---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Using MISP to investigate and analyze threats

# Using MISP to investigate and analyze threats {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

You can use the MISP data across the ServiceNow AI Platform
Threat Intelligence module and the ServiceNow AI Platform
SIR module to investigate and analyze threats to your
organization.
* **[Sighting searches in MISP](https://servicenow-prod.fluidtopics.net/ic4svfMGG_3fhU9E0grntg#sightings-searches-in-misp)**   
  You can perform sighting searches on observables in the MISP instance to determine how often certain types of attacks, such as phishing attacks or communications with a malicious IP or URL, occur in your network. Each occurrence is considered a sighting.
* **[Observable enrichment in MISP](https://servicenow-prod.fluidtopics.net/KwCXfb5MVJWoSTuZfWlUyQ#observable-enrichment-in-misp)**   
  By enriching observables with additional information from various MISP sources during incident response investigations, you can contain identified threats.
* **[Managing events in MISP](https://servicenow-prod.fluidtopics.net/iy11nBZOnEaDTsg1sZlJxA#events-in-misp)**   
  You can create events in MISP automatically or manually from the ServiceNow AI Platform. You can also edit the event data in MISP from the ServiceNow AI Platform.
* **[Roll up MITRE-ATT\&CK information using MISP enrichment results](https://servicenow-prod.fluidtopics.net/CuR6unRPUTj_pK9RUHARtQ)**   
  Roll up the MISP enrichment results manually if you haven't enabled the automatic rollup of MISP information.

**Related concepts**   

* [MISP administration](https://servicenow-prod.fluidtopics.net/0UpY4h48sjnfggKqsWYCyw "You can set up MISP integration in the ServiceNow AI Platform to perform a sighting search, observable enrichment, and to create and update events in MISP.")