Send Observables to TISC

---
title: Send Observables to TISC
description: Using this feature the security analyst can push the observables data from SIR to TISC. Using the TISC Context, you can check if the observables are present in TISC, if not security analyst can push the data whenever required.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/security-incident-response/tisc-context-in-sir-workspace.html
release: brazil
product: Security Incident Response
classification: security-incident-response
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 4
breadcrumb: [Send data from SIR Workspace to TISC, TISC integration within SIR Workspace, Working with Security Incident Records, Use, Security Incident Response Workspace, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Send Observables to TISC

Using this feature the security analyst can push the observables data from SIR to TISC. Using the TISC Context, you can check if the observables are present in TISC, if not security analyst can push the data whenever required.

## Before you begin

Role required: sn\_si.analyst, sn\_sec\_tisc.sir\_enrichment\_data\_writer

Enable the `sn_ti.automatic_push_observable_to_tisc` system property to automatically push observables associated with security incidents to TISC when no matching observable exists.

## Procedure

1.  Navigate to **Workspaces** > **Security Incident Response Workspace** > **Security Incidents** > **All**.

2.  Open a security incident.

3.  Select the **Related Records** tab to perform the TISC integration capability action.

    **Note:**

    -   You can also navigate to the **Investigation** tab, and navigate to the **Entry Points Lists** section displayed on the left side of the page and select **Associated Observables** to perform the push operation.
    -   On the **Investigation** tab, select **View Related Info** to view all the associated threat lookup, sighting search, and enrichment data for the selected observable. For more information, see [Explore Investigation Canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/explore-investigation-in-sir-workspace.md).
4.  For example, select **Threat Intel** > **Associated Observables** to perform the push operation and manually push the data into TISC.

5.  Select one or more observable record to perform **Send Observable to TISC** operation to push the data.

    \[Omitted image "sir-send-to-tisc-observables-page.png"\] Alt text: SIR Workspace - Send Observable to TISC

6.  Select **Send Observable to TISC**.

7.  On the Send Observables to TISC screen, provide the following:

    |Field|Description|
    |-----|-----------|
    |Confidence|The confidence score for the observables.|
    |TLP|The TLP \(Traffic Light Protocol\) value for the observables.|
    |Notes|Notes for the observables.|
    |TISC Tags|Tags for the observables to send. You can add custom tags that are added to the observables.|

8.  Select **Send**.

    **Note:**

    -   If the selected observable isn’t present in TISC, first the observable is created as an observable source. Then, the observable record is automatically associated with the newly created observable.
    -   Once the observable push operation is performed, then an information message is displayed.

        ```
        Following observables are successfully pushed to TISC. 
        It may take sometime to reflect in TISC context tab. 
        0.0.0.0
        ```

    -   If an observable already exists TISC, then an error message is displayed.

        ```
        The following observables already exist in TISC:
        0.0.0.0
        ```

    \[Omitted image "sir-send-to-tisc-results.png"\] Alt text: Send to TISC Push observable operation

9.  Select **TISC Context**.

    **Note:** :

    -   You can view the observable that is pushed to TISC from the SIR application.

        \[Omitted image "tisc-context-associate-observables.png"\] Alt text: View observables associated info.

    -   **In a manual push operation**: The observable data can only be pushed if they are linked to the security incidents. Once the observable is pushed from SIR then that data can be identified using sources which will have reference to security incident linked to the observable.
    -   **In an automatic push operation**: The observable or enrichment data will be pushed automatically when it is associated to security incident.

        **Note:** The **Send Observable to TISC** option disappears once the automated flow is enabled.

    -   **TISC Context** lists every TISC observable linked to the security incident, whether or not a matching threat intelligence observable exists in Security Incident Response Workspace.
    -   Using TISC context, the SIR analysts can see all the TISC Enrichment data including Threat Lookups, Sighting Search, and Observable Enrichment Results.
    -   **View Associated Info** will show all the associated observable enrichment data of the selected observables.
10. To create and link a matching threat intelligence observable in Security Incident Response Workspace, select one or more observables in the **Observables** list and select **Create and Link to SI**.

    A confirmation window opens before the action runs. This action both creates the threat intelligence observable and links it to the security incident. To link an existing record without creating one, use **Link** instead. For more details, see [Link and unlink TISC records to a security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/tisc-link-unlink-records-sir.md).

    **Note:**

    If you select lowercase and uppercase variants of the same observable value, one observable is created and linked.

    An information message confirms that observable creation and linking has started. Separate messages then report which observables were created, which were newly linked, which were already linked, which were of the unknown type, and which couldn't be processed. A work note is posted to the activity stream when at least one observable is created or newly linked.

11. View the results.


**Parent Topic:**[Send data from SIR Workspace to TISC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/send-sir-to-tisc.md)

**Related topics**  


[System properties to send data]()

[Add security incident to TISC case]()

[Add observables to TISC Case]()

[Send Threat Lookup to TISC]()

[Send Sighting Search to TISC]()

[Send Observable Enrichment to TISC]()