---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/pt-BR/security-management

 Release :

    - australia

ft:locale :

    - pt-BR

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Reduce threat analysis time using automation

# Reduce threat analysis time using automation {#ariaid-title1}

* Versão de lançamento: Australia
* 
* Atualizado 12 de mar. de 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 min. de leitura

Security incident triage and analysis are necessary steps for weeding out false positives during the threat response process, and for determining how you can best identify, contain, and eliminate security threats.

Triage can include manual steps to ferret out the causes and impacts of threats. By automating many of the steps, you can greatly reduce the time and effort needed to analyze and contain threats. After you have set up automation in
your ServiceNow®
Security Operations software, you can perform different types of automation. For example, you can automatically enrich observables data when an observable is added to a security incident. Or you can view running processes or
obtain network statistics when a CI in your CMDB is added to a security incident. These processes, illustrated below, can save you valuable time during threat analysis.

In this scenario, a malicious file has been detected by the Security Information and Event
Management (SIEM) tool your company uses for threat detection. The Security Operations integration with the
SIEM causes a security incident to be automatically created based on the type of threat
encountered. If the malicious file already contained observables or if the security analyst
added new, unexpired observables after the fact, a workflow that enriches the observable
records is automatically triggered. The workflow causes the observables to be scanned, and the
hash and IP address of the party who sent the file are added to the security incident.

During triage, the analyst may observe that configuration items (CI) contained in the
company's CMDB may have been affected by the intrusion. The analyst therefore adds the CIs to
the security incident. When the security incident is saved, two other workflows are executed
and network statistics and running processes related to the CIs are instantly added to the
security incident.

## Prepare for Threat Intelligence
automation {#ariaid-title2}

Before Threat Intelligence
automation can be used in the threat response process, you must complete a few preliminary
setup steps. When setup is complete, the workflows automatically run with little or no user
assistance.

### Antes de Iniciar

Role required: admin

### Procedimento

1. [Download
   the Security Incident Response and Threat Intelligence
   applications from the ServiceNow Store](https://servicenow-prod.fluidtopics.net/YnaeXqAVT7_bXGtafw1WTQ "Starting with Madrid, all Security Operations applications and supported integrations are available for download from the ServiceNow Store. This allows you to obtain new and updated features more rapidly. Before you can use any Security Operations applications, you must verify that you have entitlement to them (that is, you have valid licenses to use them), download them from the ServiceNow Store, and activate them.").
2. [Install one or more MID Servers](https://www.servicenow.com/docs/access?context=mid-server-landing&version=australia&pubname=australia-servicenow-platform&ft:locale=en-US), and [configure service
   credentials for each of them](https://www.servicenow.com/docs/access?context=mid-server-install-prereqs&version=australia&pubname=australia-servicenow-platform&section=t_ConfigMIDSvrSvcCredentials&ft:locale=en-US).
3. When the MID Servers are up and running, ensure the integration capability implementation that you are using (VirusTotal, for example) is active for the Threat Lookup capability.  
   The Threat Lookup capability performs lookups to determine whether one or more observables are associated with known security threats.
   1. Navigate to Security OperationsIntegrationsIntegration Capabilities.
   2. Click Threat Lookup and scroll down to the Integration Capability Implementation related list.  
   3. Locate the implementation you want to use and verify that the Active column shows true.
   4. If the implementation is not active, click the implementation Name, click to select the Active check box, and click Update.
   {#scenario-prepare-threal-auto__substeps_nwd_15w_shb}

## Automatically enrich observables data {#ariaid-title3}

After you have prepared for Threat Intelligence automation, and added new or
unexpired Indicators of Compromise (IoC) to a security incident, the Threat Intelligence -- Run IoC
lookup workflow executes automatically.

