Getting Endpoint Information (SOAR Action in ServiceNow)

Use this SOAR action to get asset information for the device that is associated with selected alerts, or for a device on the Security Incidents related list.

• This action can be run from an alert or a device.
• After the Get Endpoint Info action is performed successfully, asset information is displayed the Carbon Black Asset Snapshot table at the bottom of the Alert record page.
• Associated alerts are displayed in the Endpoint Info record related list.
• Associated asset (endpoint) information is displayed in the Alerts Table related list.
• If the action is performed multiple times, the data is stored multiple times in Carbon Black Asset Snapshots.