--- sourceDocument: Australia Security Management sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Threat Intelligence Orchestration workflows and activities # Threat Intelligence Orchestration workflows and activities {#ariaid-title1} * Release version: Australia * * Updated March 12, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read The base system includes workflows and workflow activities you can use to automate actions on your instance. ## Threat Intelligence - Run IoC Lookup workflow {#ariaid-title2} The Threat Intelligence - Run IoC Lookup workflow checks whether there is an unexpired observable and if so, the lookup is set to Complete and updated with the data from the observable. ### Before you begin Role required: sn_si.basic Note: This workflow replaces Threat Intelligence Orchestration business rules (Populate with existing IoC tables, Queue the lookup, and Update observable) with activities. If a lookup is inserted or updated and meets the conditions, the Lookup business rule triggers this workflow. ### About this task The Threat Intelligence - Run IoC Lookupworkflow checks whether there is an unexpired observable and if so, the lookup is set to Complete and updated with the data from the observable. Any indicators associated with the observable are reactivated. If the observable is expired, the workflow runs the lookups and increments the Sighting count in the existing, expired observable. If no correlating observable exists, a new observable with indicator is created. Workflow process activities include: * [Populate lookup with observable activity](https://servicenow-prod.fluidtopics.net/wXHirx65mUlkB5ZFwJvaRg#r_PopulateScanObservable "If an unexpired observable is found, the Threat Intelligence Orchestration - Populate lookup with observable workflow activity supplies data from an existing observable to a lookup. This activity can accelerate the investigation and remediation process.") * [Perform IoC Lookup activity](https://servicenow-prod.fluidtopics.net/wXHirx65mUlkB5ZFwJvaRg#r_PerfomScan "The Threat Intelligence Orchestration - Perform IoC Lookup workflow activity performs a given lookup. This activity can accelerate the investigation and remediation process.") * Wait for lookup (core activity) * [Update observable with lookup result activity](https://servicenow-prod.fluidtopics.net/wXHirx65mUlkB5ZFwJvaRg#r_UpdateObservableScanResult "The Threat Intelligence Orchestration - Update observable with lookup result workflow activity updates the observable record. If one does not exist, it creates a new observable. This activity is useful for logging information.") Figure 1. Threat Intelligence - Run IoC Lookup workflow ### Populate lookup with observable activity {#ariaid-title3} If an unexpired observable is found, the Threat Intelligence Orchestration - Populate lookup with observable workflow activity supplies data from an existing observable to a lookup. This activity can accelerate the investigation and remediation process. When triggered by a workflow Populate lookup with observable attempts to find an existing observable for a lookup that matches the value and type of the lookup provided to the activity as input. If the observable exists and is not expired, this activity: * Updates the lookup with the information found in the observable * Reactivates an indicator if it is inactive, increments the Encountered count, and updates the Last seen date * Sets State to Complete. {#r_PopulateScanObservable__ul_xpq_p32_3w} #### Input variables Input variables determine the initial behavior of the activity. {#r_PopulateScanObservable__table_pgm_tfy_jr__entry__2} | Input variable | Description | |-|-| | scanID\[string\] | lookup identifier | [ ] {#r_PopulateScanObservable__table_pgm_tfy_jr} #### Output variables The output variables contain data that can be used in subsequent activities. {#r_PopulateScanObservable__table_bnj_jfy_jr__entry__2} | Output variables | Description | |-|-| | True | Found valid observable and updated lookup. | | False | Did not find valid observable. Observable is either missing or expired. | [ ] {#r_PopulateScanObservable__table_bnj_jfy_jr} ### Perform IoC Lookup activity {#ariaid-title4} The Threat Intelligence Orchestration - Perform IoC Lookup workflow activity performs a given lookup. This activity can accelerate the investigation and remediation process. When triggered by a workflow, Perform IoC Lookup takes a scanID, looks up the lookup record, and adds the lookup to the queue by creating a lookup queue entry. #### Input variables Input variables determine the initial behavior of the activity. {#r_PerfomScan__table_pgm_tfy_jr__entry__2} | Variable | Description | |-|-| | scanID\[string\] | lookup identifier | [Table 1. Input variables] {#r_PerfomScan__table_pgm_tfy_jr} #### Output variables The output variables contain data that can be used in subsequent activities. {#r_PerfomScan__table_bnj_jfy_jr__entry__2} | Variable | Description | |-|-| | True | Triggered the lookup. | | False | Did not trigger the lookup. | [Table 2. Output variables] {#r_PerfomScan__table_bnj_jfy_jr} ### Update observable with lookup result activity {#ariaid-title5} The Threat Intelligence Orchestration - Update observable with lookup result workflow activity updates the observable record. If one does not exist, it creates a new observable. This activity is useful for logging information. When triggered by a workflow Update observable with lookup result updates an existing observable to include the new Sighting count, adds a note, and, if inactive, reactivates any indicators. The Encountered count and Last seen date in the indicator are also updated. If no correlating observable exists, the workflow creates a new observable with indicator as follows: * Runs the IoC lookups * Creates a new observable * Creates an indicator for the observable * Adds a Sighting count to the observable * Adds an Encountered count and Last seen date to the indicator * Adds a message indicating from which lookup it was created {#r_UpdateObservableScanResult__ul_hl1_5t2_3w}. #### Input variables Input variables determine the initial behavior of the activity. {#r_UpdateObservableScanResult__table_pgm_tfy_jr__entry__2} | Variable | Description | |-|-| | scanID\[string\] | Lookup identifier. | [Table 3. Input variables] {#r_UpdateObservableScanResult__table_pgm_tfy_jr} #### Output variables The output variables contain data that can be used in subsequent activities. {#r_UpdateObservableScanResult__table_bnj_jfy_jr__entry__2} | Variable | Description | |-|-| | True | Update or creation of observable is successful. | | False | Update or creation of observable failed. | [Table 4. Output variables] {#r_UpdateObservableScanResult__table_bnj_jfy_jr} ### Run Default IoC Lookup Sources activity {#ariaid-title6} When triggered by a workflow, Threat Intelligence - Run Default IoC Lookup Sources takes in a lookup request ID and creates multiple lookups depending on the entered data values. For each data type, the include_in_bulk scan column of the supported lookup type table of each lookup source is evaluated. If true, a lookup is added to the lookup request. #### Input variables Input variables determine the initial behavior of the activity. {#r_RunDefaultMalwareScanners__table_pgm_tfy_jr__entry__2} | Variable | Description | |-|-| | scan_request_id | Lookup request system identifier | [Table 5. Input variables] {#r_RunDefaultMalwareScanners__table_pgm_tfy_jr} #### Output variables The output variables contain data that can be used in subsequent activities. {#r_RunDefaultMalwareScanners__table_bnj_jfy_jr__entry__2} | Variable | Description | |-|-| | Number of scans created | Integer | [Table 6. Output variables] {#r_RunDefaultMalwareScanners__table_bnj_jfy_jr}