The Get Network Statistics capability retrieves a list of active network connections from a host or endpoint. It can be used for incident enrichment during investigations. This capability is triggered automatically when a configuration item is added to a security incident.

The Get Network Statistics capability has a flow, Security Operations Integrations - Get Network Statistics flow that accepts one or more CIs and tasks. The flow iterates over each implementation and each CI and re-invokes the implementation flow.