---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Perform an action on a security incident

# Perform an action on a security incident {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Run an Agent Client Collector
Security Incident Response action to gather more information on a security incident.
Actions are referred to in the system as capabilities, and are
configured with the base system.

## Before you begin

Add the following JSON script to your Agent Client Collector allow list, to enable running the actions that come with the base system.


    {
      "args": [
        "--logger_min_status 1",
        "--json",
        "SELECT p.name, p.state, p.pid, p.parent as ppid, p.path, p.total_size, p.start_time, p.elapsed_time as run_time, p.cmdline, p.uid, p.username, u.type as owner_domain, u.uuid FROM processes as p LEFT JOIN users as u ON u.uid = p.uid",
        "select name, process_open_sockets.pid, parent as ppid, processes.path, process_open_sockets.state, total_size, process_open_sockets.protocol, local_address, local_port, remote_address, remote_port from process_open_sockets, processes where process_open_sockets.pid = processes.pid",
        "select * from services order by service_type",
        "select computer_name, hardware_serial, hostname, name as os, build, version, mac, address from system_info, os_version, interface_details, interface_addresses where address like '%:%' and interface_addresses.type='manual' or interface_addresses.type ='dhcp' limit 1",
        "select * from logged_in_users order by time"
      ],
      "exec": "osqueryi",
      "skip_arguments": false
    }

Role required: sn_si.admin or sn_si.basic

## About this task

For details on the capabilities that come with the base system, see [Agent Client Collector Security Incident Response capabilities](https://servicenow-prod.fluidtopics.net/Mwh_hewGt_Bm2pJcewtv_Q "Agent Client Collector Security Incident Response capabilities that come with the base system are listed on the ACC Capabilities page ( Agent Client Collector SIR Integration > ACC Integration Capabilities ). These capabilities run on security incidents to gather information about the incident.").

## Procedure

1. Navigate to AllSecurity IncidentIncidentsShow All Incidents.
2. Select an incident.
3. In the Related Links section, select Agent Client Collector Capabilities.  
   The Agent Client Collector Capabilities dialog box opens.
4. Select the capability you want to run.  
   {#acc-perform-sir-action__table_orq_wnm_h5b__entry__2}

   | Field | Description |
   |-|-|
   | ACC Integration Capabilities | The ACC Integration Capabilities. If the selected the capability you want is "Run OSQuery on Agent" then the data will be tabular formatted within the work notes. |
   | ACC Integration OSQuery | The ACC Integration OSQuery. For example, Selected system info columns. |
   | Transpose Data check box | Transpose the data. When selected,the information is displayed with vertical columns. When clear, the information is displayed horizontally. |
   [Table 1. Agent Client Collector Capabilities]

   {#acc-perform-sir-action__table_orq_wnm_h5b}
5. Select Submit.  
   The selected capability runs on the security incident's CI.
**Related tasks**   

* [Generate an Agent Client Collector allow list](https://servicenow-prod.fluidtopics.net/BmIfezjPKI9zhSTnHdhU9A "Specify the checks to be included in the list of checks that are enabled to run on the agent.")

*[\>]: and then