{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":45724,"path":"security-management/threat-orch-wfs-and-activities.md","title":"Threat Intelligence Orchestration workflows and activities","bundle":null,"doc_type":null,"release":"australia","body":"\n# Threat Intelligence Orchestration workflows and activities\n\nThe base system includes workflows and workflow activities you can use to automate actions on your instance.\n\n**Parent Topic:**[Threat Intelligence Orchestration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/c_ThreatIntelligenceOrchestration.md)\n\n## Threat Intelligence - Run IoC Lookup workflow\n\nThe **Threat Intelligence - Run IoC Lookup** workflow checks whether there is an unexpired observable and if so, the lookup is set to **Complete** and updated with the data from the observable.\n\n### Before you begin\n\nRole required: sn\\_si.basic\n\n**Note:** This workflow replaces Threat Intelligence Orchestration business rules \\(**Populate with existing IoC tables**, **Queue the lookup**, and **Update observable**\\) with activities.\n\nIf a lookup is inserted or updated and meets the conditions, the Lookup business rule triggers this workflow.\n\n### About this task\n\nThe **Threat Intelligence - Run IoC Lookup**workflow checks whether there is an unexpired observable and if so, the lookup is set to **Complete** and updated with the data from the observable. Any indicators associated with the observable are reactivated.\n\nIf the observable is expired, the workflow runs the lookups and increments the **Sighting count** in the existing, expired observable.\n\nIf no correlating observable exists, a new observable with indicator is created.\n\nWorkflow process activities include:\n\n-   [Populate lookup with observable activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-orch-wfs-and-activities.md)\n-   [Perform IoC Lookup activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-orch-wfs-and-activities.md)\n-   Wait for lookup \\(core activity\\)\n-   [Update observable with lookup result activity](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-orch-wfs-and-activities.md)\n\n\\[Omitted image \"RunScanWorkflow.png\"\\] Alt text: Threat Intelligence - Run IoC Lookup workflow diagram\n\n### Populate lookup with observable activity\n\nIf an unexpired observable is found, the **Threat Intelligence Orchestration - Populate lookup with observable** workflow activity supplies data from an existing observable to a lookup. This activity can accelerate the investigation and remediation process.\n\nWhen triggered by a workflow **Populate lookup with observable** attempts to find an existing observable for a lookup that matches the **value** and **type** of the lookup provided to the activity as input.\n\nIf the observable exists and is not expired, this activity:\n\n-   Updates the lookup with the information found in the observable\n-   Reactivates an indicator if it is inactive, increments the **Encountered count**, and updates the **Last seen** date\n-   Sets **State** to Complete.\n\n#### Input variables\n\nInput variables determine the initial behavior of the activity.\n\n|Input variable|Description|\n|--------------|-----------|\n|scanID\\[string\\]|lookup identifier|\n\n#### Output variables\n\nThe output variables contain data that can be used in subsequent activities.\n\n|Output variables|Description|\n|----------------|-----------|\n|True|Found valid observable and updated lookup.|\n|False|Did not find valid observable. Observable is either missing or expired.|\n\n### Perform IoC Lookup activity\n\nThe **Threat Intelligence Orchestration - Perform IoC Lookup** workflow activity performs a given lookup. This activity can accelerate the investigation and remediation process.\n\nWhen triggered by a workflow, **Perform IoC Lookup** takes a scanID, looks up the lookup record, and adds the lookup to the queue by creating a lookup queue entry.\n\n#### Input variables\n\nInput variables determine the initial behavior of the activity.\n\n|Variable|Description|\n|--------|-----------|\n|scanID\\[string\\]|lookup identifier|\n\n#### Output variables\n\nThe output variables contain data that can be used in subsequent activities.\n\n|Variable|Description|\n|--------|-----------|\n|True|Triggered the lookup.|\n|False|Did not trigger the lookup.|\n\n### Update observable with lookup result activity\n\nThe **Threat Intelligence Orchestration - Update observable with lookup result** workflow activity updates the observable record. If one does not exist, it creates a new observable. This activity is useful for logging information.\n\nWhen triggered by a workflow **Update observable with lookup result** updates an existing observable to include the new **Sighting count**, adds a note, and, if inactive, reactivates any indicators. The **Encountered count** and **Last seen** date in the indicator are also updated.\n\nIf no correlating observable exists, the workflow creates a new observable with indicator as follows:\n\n-   Runs the IoC lookups\n-   Creates a new observable\n-   Creates an indicator for the observable\n-   Adds a **Sighting count** to the observable\n-   Adds an **Encountered count** and **Last seen** date to the indicator\n-   Adds a message indicating from which lookup it was created\n\n.\n\n#### Input variables\n\nInput variables determine the initial behavior of the activity.\n\n|Variable|Description|\n|--------|-----------|\n|scanID\\[string\\]|Lookup identifier.|\n\n#### Output variables\n\nThe output variables contain data that can be used in subsequent activities.\n\n|Variable|Description|\n|--------|-----------|\n|True|Update or creation of observable is successful.|\n|False|Update or creation of observable failed.|\n\n### Run Default IoC Lookup Sources activity\n\nWhen triggered by a workflow, Threat Intelligence - **Run Default IoC Lookup Sources** takes in a lookup request ID and creates multiple lookups depending on the entered data values.\n\nFor each data type, the **include\\_in\\_bulk scan** column of the supported lookup type table of each lookup source is evaluated. If true, a lookup is added to the lookup request.\n\n#### Input variables\n\nInput variables determine the initial behavior of the activity.\n\n|Variable|Description|\n|--------|-----------|\n|scan\\_request\\_id|Lookup request system identifier|\n\n#### Output variables\n\nThe output variables contain data that can be used in subsequent activities.\n\n|Variable|Description|\n|--------|-----------|\n|Number of scans created|Integer|\n\n"}}