Run Threat Lookup

task brazil Updated Sep 10, 2026 1 min read tisc-run-threat-lookup.md

Raw file servicenow.com

Select one or more implementations as applicable to run threat lookup on observables.

Before you begin

Role required: sn_sec_tisc.admin

Procedure

Navigate to Workspaces > Threat Intelligence Security Center.
Click Threat Analyst Workbench icon.
Go to Observables > All Observables.
Open any observable record.
Click Run Threat Lookup.

The Run Threat Lookup Select Implementations modal screen is displayed.

Note: The Run Threat Lookup performs the threat intelligence lookups to determine whether the observables are associated with any known threats.
Select the required implementation(s) from the list.

[Omitted image "tisc-observable-run-threat-lookup-modal.png"] Alt text: Run Threat lookup
Click Submit.

The selected enrichment action will be executed and an information message is displayed that Threat lookup execution has started.

Note:
- Once the execution initiated or completed, a work notes is posted on the activity stream of the form view.
- The enrichment results pushed from SIR workspace can be found in the Enrichment Results tab of that corresponding Observables details page in TISC Workspace.
- The enrichment results pushed from SIR workspace can be identified using Source field of the enrichment result table.

Parent Topic:Run Enrichment operations in TISC

Keywords run Threat Lookupscan observablesmalware detection

56 lines · 2.3 KB Wrap lines

---
title: Run Threat Lookup
description: Select one or more implementations as applicable to run threat lookup on observables.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/threat-intelligence-security-center/tisc-run-threat-lookup.html
release: brazil
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [run Threat Lookup, scan observables, malware detection]
breadcrumb: [Run Enrichment operations in TISC, Observables, TISC Library Repository, Threat Intel Library, Use, Threat Intelligence Security Center, Security Operations]
---

# Run Threat Lookup

Select one or more implementations as applicable to run threat lookup on observables.

## Before you begin

Role required: sn\_sec\_tisc.admin

## Procedure

1. Navigate to **Workspaces** &gt; **Threat Intelligence Security Center**.

2. Click **Threat Analyst Workbench** icon.

3. Go to **Observables** &gt; **All Observables**.

4. Open any observable record.

5. Click **Run Threat Lookup**.

The Run Threat Lookup **Select Implementations** modal screen is displayed.

**Note:** The Run Threat Lookup performs the threat intelligence lookups to determine whether the observables are associated with any known threats.

6. Select the required implementation\(s\) from the list.

\[Omitted image "tisc-observable-run-threat-lookup-modal.png"\] Alt text: Run Threat lookup

7. Click **Submit**.

The selected enrichment action will be executed and an information message is displayed that Threat lookup execution has started.

**Note:**

- Once the execution initiated or completed, a work notes is posted on the activity stream of the form view.
- The enrichment results pushed from SIR workspace can be found in the **Enrichment Results** tab of that corresponding Observables details page in TISC Workspace.
- The enrichment results pushed from SIR workspace can be identified using **Source** field of the enrichment result table.

**Parent Topic:**[Run Enrichment operations in TISC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intelligence-security-center/tisc-unified-experience-capabilities-and-modal-screens.md)