Retrieve network statistics with the Get Network Statistics workflow The Security Incident Response - Get Network Statistics workflow retrieves the network statistics for an affected Windows-based resource when added to a security incident in the Analysis state. Before you beginRole required: sn_si.analyst About this task For new security incidents, the workflow runs automatically when you submit the incident with a selected configuration item and when the state automatically changes to Analysis. If the incident remains in the Draft state, the workflow does not run. Existing security incidents automatically update when in the Analysis state and a new configuration item is added. Workflow process activities include: Run Audit Log Enrichment script Get Configuration Item FQDN activity Get Network Statistics via netstat activity Create Enrichment Data records activity Procedure Open a security incident. Update the State to Analysis, if necessary. Add a configuration item (computer, server, or similar). Click Update. Security Incident Response Orchestration provides network statistics information in the Related Links > Security Incident Enrichments tab. For more information see, Security Operations enrichment data mapping. Related TasksCreate IoC Lookup Request for IoC Changes workflowRetrieve running processes with the Get Running Processes workflowGet Threat Email Details and Delete workflowReturn Email Details from Exchange workflowReturn Total Emails Found in Exchange workflowSearch and Delete Threat Emails workflowRelated ReferenceCreate IoC Lookup Request activity
Retrieve network statistics with the Get Network Statistics workflow The Security Incident Response - Get Network Statistics workflow retrieves the network statistics for an affected Windows-based resource when added to a security incident in the Analysis state. Before you beginRole required: sn_si.analyst About this task For new security incidents, the workflow runs automatically when you submit the incident with a selected configuration item and when the state automatically changes to Analysis. If the incident remains in the Draft state, the workflow does not run. Existing security incidents automatically update when in the Analysis state and a new configuration item is added. Workflow process activities include: Run Audit Log Enrichment script Get Configuration Item FQDN activity Get Network Statistics via netstat activity Create Enrichment Data records activity Procedure Open a security incident. Update the State to Analysis, if necessary. Add a configuration item (computer, server, or similar). Click Update. Security Incident Response Orchestration provides network statistics information in the Related Links > Security Incident Enrichments tab. For more information see, Security Operations enrichment data mapping. Related TasksCreate IoC Lookup Request for IoC Changes workflowRetrieve running processes with the Get Running Processes workflowGet Threat Email Details and Delete workflowReturn Email Details from Exchange workflowReturn Total Emails Found in Exchange workflowSearch and Delete Threat Emails workflowRelated ReferenceCreate IoC Lookup Request activity
