Security Operations Integration- Get Running Processes capability
The Get Running Processes capability retrieves a list of running processes on a configuration item (CI) from a host or endpoint. This capability is used for incident enrichment during investigations.
The Get Running Processes capability has two implementation flows:
- Security Operations Carbon Black Integration - Get Running Processes Flow
- Security Operations System Command Integration- Get Running Processes flow
Note: If no implementations are available, capability actions are not displayed in product menus.
Actions specific to this flow are described here. For more information on other actions, see Common Security Operations integration flows and orchestration activities.
- Security Operations Carbon Black Integration - Get Running Processes Flow
The Security Operations Carbon Black Integration - Get Running Processes is the implementation for the Carbon Black integration launched by the Security Operations Integration - Get Running Process flow. - Security Operations System Command Integration- Get Running Processes flow
The Security Operations System Command Integration - Get Running Processes flow retrieves the running processes of a configuration item when added or updated to a Windows or Unix-based security incident in the Analysis state. - Security Operations - Get Running Processes Flow
The Security Operations - Get Running Processes flow is a high-level flow independent of integrations. It retrieves a list of running processes on a configuration item (CI) from a host. Use it to fulfill an integration, such as Carbon Black, or for a Windows-based security incident.
Parent Topic:Integration capabilities
Related topics
Security Operations Integration- Block Request capability
Security Operations Integration- Email Search and Delete capability
Security Operations Integration- Enrich CI capability
Security Operations Integration- Enrich Observable capability
Security Operations Integration- Get Network Statistics capability
Security Operations Integration- Isolate Host capability
Security Operations Integration- Publish to Watchlist capability
Security Operations Integration- Sightings Search capability