---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/pt-BR/security-management

 Release :

    - australia

ft:locale :

    - pt-BR

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Using MISP to investigate and analyze threats

# Using MISP to investigate and analyze threats {#ariaid-title1}

* Versão de lançamento: Australia
* 
* Atualizado 12 de mar. de 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 min. de leitura

You can use the MISP data across the ServiceNow AI Platform
Threat Intelligence module and the ServiceNow AI Platform
SIR module to investigate and analyze threats to your
organization.
* **[Sighting searches in MISP](https://servicenow-prod.fluidtopics.net/s2prMy7HBiU0rkRPyIrfxA#sightings-searches-in-misp)**   
  You can perform sighting searches on observables in the MISP instance to determine how often certain types of attacks, such as phishing attacks or communications with a malicious IP or URL, occur in your network. Each occurrence is considered a sighting.
* **[Observable enrichment in MISP](https://servicenow-prod.fluidtopics.net/o63yE9KDeFD_tOkdBUT5NA#observable-enrichment-in-misp)**   
  By enriching observables with additional information from various MISP sources during incident response investigations, you can contain identified threats.
* **[Managing events in MISP](https://servicenow-prod.fluidtopics.net/aIWAW_2FvrP~VCcCyUjupA#events-in-misp)**   
  You can create events in MISP automatically or manually from the ServiceNow AI Platform. You can also edit the event data in MISP from the ServiceNow AI Platform.
* **[Roll up MITRE-ATT\&CK information using MISP enrichment results](https://servicenow-prod.fluidtopics.net/Eih~N1PEjxgpC8bnc24T3w)**   
  Roll up the MISP enrichment results manually if you haven't enabled the automatic rollup of MISP information.

**Conceitos relacionados**   

* [MISP administration](https://servicenow-prod.fluidtopics.net/2yAEgNNjPEXL3c6qrcup0A "You can set up MISP integration in the ServiceNow AI Platform to perform a sighting search, observable enrichment, and to create and update events in MISP.")