Add Observables to EDLs

  • Release version: Australia
  • Updated March 12, 2026
  • 1 minute to read

    • Add observables such as IP addresses, domains, and hashes to External Dynamic Lists (EDLs) to automatically update threat intelligence feeds in your security infrastructure.

    Before you begin

    Role required: sn_sec_tisc.analyst

    Procedure

    1. Navigate to Workspaces > Threat Intelligence Security Center.
    2. Select the Threat Analyst Workbench icon.
    3. Navigate to Observables > All Observables.
    4. Open any observable record.
    5. Select Add to EDL button to add the observables to the list.
      The Add to EDL modal screen appears. Proceed to add observables to the EDLs.
    6. Optional: Select Remove to remove the observables from the EDLs.
      For more information, see Remove Observables from EDL.