Security Operations Carbon Black Integration - Get Running Processes workflow The Security Operations Carbon Black Integration - Get Running Processes is the implementation for the Carbon Black integration launched by the Security Operations Integration - Get Running Process workflow. Before you beginRole required: sn_si.analyst About this task Workflow process activities include: Get IP from CI activity Collect Carbon Black Configurations activity Get Sensor ID activity Execution Tracking - Begin (CIs) activity Create Session Capability Execution Tracking - Failure activity Check Session Status activity Timer workflow activityTimer workflow activityTimer workflow activity - Waits for one second Turnstile workflow activity - Check Session ready 30 times Create Command Process activity Check Command Status and Get Process activity Map Processes Data activity and return process list Create Enrichment Data records activity Capability Execution Tracking - Complete activity Close Session activity Get IP from CI activityThe Get IP from CI workflow activity gathers the IP address from configuration items (CIs) to use in the workflow. Collect Carbon Black Configurations activityThe Collect Carbon Black Configurations workflow activity gathers configuration information to use in the workflow. Get Sensor ID activityThe Get Sensor ID workflow activity gathers sensor identifiers to use in the workflow.Execution Tracking - Begin (Observables) activityThe Execution Tracking - Begin (Observables) workflow activity starts the auditing process for a Security Operations Integration workflow that operates on observables. Create Session activityThe Create Session workflow activity establishes a Carbon Black session to use in the workflow.Check Session Status activityDetermines the status of a Carbon Black session within the workflow. Create Command Process activityThe Create Command Process workflow activity creates a Carbon Black command process to use in the workflow.Check Command Status and Get Process activityChecks the Carbon Black command status and retrieves processes to use in the workflow. Map Processes Data activityThe Map Processes Data workflow activity maps Carbon Black process data within the workflow. Create Enrichment Data records activityThe Create enrichment data records workflow activity creates or updates enrichment records to use in the workflow.Capability Execution Tracking - Complete activityThe Capability Execution Tracking - Complete workflow activity updates the audit record when the workflow is complete.Close Session activityCloses a Carbon Black session within the workflow.