---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Determine Observables activity

# Determine Observables
activity {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The Determine Observables workflow activity determines which
observable to include in the workflow
The Determine Observables activity can be used with any workflow to
determine which observables to include in the workflow.

## Results

Possible results for this activity are:
{#determine-observables-activity__table_lg3_dm5_vy__entry__2}

| Result | Description |
|-|-|
| Success | Found observables |
| Failure | No observables found. More error information is available in the activity output error. |
[Table 1. Results]

{#determine-observables-activity__table_lg3_dm5_vy}

## Input variables {#determine-observables-activity__section_f1b_y2m_3z}

Input variables determine the initial behavior of the activity.
{#determine-observables-activity__table_pgm_tfy_jr__entry__2}

| Variable | Description |
|-|-|
| task_sys_id | Task identifier (maps security incident to observables). |
| observables | IP addresses, hash, URLs, domain names. |
[ ]

{#determine-observables-activity__table_pgm_tfy_jr}

## Output variables

The output variables contain data that can be used in subsequent activities.
{#determine-observables-activity__table_bnj_jfy_jr__entry__2}

| Variable | Description |
|-|-|
| observables | Filtered observables |
[Table 2. Output variables]

{#determine-observables-activity__table_bnj_jfy_jr}