Security Incident Response- Get Network Statistics flow
On this page
Security Incident Response- Get Network Statistics flow
The Security Incident Response > Get Network Statistics flow retrieves the network statistics for an affected Windows-based resource when added to a security incident in the Analysis state.
Before you begin
Role required: sn_si.analyst
About this task
For new security incidents that contain configuration items, the flow runs automatically when the state changes to Analysis.
Existing security incidents are automatically updated when you are in the Analysis state and you add a new configuration item.
[Omitted image “get-network-statistics-flow.png”] Alt text: Get Network Statistics flow
The flow process actions include:
-
Determine Shell Script by OS
-
If statement is executed by Powershell
-
Legacy: Capability Execution Tracking- Failure Flow Action - Returns enrichment ID.
-
Legacy: Capability Execution Tracking - Complete Flow Action
Procedure
-
Open a security incident.
-
Update the State to Analysis, if necessary.
-
Add a configuration item (computer, server, or similar).
-
Click Update.
Security Incident Response Orchestration provides network statistics information in the Related Links > Security Incident Enrichments tab. For more information see, Security Operations enrichment data mapping.
Actions specific to this flow are described here. For more information on other actions, see Common Security Operations integration flows and orchestration activities.
Parent Topic:Security Incident Response Orchestration workflows and activities
Parent Topic:Security Operations Integration- Get Network Statistics capability
Related topics
{Create Lookup Request for IoC Changes workflow}[]
{Security Incident Response - Get Running Services workflow}[]
{Run procdump flow}[]
{Security Incident - Evaluate response task outcome workflow}[]
Keep exploring.
Find another answer, or bring this documentation into your own tools.