Run Observable Enrichment

---
title: Run Observable Enrichment
description: Select one or more implementations as applicable to run threat lookup on observables.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/threat-intelligence-security-center/tisc-run-observable-enrichment.html
release: brazil
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [run observable enrichment, threat lookup on observables]
breadcrumb: [Run Enrichment operations in TISC, Observables, TISC Library Repository, Threat Intel Library, Use, Threat Intelligence Security Center, Security Operations]
---

# Run Observable Enrichment

Select one or more implementations as applicable to run threat lookup on observables.

## Before you begin

Role required: sn\_sec\_tisc.admin

## Procedure

1.  Navigate to **Workspaces** > **Threat Intelligence Security Center**.

2.  Click **Threat Analyst Workbench** icon.

3.  Go to **Observables** > **All Observables**.

4.  Open any observable record.

5.  Click **Run Observable Enrichment**.

    The Run Observable Enrichment **Select Implementations** modal screen is displayed.

    **Note:** Only supported records will be submitted against the selected implementation\(s\)

6.  Select the required implementation\(s\) \(for example, WHOIS\) from the list.

    \[Omitted image "tisc-run-observable-enrichment.png"\] Alt text: Run Observable Enrichment

7.  Click **Submit**.

    The selected enrichment action will be executed and an information message is displayed that Threat lookup execution has started.

    **Note:**

    -   Once the execution initiated or completed, a work notes is posted on the activity stream of the form view.
    -   The enrichment results pushed from SIR workspace can be found in the **Enrichment Results** tab of that corresponding Observables details page in TISC Workspace.
    -   The enrichment results pushed from SIR workspace can be identified using **Source** field of the enrichment result table.

**Parent Topic:**[Run Enrichment operations in TISC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intelligence-security-center/tisc-unified-experience-capabilities-and-modal-screens.md)