{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44219,"path":"security-management/secops-integration-enrich-observ-wf.md","title":"Security Operations Integration - Enrich Observable flow","bundle":null,"doc_type":null,"release":"australia","body":"\n# Security Operations Integration - Enrich Observable flow\n\nThe Security Operations Integration - Enrich Observable sub flow allows you to enrich observables with additional information from a variety of sources using implementation flow designer.\n\n## Before you begin\n\nRole required: sn\\_si.analyst\n\n## About this task\n\nThis flow can be triggered from either Security Incident Response or Threat Intelligence in two ways.\n\n-   by selecting one or more observables from the Observables list and selecting **Run observable enrichment** from the **Actions on selected rows** choice list.\n-   by opening an observable record and clicking the **Run observable enrichment** related link.\n\nEither method then allows you to specify which implementations to be used to enrich the selected observables. The associated implementation flows are executed to perform the enrichment.\n\n\n\n\\[Omitted image \"flows-enrich-observables.png\"\\] Alt text: Security Operations Integration - Enrich Observable\n\nActions specific to this flow are described here. For more information on other actions, see [Common Security Operations integration flows and orchestration activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/common-wf-activities.md).\n\nThe flow process actions include:\n\n-   [Legacy: Capability Execution Tracking- No Impls action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/execution-tracking-noimpls-activity.md)\n-   [Get Supported Security Capabilities action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/get-supported-security-capabilities-activity.md)[Legacy: Capability Execution Tracking- No Impls action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/execution-tracking-noimpls-activity.md)\n\n**Parent Topic:**[Security Operations Integration- Enrich Observable capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/enrich-observable-capability.md)\n\n"}}