Send observables to EDR

task australia Updated Sep 10, 2026 1 min read tisc-ms-defend-edr.md

Raw file servicenow.com

Send observables to the EDR security tool.

Before you begin

Role required: sn_sec_tisc.analyst

Procedure

Navigate to Workspaces > Threat Intelligence Security Center.
Click the Threat Intel Library icon.
Go to Observables > All Observables.
Open any observable record.
Select Send to EDR.

The Send to EDR Implementations modal screen is displayed.
Select the required implementation from the list.

For example, select the implementation associated to Microsoft Defender EDR.
Click Next.
Select the run time details such as the Title and Description of the implementation.
Click Submit.

The selected action is executed and an information message is displayed that Observable Send to EDR execution has started and the results of this execution will be available under the Activity Stream after the execution is complete.

Note: Once the execution is initiated or completed, a work notes is posted on the activity stream of the form view and you can verify the execution progress accordingly.

Parent Topic:Microsoft Defender for EDR integration

Keywords send to EDRMicrosoft Defender EDRobservable implementationthreat intel library

55 lines · 2.0 KB Wrap lines

---
title: Send observables to EDR
description: Send observables to the EDR security tool.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/tisc-ms-defend-edr.html
release: australia
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [send to EDR, Microsoft Defender EDR, observable implementation, threat intel library]
breadcrumb: [Microsoft Defender for EDR integration, TISC Security Tools integrations, TISC Integrations, Integrate, Threat Intelligence Security Center, Security Operations]
---

# Send observables to EDR

Send observables to the EDR security tool.

## Before you begin

Role required: sn\_sec\_tisc.analyst

## Procedure

1. Navigate to **Workspaces** &gt; **Threat Intelligence Security Center**.

2. Click the **Threat Intel Library** icon.

3. Go to **Observables** &gt; **All Observables**.

4. Open any observable record.

5. Select **Send to EDR**.

The Send to EDR **Implementations** modal screen is displayed.

6. Select the required implementation from the list.

For example, select the implementation associated to Microsoft Defender EDR.

7. Click **Next**.

8. Select the run time details such as the **Title** and **Description** of the implementation.

9. Click **Submit**.

The selected action is executed and an information message is displayed that Observable Send to EDR execution has started and the results of this execution will be available under the Activity Stream after the execution is complete.

**Note:** Once the execution is initiated or completed, a work notes is posted on the activity stream of the form view and you can verify the execution progress accordingly.

**Parent Topic:**[Microsoft Defender for EDR integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-ms-defender-integration.md)