Remove Observables from EDL
task australia Updated Sep 10, 2026 1 min read remove-observables-edl.md
Remove observables from an External Dynamic List (EDL) to stop blocking or monitoring specific observables. Use this when observables are no longer relevant or incorrectly categorized.
Before you begin
Role required: sn_sec_tisc.analyst
Procedure
-
Navigate to Workspaces > Threat Intelligence Security Center.
-
Select the Threat Analyst Workbench.
-
Navigate to Observables > All Observables.
-
Open any observable record.
-
Select Remove from EDL button to remove the entries from the list.
The Remove from EDL modal opens. Complete the removal process. You can add observables back to the list later. For more information, see Add Observables to EDLs.
Parent Topic:Palo Alto Networks integration
Related topics
Keywords remove observablesEDLExternal Dynamic ListThreat Analyst Workbenchremove from EDL
46 lines · 2.2 KB
---
title: Remove Observables from EDL
description: Remove observables from an External Dynamic List \(EDL\) to stop blocking or monitoring specific observables. Use this when observables are no longer relevant or incorrectly categorized.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/remove-observables-edl.html
release: australia
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [remove observables, EDL, External Dynamic List, Threat Analyst Workbench, remove from EDL]
breadcrumb: [Palo Alto Networks integration, Firewall integration, TISC Security Tools integrations, TISC Integrations, Integrate, Threat Intelligence Security Center, Security Operations]
---
# Remove Observables from EDL
Remove observables from an External Dynamic List \(EDL\) to stop blocking or monitoring specific observables. Use this when observables are no longer relevant or incorrectly categorized.
## Before you begin
Role required: sn\_sec\_tisc.analyst
## Procedure
1. Navigate to **Workspaces** > **Threat Intelligence Security Center**.
2. Select the **Threat Analyst Workbench**.
3. Navigate to **Observables** > **All Observables**.
4. Open any observable record.
5. Select **Remove from EDL** button to remove the entries from the list.
The **Remove from EDL** modal opens. Complete the removal process. You can add observables back to the list later. For more information, see [Add Observables to EDLs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/add-obsesrvables-edl.md).
**Parent Topic:**[Palo Alto Networks integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/palo-alto-networks-integration.md)
**Related topics**
[Approve EDL entries for Palo Alto Networks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-approve-edl-entries.md)
| title | Remove Observables from EDL |
| description | Remove observables from an External Dynamic List \(EDL\) to stop blocking or monitoring specific observables. Use this when observables are no longer relevant or incorrectly categorized. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/remove-observables-edl.html |
| release | australia |
| product | Threat Intelligence Security Center |
| classification | threat-intelligence-security-center |
| topic_type | task |
| last_updated | 2026-09-10 |
| reading_time_minutes | 1 |
| keywords | remove observablesEDLExternal Dynamic ListThreat Analyst Workbenchremove from EDL |
| breadcrumb | Palo Alto Networks integrationFirewall integrationTISC Security Tools integrationsTISC IntegrationsIntegrateThreat Intelligence Security CenterSecurity Operations |