Security Operations Tanium Integration - Get Running Processes workflow

The Security Operations Tanium Integration - Get Running Processes is the implementation for the Tanium integration launched by the Security Operations Integration - Get Running Process workflow.

Before you begin

Role required: sn_si.analyst

About this task

Workflow process activities include:

• Get IP from CI Flow Action
• Capability Execution Tracking- Failure Flow Action
• Tanium: Execute Request activity
• Tanium: Get Question ID from Response activity
• Execution Tracking - Begin (CIs) Flow Action
• Turnstile workflow activity - wait for data
• Tanium: Build Check if Done Request activity
• Tanium: Determine if done from Response activity
• Tanium: Build Get Result Data Request activity
• Tanium: Get Result Data from Response activity - return process list
• Create Enrichment Data records Flow Action
• Timer workflow activity - Waits for 1 second
• Create Enrichment Data records Flow Action
• Capability Execution Tracking - Complete Flow Action

Figure 1. Get Running Processes

Activities specific to this workflow are described here. For more information on other activities, see Common integration workflow activities.

• Get IP from CI Flow Action
  The Get IP from CI flow action gathers the IP address from configuration items (CIs) to use in the flow.
• Tanium: Get Result Data from Response activity
  The Tanium: Get Result Data from Response workflow activity processes the response body from the result data and outputs an array of JSON objects representing the results from Tanium.