---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Get Running Services - WMI Enrichment

# Get Running Services - WMI Enrichment {#ariaid-title1}

* Release version: Australia
* 
* Updated August 11, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The Security Incident Response - Get Running Services workflow
gathers running services on a configuration item added to a security incident.
The Get Running Services - WMI Enrichment activity is launched
automatically to retrieve running services information for a Windows host.

## Input variables

Input variables determine the initial behavior of the activity.
{#get-running-services-via-pwrshell-activity__table_pgm_tfy_jr__entry__2}

| Variable | Description |
|-|-|
| target \[string\] | The fully qualified domain name (FQDN) of the target system. |
[Table 1. Input variables]

{#get-running-services-via-pwrshell-activity__table_pgm_tfy_jr}

## Output variables

The output variables contain data that can be used in subsequent activities.
{#get-running-services-via-pwrshell-activity__table_bnj_jfy_jr__entry__2}

| Variable | Description |
|-|-|
| response \[string\] | A JSON string representing the current running services on the target system. JSON data includes: name :   The name of the service pid :   The process identifier of the running service service_type :   (Optional) The type of running service. start_name :   The system name for the service path :   The file path of the running service executable start_mode :   The start mode of the running service. display_name :   The name of the running service as it appears to the user |
[Table 2. Output variables]

{#get-running-services-via-pwrshell-activity__table_bnj_jfy_jr}

## Restrictions

The MID Server must support PowerShell.

SHA-256 hash requires PowerShell V4.