Security Operations Integration- Get Network Statistics capability

The Get Network Statistics capability retrieves a list of active network connections from a host or endpoint. It can be used for incident enrichment during investigations. This capability is triggered automatically when a configuration item is added to a security incident.

Note:

If no implementations are available, capability actions are not displayed in product menus.

• Security Operations Integrations - Get Network Statistics workflow
  The Security Operations Integrations - Get Network Statistics workflow retrieves a list of active network connections from a host or endpoint.
• Execution Tracking - Begin (CIs) Flow Action
  The Execution Tracking - Begin (CIs) flow action starts the auditing process for a Security Operations Integration flow that operates on configuration items (CIs).
• Security Incident Response- Get Network Statistics Flow
  The Security Incident Response > Get Network Statistics flow retrieves the network statistics for an affected Windows-based resource when added to a security incident in the Analysis state.

Related concepts

• Security Operations Integration- Block Request capability
• Security Operations Integration- Email Search and Delete capability
• Security Operations Integration- Enrich CI capability
• Security Operations Integration- Enrich Observable capability
• Security Operations Integration- Get Running Processes capability
• Security Operations Integration- Isolate Host capability
• Security Operations Integration- Publish to Watchlist capability
• Security Operations Integration- Sightings Search capability
• Security Operations Integration - Threat Lookup capability

Related tasks

• Change the order of workflow execution