Add multiple security incident observables

---
title: Add multiple security incident observables
description: To save time, you can add multiple security incident observables to the security incident observables list.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/add-multiple-si-observables.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Manage observables, Managing security incidents and inbound requests, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Add multiple security incident observables

To save time, you can add multiple security incident observables to the security incident observables list.

## Before you begin

Role required: sn\_ti\_write

**Note:** When adding multiple security incident observables, duplicates are ignored during processing.

## Procedure

1.  Navigate to **Security Incident**.

2.  Choose an incident.

3.  Select the **Investigation** tab.

4.  Select **Associated Observables**.

5.  Select Multiple New from the more options.

6.  Enter or paste multiple observables.

    Entries can be of any Observable Type. Accepted formats are: comma, new line, tab, or pipe separators.

    \[Omitted image "AddMultipleObservables.png"\] Alt text: Add multiple observables comma delimited list example

    **Note:** When you add an observable to the security incident, the system checks for any other configuration items or users associated with it. The **Related Configuration Items** and **Related Users** related list tabs are updated accordingly.

    Note: Observable values not auto-detected are assigned to type Unknown.

7.  Select **Submit**.