Execution Tracking - Begin Flow Action
The Execution Tracking - Begin flow action starts the auditing process for a Security Operations Integration flow that operates on observables.
The Execution Tracking - Begin flow action can be used with any flow to begin recording the progress of the flow in an audit.
Results
Possible results for this flow action are:
| Result | Description |
|---|---|
| Success | An audit record is created. |
Input variables
Input variables determine the initial behavior of the flow action.
| Variable | Description |
|---|---|
| capabilityId | System identifier of the Integration Capability being executed. |
| isImpl | Flag that specifies whether auditing is done for an Integration Capability flow or an Integration Capability implementation flow. Possible values are: - false - denotes auditing on an abstract Integration Capability flow such as Sightings Search. \(default.\) - true - denotes auditing on an Integration Capability implementation flow. For example, Splunk or Elasticsearch. |
| taskId | System identifier for any task associated with the flow. |
| observableList | One or more observable SysIDs to perform the desired action. Used as a flow input. |
| flowContextId | System identifier of the associated flow context record. Supplied by the system. |
| flowName | Name of the flow. Supplied by the system. |
| parentCapabilityExcutionId | System identifier of the audit record that launched the implementation flow. Only required for Integration Capability implementation flows such as Splunk, Elasticsearch, and VirusTotal. |
Output variables
The output variables contain data that can be used in subsequent actions.
| Variable | Description |
|---|---|
| capabilityExecutionId | System identifier of the audit record. |
Parent Topic:Common Security Operations integration flows and orchestration activities