{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44013,"path":"security-management/enrich-observable-capability.md","title":"Security Operations Integration- Enrich Observable capability","bundle":null,"doc_type":null,"release":"australia","body":"\n# Security Operations Integration- Enrich Observable capability\n\nThe Enrich Observable capability allows you to enrich observables with additional information from a variety of sources using implementation flows. This capability is used during incident response investigations to contain an identified threat.\n\nThe Enrich Observable capability has a flow, [Security Operations Integration - Enrich Observable flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/secops-integration-enrich-observ-wf.md). When the capability flow runs, it executes additional flows for the activated implementations. You can specify an implementation to use to perform enrichment on the selected observables, or you can perform the enrichment using all implementations that match the supported observable types.\n\n**Note:** If no implementations are available, capability actions are not displayed in product menus.\n\n-   **[Security Operations Integration - Enrich Observable flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/secops-integration-enrich-observ-wf.md)**  \nThe Security Operations Integration - Enrich Observable sub flow allows you to enrich observables with additional information from a variety of sources using implementation flow designer.\n\n**Parent Topic:**[Integration capabilities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/integration-capabilities.md)\n\n**Related topics**  \n\n\n[Security Operations Integration- Block Request capability]()\n\n[Security Operations Integration- Email Search and Delete capability]()\n\n[Security Operations Integration- Enrich CI capability]()\n\n[Security Operations Integration- Get Network Statistics capability]()\n\n[Security Operations Integration- Get Running Processes capability]()\n\n[Security Operations Integration- Isolate Host capability]()\n\n[Security Operations Integration- Publish to Watchlist capability]()\n\n[Security Operations Integration- Sightings Search capability]()\n\n[Security Operations Integration - Threat Lookup capability]()\n\n[Change the order of flow execution]()\n\n"}}