{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":45359,"path":"security-management/t_UpdateSecIncScanResults.md","title":"Update security incident with lookup results workflow","bundle":null,"doc_type":null,"release":"australia","body":"\n# Update security incident with lookup results workflow\n\nThe **Update security incident with lookup results** workflow updates existing security incidents with lookup results.\n\n## Before you begin\n\nRole required: sn\\_si.basic\n\n## About this task\n\nThis workflow is triggered by a business rule on the lookup table which monitors when the **Result** field changes to Failed.\n\nWorkflow process activities include:\n\n-   [Roll up lookup info to security incident activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/r_RollUpScanInfoSI.md)\n-   [Update Task Worknotes activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/update-task-worknotes-activity.md)\n\n\\[Omitted image \"UpdateSILookupResultsWorkflow.png\"\\] Alt text: Update security incident with lookup results workflow diagram\n\n**Parent Topic:**[Common Security Operations integration flows and orchestration activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/common-wf-activities.md)\n\n"}}