---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# RISKIQ and WHOISIQ integration

# RISKIQ and WHOISIQ integration {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

With the integration of RISKIQ
and WHOISIQ APIs with the ServiceNow AI Platform®
Security Operations product, security
analysts are provided with additional enrichment data and insight into the validity of websites.

The RISKIQ SSL Certificates API
performs lookups on SSL Certificates, which include details on the issuing certificate
authority, organizations who request certificates, the entity certificates are issued to, and
the domain. SSL certificate lookups are performed automatically when security incidents are
created.

The RISKIQ
WHOISIQ API performs lookups on other
observable types, such as domain, email, nameserver, organization, address, and phone number.
URL and domain observables are enriched automatically when security incidents are created.

The integration requires the Security Incident Response and Threat Intelligence products.
1. [Supported observables for RISKIQ and RISKIQ WHOISIQ](https://servicenow-prod.fluidtopics.net/er0CYm1rBPOEf_Aobh6OQA)  
   The RISKIQ API supports automatic SSL certificate lookups on IP address, file hash, Certificate Serial Number, domain, and URL observables. URL and domain observables are enriched automatically with the WHOISIQ API. For observable enrichment on other types of observables with the WHOISIQ API, create observables and run lookups manually from the Observables table.
2. [Install and configure RISKIQ and WHOISIQ](https://servicenow-prod.fluidtopics.net/9und49zaUE3Cjrvo5xPDpg)  
   Before you run the integration on your instance, complete the installation and configuration steps so the RISKIQ and WHOISIQ applications properly integrate with ServiceNow AI Platform Security Operations.
3. [Verify expected results for RISKIQ SSL certificate lookups](https://servicenow-prod.fluidtopics.net/PJXse4KYtbQ9GMAWqE8~_w)  
   When a security incident generates observables for URLs, domains, IP addresses, certificate file hashes (SHA-1 fingerprint), and certificate serial numbers, security incident analysts use the SSL certificate lookup results to verify sites have certificates that have been issued by a trusted public Certificate Authority (CA).
4. [Verify expected results for WHOISIQ URL lookups](https://servicenow-prod.fluidtopics.net/w6j~TJryNb2X_D5Qq~ZSzA)  
   When a security incident generates observables for URLs or domains, the WHOISIQ API performs the observable enrichment automatically upon security incident creation. The lookup results are displayed on the Observable Enrichment Results and SSL Certificates tabs on the security incident record.
5. [Create an observable for manual WHOISIQ lookups](https://servicenow-prod.fluidtopics.net/_A6JIvevOpIn53o6I6dTsw)  
   Security incident analysts use information from observable enrichment with the WHOISIQ API to learn more about the email addresses, names, and phone numbers of organizations.
6. [Verify expected results for manual WHOISIQ lookups](https://servicenow-prod.fluidtopics.net/FLQ4hCRH~1pSWtbXUEFUYw)  
   Run a manual lookup on an observable when it does not automatically generate a security incident. For observable enrichment lookups using the WHOISIQ API for email addresses, organization names, phone numbers, or mailing addresses, initiate the lookup manually from the Observables table.