---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Run a sightings search on observables in a case

# Run a sightings search on observables in a case {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

You can search for observables using the Sighting Search feature to determine how
often they occur. Each occurrence is considered a sighting. You can limit the
search to the number of sightings within a selected number of days or within a date
range.

## Before you begin

The Threat Intelligence plugin must be activated to use Security Case Management.

Role required: sn_ti.case_user_write

## Procedure

1. Navigate to AllThreat IntelligenceCase ManagementAll Cases.
2. Open the case that contains observables for which you want to run a sightings search.
3. Click the Case Artifacts related link.
4. Click the Observables tab.
5. Select one or more observables for which you want to search for sightings.  
6. From the Actions on selected items drop-down list, select Run sightings search.  
   The Run Sighting Search dialog box appears.
7. Either enter the number of days or hours you want to search for sightings of the selected observables, or select a date range.
8. Click Search.
{#run-local-sighted-srch__steps_acn_qzp_cz}
**Related tasks**   

* [Create a case from IoCs or observables](https://servicenow-prod.fluidtopics.net/Wg2HQ5CJenZRoqL4hcuatQ "In Threat Intelligence, you can create a case from artifacts (IoCs or observables). After the IoCs or observables have been used to create a case, you can use Security Case Management to analyze the data.")
* [Add IoCs and observables to an existing case](https://servicenow-prod.fluidtopics.net/k7LgOZHvnOw7b_J1FA4pwg "You can add IoCs and observables to existing cases. After the security incidents have been added to cases, you can use Security Case Management to analyze the data.")
* [Create an observable from a case](https://servicenow-prod.fluidtopics.net/f2cLAaQu5BMnyeTaoZBuvw "New observables can be created from cases in Security Case Management.")

*[\>]: and then