Create IoC Lookup Request activity

---
title: Create IoC Lookup Request activity
description: The Create IoC Lookup Request activity can be used with any workflow to create a malware lookup request for added or modified IoC fields.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/r\_CreateMalwareScanRequest.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: reference
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Create Lookup Request for IoC Changes workflow, Security Incident Response Orchestration workflows and activities, Understand Security Incident Response Orchestration workflows and workflow templates, Security Incident Response Orchestration, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Create IoC Lookup Request activity

The **Create IoC Lookup Request** activity can be used with any workflow to create a malware lookup request for added or modified IoC fields.

## Results

Possible results for this activity are:

|Result|Description|
|------|-----------|
|Success|Lookup request created.|
|Failure|Lookup request not created.|

|Variable|Description|
|--------|-----------|
|iocString|JSON formatted IoC information. IP, hash, url.|
|siId|Security incident system identifier|

## Output variables

The output variables contain data that can be used in subsequent activities.

|Variable|Description|
|--------|-----------|
|scnReqID|Lookup request identifier|

**Parent Topic:**[Create Lookup Request for IoC Changes workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/t_CreateScanRequestforIoCChanges.md)