---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/pt-BR/security-management

 Release :

    - australia

ft:locale :

    - pt-BR

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Submit an IoC Lookup request from a security incident

# Submit an IoC Lookup request from a security incident {#ariaid-title1}

* Versão de lançamento: Australia
* 
* Atualizado 12 de mar. de 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 min. de leitura

An IoC lookup automatically runs whenever observables are added to a security
incident. Also, if your security incident has attachments, they can be easily found with
the press of a button.

## Antes de Iniciar

For automatic IoC lookups, the Threat Intelligence plugin must be activated.

Role required: sn_si.basic  
Nota:  
By default, the Lookup Type for File is inactive.

## Procedimento

1. [Create a new security
   incident](https://servicenow-prod.fluidtopics.net/viqFkza~~jgXC19yThSchQ "In addition to automatic methods for creating security incidents, you can create them manually, as needed.") or open an existing one if you intend to attach new files to it.
2. Click the paperclip icon in the form header and attach one or more files.
3. When you have completed your entries on the form, right-click the form header and click Save.  
   After the record has been saved, a Lookup attachments button appears.
4. Click Lookup attachments.  
   Nota:  
   The work notes under Incident Details report the progress of the lookup process.
5. You can click the lookup number at the end of the message to view the lookup record.  
   You can click the Lookup reference link to view detailed results. ![Lookup request message]()