Verify expected results for manual WHOISIQ lookups

  • Release version: Yokohama
  • Updated January 30, 2025
  • 1 minute to read

    • Run a manual lookup on an observable when it does not automatically generate a security incident. For observable enrichment lookups using the WHOISIQ API for email addresses, organization names, phone numbers, or mailing addresses, initiate the lookup manually from the Observables table.

    Before you begin

    Role required: sn_si.analyst

    About this task

    Create an observable for a manual lookup using the WHOISIQ API. For more information on how to create and edit an observable, see Create an observable for manual WHOISIQ lookups.

    Procedure

    1. Navigate to All > IoC Repository > Observables and locate the observable in the list you are working with.
    2. Click your observable in the Value column to open the record.
      Click the observable you want to lookup.
    3. Click the Run Observable Enrichment related link to run the lookup.
      Run Observable Enrichment in Related Links.
    4. In the Run Observable Enrichment window, move RiskIQ Whois to the Selected list.
      Move RsikIQ Whois to Selected.
    5. Click Submit.
      Lookup results are displayed on the Observable Enrichment Results tab on the observable record.
      Observable Enrichment Results tab and lookup results.
    If no results are returned for the observable, a message is displayed in the Summary column. If you do not see results, verify the observable is supported by the API.