---
sourceDocument: Xanadu IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/it-operations-management

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Run an Agent Client Collector Security Incident Response command

# Run an Agent Client Collector
Security Incident Response command {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Run a specified command, on a machine referenced by an incident, to retrieve
information on the incident's CI. For example, if you run a ps command on
an incident, the command retrieves the status of active processes in the system. Commands
are listed according to the CI operating system associated with the security
incident.

## Before you begin

Role required: sn_si.admin or sn_si.basic

## Procedure

1. Navigate to AllSecurity IncidentIncidentsShow All Incidents.
2. Select an incident.
3. In the Related Links section, select Agent Client Collector Capabilities.  
   The Agent Client Collector Capabilities dialog box opens.
4. Select Run Command on Agent.
5. In the ACC Integration Capabilities field, select Run Command on agent.  
   The ACC Integration Command field appears.
6. Select the command you want to run.  
   The available commands are those configured on the ACC Integration Commands page, as described in [Create an Agent Client Collector Security Incident Response command](https://www.servicenow.com/docs/Hyy7hFMzUYOqZJ_tidR6fA "Define a command or command string to be executed on a machine referenced by a security incident. Commands are listed by operating system. For example, a ps command on a Windows OS retrieves the status of active Windows OS processes in the system.").
7. Select Submit.  
   The command runs on the security incident's CI, according to the OS specified in the command.

*[\>]: and then