{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44868,"path":"security-management/security-incident-response/sec-inc-resp-orchestration-workflows.md","title":"Security Incident Response Orchestration workflows and activities","bundle":null,"doc_type":null,"release":"australia","body":"\n# Security Incident Response Orchestration workflows and activities\n\nSeveral workflows and activities are included with Security Incident Response Orchestration.\n\nOnly users with the sn\\_sec\\_cmn.admin role can [Workflow editor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/build-workflows/workflow-editor.md).\n\n-   **[Create Lookup Request for IoC Changes workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/t_CreateScanRequestforIoCChanges.md)**  \nThe **Security Incident Response - Create Lookup Request for IoC Changes** flow is triggered by the **Lookup Security Incident Observables** scheduled job to automatically look up IoCs that are added or changed. Malware scans are triggered only when new data is entered and only the new data is scanned.\n-   **[Security Incident Response- Get Network Statistics flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/obtain-network-statistics-workflow.md)**  \nThe **Security Incident Response** > **Get Network Statistics** flow retrieves the network statistics for an affected Windows-based resource when added to a security incident in the **Analysis** state.\n-   **[Security Incident Response - Get Running Services workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/get-running-services-workflow.md)**  \nThe **Security Incident Response - Get Running Services workflow** retrieves a list of running services from Windows-based, ServiceNow, configuration items \\(CIs\\). This workflow is used for incident enrichment during investigations.\n-   **[Run procdump flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/invoke_procdump.md)**  \nThe **Run procdump** flow runs a process dump on a specified process and saves it to a file that can be targeted by security analysts.\n-   **[Security Incident - Evaluate response task outcome workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/si-evaluate-response-task-outcome-workflow.md)**  \nSecurity Incident - Evaluate Response task outcome workflow determines the task to use, invokes a chosen workflow and evaluation script based on the outcome evaluator record provided as input to the chosen workflow.\n\n**Parent Topic:**[Understand Security Incident Response Orchestration workflows and workflow templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/view-wf-templates.md)\n\n"}}