Skip to content
Get Running Services workflow › Security Incident Response Orchestration workflows and activities › Understand Security Incident Response Orchestration workflows and workflow templates › Security Incident Response Orchestration › Security Incident Response › Enterprise security case management applications › Security Operations
Release: Australia · Updated: 2026-07-09 · Official documentation · View source

Get Running Services - WMI Enrichment

The Security Incident Response - Get Running Services workflow gathers running services on a configuration item added to a security incident.

The Get Running Services - WMI Enrichment activity is launched automatically to retrieve running services information for a Windows host.

Input variables

Input variables determine the initial behavior of the activity.

VariableDescription
target [string]The fully qualified domain name (FQDN) of the target system.

Output variables

The output variables contain data that can be used in subsequent activities.

VariableDescription
response \[string\]

A JSON string representing the current running services on the target system.

JSON data includes:

  • name

The name of the service

  • pid

The process identifier of the running service

  • service_type

(Optional) The type of running service.

  • start_name

The system name for the service

  • path

The file path of the running service executable

  • start_mode

The start mode of the running service.

  • display_name

The name of the running service as it appears to the user

Restrictions

The MID Server must support PowerShell.

SHA-256 hash requires PowerShell V4.

Parent Topic:Security Incident Response - Get Running Services workflow