Get IP from CI activity The Get IP from CI workflow activity gathers the IP address from configuration items (CIs) to use in the workflow. The Get IP from CI activity can be used with any workflow to gather configuration item (CI) IP addresses to use in the workflow. Results Possible results for this activity are: Table 1. Results Result Description Success Found IP addresses. Failure No IP addresses found. More error information is available in the activity output error. Input variables Input variables determine the initial behavior of the activity. Variable Description ci_sys_id Configuration item identifier. Output variables The output variables contain data that can be used in subsequent activities. Table 2. Output variables Variable Description ip_addr IP addresses. Execution Tracking - Begin activityThe Execution Tracking - Begin workflow activity starts the auditing process for a Security Operations Integration workflow that operates on observables. Tanium: Build Get Processes Request activityThe Tanium: Get Result Data from Response workflow activity builds a request for processes to use in the workflow.Tanium: Execute Request activityThis workflow activity executes an HTTP request. The inputs define the endpoint and the expected request body. The request body itself is the encrypted SOAP envelope. Tanium: Get Question ID from Response activityThis workflow activity processes the response body to obtain the Question ID.Tanium: Build Check if Done Request activityThis workflow activity builds a request of the Tanium server to check if data collection for the question is complete. It returns the encrypted request and other components necessary to execute the request.Tanium: Determine if done from Response activityThis workflow activity determines if a request has completed based on the response body.Tanium: Build Get Result Data Request activityThis workflow builds a request to collect all the data returned from Tanium in answer to a question. It takes a Question ID as input and provides the output to execute the request, including an encrypted SOAP envelope payload.
Get IP from CI activity The Get IP from CI workflow activity gathers the IP address from configuration items (CIs) to use in the workflow. The Get IP from CI activity can be used with any workflow to gather configuration item (CI) IP addresses to use in the workflow. Results Possible results for this activity are: Table 1. Results Result Description Success Found IP addresses. Failure No IP addresses found. More error information is available in the activity output error. Input variables Input variables determine the initial behavior of the activity. Variable Description ci_sys_id Configuration item identifier. Output variables The output variables contain data that can be used in subsequent activities. Table 2. Output variables Variable Description ip_addr IP addresses. Execution Tracking - Begin activityThe Execution Tracking - Begin workflow activity starts the auditing process for a Security Operations Integration workflow that operates on observables. Tanium: Build Get Processes Request activityThe Tanium: Get Result Data from Response workflow activity builds a request for processes to use in the workflow.Tanium: Execute Request activityThis workflow activity executes an HTTP request. The inputs define the endpoint and the expected request body. The request body itself is the encrypted SOAP envelope. Tanium: Get Question ID from Response activityThis workflow activity processes the response body to obtain the Question ID.Tanium: Build Check if Done Request activityThis workflow activity builds a request of the Tanium server to check if data collection for the question is complete. It returns the encrypted request and other components necessary to execute the request.Tanium: Determine if done from Response activityThis workflow activity determines if a request has completed based on the response body.Tanium: Build Get Result Data Request activityThis workflow builds a request to collect all the data returned from Tanium in answer to a question. It takes a Question ID as input and provides the output to execute the request, including an encrypted SOAP envelope payload.
