Run Enrichment Actions from Observable

---
title: Run Enrichment Actions from Observable
description: Use this section to understand how enrichments actions are performed on observables and other objects.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/run-enrichment-actions-from-observable.html
release: australia
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [run enrichment actions, observable enrichment, enrichment operations]
breadcrumb: [Observables, TISC Library Repository, Threat Intel Library, Use, Threat Intelligence Security Center, Security Operations]
---

# Run Enrichment Actions from Observable

Use this section to understand how enrichments actions are performed on observables and other objects.

## Before you begin

Role required: sn\_sec\_tisc.admin

## Procedure

1.  Navigate to **Workspaces** > **Threat Intelligence Security Center**.

2.  Click **Threat Analyst Workbench** icon.

3.  Go to **Observables** > **All Observables**.

4.  Click any Enrichment actions from the split button.

5.  Select the available implementation\(s\).

6.  Click **Submit**.

    For example, Run Threat Lookup. The selected enrichment action will be executed and an information message is displayed that Observable enrichment execution has started on the selected observable\(s\). Results will be available in the detail page of respective observable\(s\) once the execution is complete.

    **Note:** Once the execution initiated or completed, a work notes is posted on the activity stream of the form view.


**Parent Topic:**[Observables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/observables.md)