Security Incident Response - Get Running Services workflow

  • Rversion finale: Australia
  • Mis à jour 12 mars 2026
  • 1 minute de lecture

    • The Security Incident Response - Get Running Services workflow retrieves a list of running services from Windows-based, ServiceNow, configuration items (CIs). This workflow is used for incident enrichment during investigations.

    Avant de commencer

    Role required: sn_si.analyst

    Pourquoi et quand exécuter cette tâche

    The Security Incident Response - Get Running Services workflow runs automatically when you add a new configuration item to a Windows security incident after the state changes to Analysis. The information this workflow obtains appears on the Show Enrichment Data tabs for the security incident.

    Remarque :
    If the security incident remains in the Draft state, the Security Incident Response - Get Running Services workflow workflow does not run.
    Workflow activities include:
    Figure 1. Get Running Services
    Security Incident Response - Get Running Services workflow diagram

    Procédure

    1. Open a security incident.
    2. Update the State to Analysis, if necessary.
    3. Add a Windows-based configuration item (server, laptop, or similar).
    4. Click Update.
      Security Incident Response provides running services information in the Related Links > Security Incident Enrichmentstab. For more information, see Security Operations enrichment data mapping.