Take Orbital Forensic Snapshot

This workflow initiates a Cisco Orbital forensic snapshot for the endpoint identified by the provided observable. Supported observables: ip, mac_address, amp_computer_guid

GitHub

---

Change Log

See the Important Notes page for more information about updating workflows

---

Requirements

• The following system atomics are used by this workflow:
  • Orbital - Query Endpoint
  • Threat Response - Generate Access Token
• The following atomic actions must be imported before you can import this workflow:
  • None
• The targets and account keys listed at the bottom of the page
• Cisco Secure Endpoint with Orbital

---

Workflow Steps

1. Make sure the observable is supported and set the corresponding local variable
2. Generate an access token for Orbital
3. Execute a forensic snapshot

---

Configuration

• If you want to change the name of this workflow in the pivot menu, change its display name

---

Targets

Target Group: Default TargetGroup

---

Account Keys

---