Security Operations System Command Integration- Get Running Processes flow

The Security Operations System Command Integration - Get Running Processes flow retrieves the running processes of a configuration item when added or updated to a Windows or Unix-based security incident in the Analysis state.

Before you begin

Role required: sn_si.analyst

About this task

For new security incidents, the flow runs automatically when you submit the incident with a selected configuration item, when the state automatically changes to Analysis. If it remains in the Draft state, then it does not run.

Existing security incidents are automatically updated when you are in the Analysis state and you add a new configuration item.

The flow process actions include:

• Get Configuration Item FQDN Flow Action

• Determine Shell Script by OS activity

• Legacy: Execution Tracking - Begin Flow Action

• Get Running Processes via PowerShell

• Execute Shell Script activity

• Legacy: Capability Execution Tracking- Failure Flow Action

• Extract Shell Script from MID Script activity

• Combine Results and return values in an array

• Create Enrichment Data records Flow Action

• Legacy: Capability Execution Tracking - Complete Flow Action

[Omitted image “get-running-processes-flows.png”] Alt text: Security Operations System Command Integration- Get Running Processes flow

Procedure

1. Open a security incident.

2. Update the State to Analysis, if necessary.

3. Add a configuration item (computer, server, or similar).

4. Click Update.

   Security Incident Response Orchestration provides running process information in the Related Link > Security Incident Enrichmentstab. For more information, see Security Operations enrichment data mapping.

   Actions specific to this flow are described here. For more information on other actions, see Common Security Operations integration flows and orchestration activities.

5. Combine results activity
   The Combine results workflow activity merges the results from third-party integrations to use in the workflow.

6. Execute Shell Script activity
   The Execute Shell Script workflow activity runs a MID server shell script within the workflow.

7. Extract Shell Script from MID Script activity
   The Extract Shell Script from MID script workflow activity pulls a MID server shell script to use with in the workflow.

8. Get Running Processes via PowerShell activity
   The Get Sensor ID workflow activity gathers running processes using PowerShell to use in the workflow.

Parent Topic:Security Operations Integration- Get Running Processes capability