Security Operations Integration- Get Running Processes capability

The Get Running Processes capability retrieves a list of running processes on a configuration item (CI) from a host or endpoint. This capability is used for incident enrichment during investigations.

The Get Running Processes capability has two implementation workflows:

• Security Operations Carbon Black Integration - Get Running Processes Flow
• Security Operations System Command Integration- Get Running Processes flow

Note:

If no implementations are available, capability actions are not displayed in product menus.

Activities specific to this workflow are described here. For more information on other activities, see Common Security Operations integration flows and orchestration Flow Actions.

• Security Operations - Get Running Processes Flow
  The Security Operations - Get Running Processes flow is a high-level flow independent of integrations. It retrieves a list of running processes on a configuration item (CI) from a host. Use it to fulfill an integration, such as Carbon Black, or for a Windows-based security incident.
• Security Operations Carbon Black Integration - Get Running Processes Flow
  The Security Operations Carbon Black Integration - Get Running Processes is the implementation for the Carbon Black integration launched by the Security Operations Integration - Get Running Process flow.
• Security Operations System Command Integration- Get Running Processes flow
  The Security Operations System Command Integration - Get Running Processes flow retrieves the running processes of a configuration item when added or updated to a Windows or Unix-based security incident in the Analysisstate.

Related concepts

• Security Operations Integration- Block Request capability
• Security Operations Integration- Email Search and Delete capability
• Security Operations Integration- Enrich CI capability
• Security Operations Integration- Enrich Observable capability
• Security Operations Integration- Get Network Statistics capability
• Security Operations Integration- Isolate Host capability
• Security Operations Integration- Publish to Watchlist capability
• Security Operations Integration- Sightings Search capability
• Security Operations Integration - Threat Lookup capability

Related tasks

• Change the order of workflow execution