Retrieve network statistics with the Get Network Statistics workflow

The Security Incident Response - Get Network Statistics workflow retrieves the network statistics for an affected Windows-based resource when added to a security incident in the Analysis state.

About this task

For new security incidents, the workflow runs automatically when you submit the incident with a selected configuration item and when the state automatically changes to Analysis. If the incident remains in the Draft state, the workflow does not run.

Existing security incidents automatically update when in the Analysis state and a new configuration item is added.

Workflow process activities include:

• Run Audit Log Enrichment script
• Get Configuration Item FQDN activity
• Get Network Statistics via netstat activity
• Create Enrichment Data records activity

1. Open a security incident.
2. Update the State to Analysis, if necessary.
3. Add a configuration item (computer, server, or similar).
4. Click Update.
   Security Incident Response Orchestration provides network statistics information in the Related Links > Security Incident Enrichments tab. For more information see, Security Operations enrichment data mapping.