Security Operations Integration - Publish to Watchlist Flow

---
title: Security Operations Integration - Publish to Watchlist Flow
description: The Security Operations Integrations - Publish to Watchlist flow is a high-level flow independent of integrations. It adds observables to third-party watchlist that support the capability. Use it to fulfill an integration.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/secops-integration-publish-watchlist-workflow.html
release: brazil
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Security Operations Integration- Publish to Watchlist capability, Integration capabilities, Security Operations Integration Reference, Security Operations common functionality, Security Operations]
---

# Security Operations Integration - Publish to Watchlist Flow

The **Security Operations Integrations - Publish to Watchlist** flow is a high-level flow independent of integrations. It adds observables to third-party watchlist that support the capability. Use it to fulfill an integration.

## Before you begin

Role required: sn\_si.analyst

## About this task

This flow is visible and runs only when an integration is available. It is triggered from the **Observables** or **Associated Indicators** tab on a security incident.

\[Omitted image "publish-to-watchlist.png"\] Alt text: Security Operations Integration - Publish to Watchlist capability flow

Activities specific to this flow are described here. For more information on other activities, see [Common Security Operations integration flows and orchestration activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/common-wf-activities.md).

**Parent Topic:**[Security Operations Integration- Publish to Watchlist capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/pubish-to-watchlist-capability.md)