{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":45027,"path":"security-management/security-incident-response/t_CreateScanRequestforIoCChanges.md","title":"Create Lookup Request for IoC Changes workflow","bundle":null,"doc_type":null,"release":"australia","body":"\n# Create Lookup Request for IoC Changes workflow\n\nThe **Security Incident Response - Create Lookup Request for IoC Changes** flow is triggered by the **Lookup Security Incident Observables** scheduled job to automatically look up IoCs that are added or changed. Malware scans are triggered only when new data is entered and only the new data is scanned.\n\n## Before you begin\n\nRole required: sn\\_si.basic\n\n## About this task\n\nIf the IoC is empty, the workflow does not run. Historical scans are retained and viewable in the **Security Scan Requests** tab and worknotes of the security incident. The existing security incidents are automatically updated.\n\n**Important:**\n\nThe **Security Incident Response - Create Lookup Request for IoC Changes** workflow is migrated to the Flow Designer. The flow gets triggered only when the sn\\_ti\\_scanner has at least one record.\n\nThe Flow Designer actions include:\n\n-   Audit Log Enrichment\n-   [Create IoC Lookup Request activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/r_CreateMalwareScanRequest.md)\n\n\\[Omitted image \"ScanRequest4IoChangesWorkflow.png\"\\] Alt text: Security Incident Response - Create Lookup Request for IoC Changes workflow diagram\n\n-   **[Create IoC Lookup Request activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/r_CreateMalwareScanRequest.md)**  \nThe **Create IoC Lookup Request** activity can be used with any workflow to create a malware lookup request for added or modified IoC fields.\n\n**Parent Topic:**[Security Incident Response Orchestration workflows and activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/sec-inc-resp-orchestration-workflows.md)\n\n**Related topics**  \n\n\n[Security Incident Response- Get Network Statistics flow]()\n\n[Security Incident Response - Get Running Services workflow]()\n\n[Run procdump flow]()\n\n[Security Incident - Evaluate response task outcome workflow]()\n\n"}}