Execution Tracking - Begin Flow Action

  • 릴리스 버전: Australia
  • 업데이트 날짜 2026년 03월 12일
  • 소요 시간: 3분

    • The Execution Tracking - Begin flow action starts the auditing process for a Security Operations Integration flow that operates on observables.

    The Execution Tracking - Begin flow action can be used with any flow to begin recording the progress of the flow in an audit.

    Results

    Possible results for this flow action are:

    표 1. Results
    Result Description
    Success An audit record is created.

    Input variables

    Input variables determine the initial behavior of the flow action.

    Variable Description
    capabilityId System identifier of the Integration Capability being executed.
    isImpl Flag that specifies whether auditing is done for an Integration Capability flow or an Integration Capability implementation flow. Possible values are:
    • false - denotes auditing on an abstract Integration Capability flow such as Sightings Search. (default.)
    • true - denotes auditing on an Integration Capability implementation flow. For example, Splunk or Elasticsearch.
    taskId System identifier for any task associated with the flow.
    observableList One or more observable SysIDs to perform the desired action.

    Used as a flow input.
    flowContextId System identifier of the associated flow context record. Supplied by the system.
    flowName Name of the flow. Supplied by the system.
    parentCapabilityExcutionId System identifier of the audit record that launched the implementation flow. Only required for Integration Capability implementation flows such as Splunk, Elasticsearch, and VirusTotal.

    Output variables

    The output variables contain data that can be used in subsequent actions.

    표 2. Output variables
    Variable Description
    capabilityExecutionId System identifier of the audit record.