Security Operations Integration- Get Running Processes capability

The Get Running Processes capability retrieves a list of running processes on a configuration item (CI) from a host or endpoint. This capability is used for incident enrichment during investigations.

The Get Running Processes capability has two implementation flows:

• Security Operations Carbon Black Integration - Get Running Processes Flow
• Security Operations System Command Integration- Get Running Processes flow

注:

If no implementations are available, capability actions are not displayed in product menus.

Actions specific to this flow are described here. For more information on other actions, see Common Security Operations integration flows and orchestration activities.

• Security Operations Carbon Black Integration - Get Running Processes Flow
  The Security Operations Carbon Black Integration - Get Running Processes is the implementation for the Carbon Black integration launched by the Security Operations Integration - Get Running Process flow.
• Security Operations System Command Integration- Get Running Processes flow
  The Security Operations System Command Integration - Get Running Processes flow retrieves the running processes of a configuration item when added or updated to a Windows or Unix-based security incident in the Analysis state.
• Security Operations - Get Running Processes Flow
  The Security Operations - Get Running Processes flow is a high-level flow independent of integrations. It retrieves a list of running processes on a configuration item (CI) from a host. Use it to fulfill an integration, such as Carbon Black, or for a Windows-based security incident.

関連概念

• Security Operations Integration- Block Request capability
• Security Operations Integration- Email Search and Delete capability
• Security Operations Integration- Enrich CI capability
• Security Operations Integration- Enrich Observable capability
• Security Operations Integration- Get Network Statistics capability
• Security Operations Integration- Isolate Host capability
• Security Operations Integration- Publish to Watchlist capability
• Security Operations Integration- Sightings Search capability
• Security Operations Integration - Threat Lookup capability

関連タスク

• Change the order of flow execution