Security Operations Integration - Get Network Statistics capability

The Get Network Statistics capability retrieves a list of active network connections from a host or endpoint. It can be used for incident enrichment during investigations. This capability is triggered automatically when a configuration item is added to a security incident.

The Get Network Statistics capability has a workflow, Security Operations Integrations - Get Network Statistics workflow that accepts one or more CIs and tasks. The workflow iterates over each implementation and each CI and re-invokes the implementation workflow.

Note:

If no implementations are available, capability actions are not displayed in product menus.

• Security Operations Integrations - Get Network Statistics workflow
  The Security Operations Integrations - Get Network Statistics workflow retrieves a list of active network connections from a host or endpoint.
• Security Incident Response- Get Network Statistics Flow
  The Security Incident Response > Get Network Statistics flow retrieves the network statistics for an affected Windows-based resource when added to a security incident in the Analysis state.

Related concepts

• Security Operations Integration- Block Request capability
• Security Operations Integration- Email Search and Delete capability
• Security Operations Integration- Enrich CI capability
• Security Operations Integration - Enrich Observable capability
• Security Operations Integration- Get Running Processes capability
• Security Operations Integration- Isolate Host capability
• Security Operations Integration - Publish to Watchlist capability
• Security Operations Integration - Sightings Search capability
• Security Operations Integration - Threat Lookup capability

Related tasks

• Change the order of workflow execution