst\n\n## About this task\n\nFor new security incidents that contain configuration items, the flow runs automatically when the state changes to **Analysis**.\n\nExisting security incidents are automatically updated when you are in the **Analysis** state and you add a new configuration item.\n\n\\[Omitted image \"get-network-statistics-flow.png\"\\] Alt text: Get Network Statistics flow\n\nThe flow process actions include:\n\n-   [Get Configuration Item FQDN Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/get-config-FQDN-activity.md)\n-   Determine Shell Script by OS\n-   If statement is executed by Powershell\n-   [Legacy: Execution Tracking - Begin Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/execution-tracking-begin.md)\n-   [Get Network Statistics via netstat Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/get-network-stats-netstat-activity.md)\n-   [Legacy: Capability Execution Tracking- Failure Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/capability-execution-tracking-failure.md)\n-   [Create Enrichment Data records Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/create-enrich-data-records.md)\n-   [Legacy: Capability Execution Tracking- Failure Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/capability-execution-tracking-failure.md) - Returns enrichment ID.\n-   [Legacy: Capability Execution Tracking - Complete Flow Action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/capability-execution-tracking-complete.md)\n\n## Procedure\n\n1.  Open a security incident.\n\n2.  Update the **State** to **Analysis**, if necessary.\n\n3.  Add a configuration item \\(computer, server, or similar\\).\n\n4.  Click **Update**.\n\n    Security Incident Response Orchestration provides network statistics information in the **Related Links** > **Security Incident Enrichments** tab. For more information see, [Security Operations enrichment data mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/enrichment-data-mapping.md).\n\n    Actions specific to this flow are described here. For more information on other actions, see [Common Security Operations integration flows and orchestration activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/common-wf-activities.md).\n\n\n**Parent Topic:**[Security Incident Response Orchestration workflows and activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/sec-inc-resp-orchestration-workflows.md)\n\n**Parent Topic:**[Security Operations Integration- Get Network Statistics capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/get-network-statistics-capability.md)\n\n**Related topics**  \n\n\n[Create Lookup Request for IoC Changes workflow]()\n\n[Security Incident Response - Get Running Services workflow]()\n\n[Run procdump flow]()\n\n[Security Incident - Evaluate response task outcome workflow]()\n\n"}}