The workflow activities extract information from the IoCs, including the hash of the suspicious
file and the originating IP address with no user intervention.
Figura 1. Automatically enrich observables data  
Nota:  
You can also run the lookup manually by selecting one or more observables already attached to the security incident and selecting Run Threat Lookup from the Actions on selected rows choice list.  
The workflow performs the following activities:

1. The Populate lookup with observable activity attempts to find an existing observable for a lookup that matches the value and type of the lookup provided to the activity as input.
   1. If an observable that matches the inputs is found, the Perform IoC Lookup activity causes a lookup to be performed on the record's ScanID.
   2. If an observable is found and is not expired, the lookup is not performed and the lookup results in the security incident are updated with information from the observable. For more information, see [Populate lookup with observable activity](https://servicenow-prod.fluidtopics.net/L7TFHnw~UpIdWPMQ_HLV9Q#r_PopulateScanObservable "If an unexpired observable is found, the Threat Intelligence Orchestration - Populate lookup with observable workflow activity supplies data from an existing observable to a lookup. This activity can accelerate the investigation and remediation process.").
   {#scenario-auto-enrich-observ__ol_dxk_gqw_5hb}
2. When an IoC lookup is performed, the following four activities first retrieve information from the enrichment data map. [Enrichment Data
   Mapping](https://servicenow-prod.fluidtopics.net/ZKykweTPaOvRjAk6_ZMN6g "Enrichment Data Mapping transforms data from XML, JSON, or Properties files to ServiceNow records. Security Operations workflows use enrichment data maps and provide output data to security incidents.") transforms data from XML, JSON, or properties files to ServiceNow records. Next, they verify whether a parent security incident exists. If so, an observable is created and enriched. If not, the existing observable is enriched. For more information, see [Update observable with lookup result activity](https://servicenow-prod.fluidtopics.net/L7TFHnw~UpIdWPMQ_HLV9Q#r_UpdateObservableScanResult "The Threat Intelligence Orchestration - Update observable with lookup result workflow activity updates the observable record. If one does not exist, it creates a new observable. This activity is useful for logging information.").
   * Get enrichment data Mapping
   * Check parent incident exists
   * Create Enrichment Data records
   * Create Enrichment Data for Record
   {#scenario-auto-enrich-observ__ul_znk_tqw_5hb}
3. After the data enrichment is complete, the Update observable with lookup results activity updates the observables in the security incident and writes the results to the Threat Lookup Results related list.

{#scenario-auto-enrich-observ__ol_xjp_mpw_5hb} Figura 2. Threat Lookup Results

## Automatically obtain network statistics and running processes {#ariaid-title4}

If you add a configuration item (CI) with a fully qualified Windows domain name
(FQDM) that is found in the CMDB to a security incident, additional workflows run to provide
network statistics and running processes.

### Antes de Iniciar

Role required: admin

### Procedimento

1. Using the [Discovery](https://www.servicenow.com/docs/access?context=r-discovery&version=australia&pubname=australia-it-operations-management&ft:locale=en-US) module, populate the CMDB with Windows domain names.  
   Nota:  
   If you do not subscribe to the ServiceNow [Discovery](https://www.servicenow.com/docs/access?context=r-discovery&version=australia&pubname=australia-it-operations-management&ft:locale=en-US) module, you must populate your CMDB manually, or use a third-party Discovery-type product.
2. Add a CI to the security incident.  
   The following two workflows are executed in parallel.
   * [Security Operations - Get Running Processes Flow](https://servicenow-prod.fluidtopics.net/GpUjxpMEiEfJ6N4W6Mo2Gg "The Security Operations - Get Running Processes flow is a high-level flow independent of integrations. It retrieves a list of running processes on a configuration item (CI) from a host. Use it to fulfill an integration, such as Carbon Black, or for a Windows-based security incident."): This workflow retrieves a list of running processes on a configuration item (CI) from a host. Use it to fulfill an integration, such as Carbon Black, or for a Windows-based security incident.  
     When the workflow completes, running processes are shown in the Running Processes related list in the security incident.Figura 3. Running Processes
   * [Security Operations Integrations - Get Network Statistics flow](https://servicenow-prod.fluidtopics.net/CW0iOoQayRdIWm1NvDmX7g "The Security Operations Integrations - Get Network Statistics flow retrieves a list of active network connections from a host or endpoint."): This workflow retrieves a list of active network connections from a host or endpoint. When  
     When the workflow completes, network statistics are shown in the Network Statistics related list in the security incident.Figura 4. Network Statistics
   {#scenario-auto-network-stats__ul_pgw_gcx_shb}