Security Incident Response - Get Running Services workflow

  • Freigeben Version: Australia
  • Aktualisiert 12. März 2026
  • 1 Minute Lesedauer

    • The Security Incident Response - Get Running Services workflow retrieves a list of running services from Windows-based, ServiceNow, configuration items (CIs). This workflow is used for incident enrichment during investigations.

    Vorbereitungen

    Role required: sn_si.analyst

    Warum und wann dieser Vorgang ausgeführt wird

    The Security Incident Response - Get Running Services workflow runs automatically when you add a new configuration item to a Windows security incident after the state changes to Analysis. The information this workflow obtains appears on the Show Enrichment Data tabs for the security incident.

    Hinweis:
    If the security incident remains in the Draft state, the Security Incident Response - Get Running Services workflow workflow does not run.
    Workflow activities include:
    Abbildung : 1. Get Running Services
    Security Incident Response - Get Running Services workflow diagram

    Prozedur

    1. Open a security incident.
    2. Update the State to Analysis, if necessary.
    3. Add a Windows-based configuration item (server, laptop, or similar).
    4. Click Update.
      Security Incident Response provides running services information in the Related Links > Security Incident Enrichmentstab. For more information, see Security Operations enrichment data mapping.