---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Security Operations Integration - Enrich Observable flow

# Security Operations Integration - Enrich Observable flow {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The Security Operations Integration - Enrich Observable sub flow allows you to enrich observables with additional information from a variety of sources using implementation flow designer.

## Before you begin

Role required: sn_si.analyst

## About this task

This flow can be triggered from either Security Incident Response or Threat Intelligence in two ways.

* by selecting one or more observables from the Observables list and selecting Run observable enrichment from the Actions on selected rows choice list.
* by opening an observable record and clicking the Run observable enrichment related link.

{#secops-integration-enrich-observ-wf__ul_oqw_mvx_v1b}

Either method then allows you to specify which implementations to be used to enrich the selected observables. The associated implementation flows are executed to perform the enrichment.  
Figure 1. Enrich Observable

Actions specific to this flow are described here. For more information on other actions, see [Common Security Operations integration flows and orchestration activities](https://servicenow-prod.fluidtopics.net/VeHrUh9NzKmFfa~3wxWcqQ "Many of the flows associated with third-party integrations include the same activities. For example, activities for beginning and completing processing.").  
The flow process actions include:

* [Legacy: Capability Execution Tracking- No Impls action](https://servicenow-prod.fluidtopics.net/8gyoOnrdwEvCZgYXRRg4eg "The Capability Execution Tracking - No Impls flow action creates an error record when no integration capability implementation is found.")
* [Get Supported Security Capabilities action](https://servicenow-prod.fluidtopics.net/iiKXFyzD8b7PaGdn84u7ag "The Get Supported Capabilities flow action retrieves the name and number of integrations that are active and support the requested capability.")[Legacy: Capability Execution Tracking- No Impls action](https://servicenow-prod.fluidtopics.net/8gyoOnrdwEvCZgYXRRg4eg "The Capability Execution Tracking - No Impls flow action creates an error record when no integration capability implementation is found.")
{#secops-integration-enrich-observ-wf__ul_p22_scy_hcc}