---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Observable Enrichment

# Observable Enrichment {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The Enrich Observable WhoIs workflow performs enrichment on selected observables. If the observables are of a type recognized by the WhoisXML API Integration, the observables are enriched.  
Note:  
The Threat Intelligence Security Center supports Observable Enrichment only for the WHOIS Integration.
* **[Run Have I Been Pwned enrichment integration](https://servicenow-prod.fluidtopics.net/2XvUvqcpnmWSyrsY6kPWng)**   
  Run the Have I Been Pwned (HIBP) enrichment on an email address or domain name observable to determine whether it has been involved in a known data breach.
* **[Whois integration](https://servicenow-prod.fluidtopics.net/qCD3idclU0N7rQPGLyahKw)**   
  Submit Whois lookups on domain names and URLs to gather threat intelligence and assess potential security risks. Use this integration to obtain registration details, ownership information, and other contextual data for suspicious domains.
* **[Shodan integration](https://servicenow-prod.fluidtopics.net/GsNaKLYmLNFs0IoybLJ8YQ)**   
  Configure Shodan integration to enable automated discovery and analysis of internet-connected devices in your network infrastructure.