{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44930,"path":"security-management/security-incident-response/si-evaluate-response-task-outcome-workflow.md","title":"Security Incident - Evaluate response task outcome workflow","bundle":null,"doc_type":null,"release":"australia","body":"\n# Security Incident - Evaluate response task outcome workflow\n\nSecurity Incident - Evaluate Response task outcome workflow determines the task to use, invokes a chosen workflow and evaluation script based on the outcome evaluator record provided as input to the chosen workflow.\n\n## Before you begin\n\nRole required: sn\\_si.write\n\n## About this task\n\nThis workflow runs at the same time as the create task activity to be evaluated. The evaluation script queries the artifacts \\(such as sightings search records or running processes\\) of the configured capability. It uses context information from the response task \\(such as its parent security incident\\) to determine the appropriate outcome. The outcome is generally yes or no, but can be workflow activity dependent. When creating an outcome evaluator record, only capabilities that have a configured workflow, with the **Is task based capability** check box selected, and a task input variable set are available to select.\n\n## Procedure\n\n1.  Review the workflow process activities and the workflow diagram.\n\n    The workflow includes the following process activities:\n\n    -   Run script to determine response task\n    -   Should Run Workflow\n    -   Parallel Flow Launcher Launch Capability Workflow\n    -   Create Evaluation Event\n    \\[Omitted image \"EvaluateResponseOutcomeWorkflow.png\"\\] Alt text: Security Incident Evaluate Response Outcome workflow diagram\n\n\n**Parent Topic:**[Security Incident Response Orchestration workflows and activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/sec-inc-resp-orchestration-workflows.md)\n\n**Related topics**  \n\n\n[Create Lookup Request for IoC Changes workflow]()\n\n[Security Incident Response- Get Network Statistics flow]()\n\n[Security Incident Response - Get Running Services workflow]()\n\n[Run procdump flow]()\n\n"}}