---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Run Observable Enrichment

# Run Observable Enrichment {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Select one or more implementations as applicable to run threat lookup on observables.

## Before you begin

Role required: sn_sec_tisc.admin

## Procedure

1. Navigate to WorkspacesThreat Intelligence Security Center.
2. Click Threat Analyst Workbench icon.
3. Go to ObservablesAll Observables.
4. Open any observable record.
5. Click Run Observable Enrichment.  
   The Run Observable Enrichment Select Implementations modal screen is displayed.  
   Note:  
   Only supported records will be submitted against the selected implementation(s)
6. Select the required implementation(s) (for example, WHOIS) from the list.  
7. Click Submit.  
   The selected enrichment action will be executed and an information message is displayed that Threat lookup execution has started.  
   Note:  
   * Once the execution initiated or completed, a work notes is posted on the activity stream of the form view.
   * The enrichment results pushed from SIR workspace can be found in the Enrichment Results tab of that corresponding Observables details page in TISC Workspace.
   * The enrichment results pushed from SIR workspace can be identified using Source field of the enrichment result table.
   {#tisc-run-observable-enrichment__ul_ykt_gjt_bcc}
{#tisc-run-observable-enrichment__steps_tmd_xdc_h1c}

*[\>]: and then