Before
An analyst would receive the command request, open a real-time response session, submit the command, and repeatedly check whether it had completed. They would then perform the required session cleanup and assemble the execution details manually.
How it works
- Receive the command request and initialize a real-time response session.
- Execute the administrator command on a single host and evaluate its status, waiting five seconds and polling again when processing is incomplete.
- When the command reaches the required state, delete the session file and build the execution results.
Workflow details
- Command intake: An email-triggered request starts the workflow, and the requested real-time response command is captured for execution.
- Session and execution: The workflow initializes a real-time response session and submits the administrator command to a single host.
- Status validation: The command status is checked and evaluated. If processing is incomplete, the workflow waits five seconds before checking again; if the command reaches the required state, it proceeds to cleanup.
- Cleanup and results: The workflow deletes the real-time response session file when the relevant condition is met and builds a results record from the command operations before returning to wait for another command.
What changed
Command execution now starts from an email-triggered request and proceeds through session creation, host execution, status validation, timed polling, cleanup, and result building without requiring an analyst to coordinate each step manually. Human involvement is reduced to submitting the command request and reviewing the resulting execution information.
Work removed
Receiving the command details, initializing the session, submitting the administrator command, checking command status repeatedly, waiting between incomplete checks, deleting the session file, and assembling the execution results.
Expected outcome
Commands are monitored through completion with automatic five-second polling when needed, followed by session cleanup and results preparation; no measured performance improvement is provided.
