{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":45508,"path":"security-management/threat-intelligence-security-center/tisc-analyze-ioc.md","title":"Analyze and assess threat IoC’s","bundle":null,"doc_type":null,"release":"australia","body":"\n# Analyze and assess threat IoC’s\n\nLearn how to analyze an IOC’s which are a threat and notifying the security incident team.\n\n## Before you begin\n\nRole required:\n\n-   System Administrator \\(view, create or edit\\)\n-   sn\\_sec\\_tisc.admin \\(view\\)\n\n## About this task\n\nWhenever a sighting search enrichment is requested:\n\n-   if the observable is sighted \\(count > 0\\) and\n-   Observable Reputation is Malicious and\n-   Observable Threat score is > 80 and\n-   Observable Confidence > 80\n\n## Procedure\n\n1.  Navigate to **All** > **Threat Intelligence Security Center** > **Administration**.\n\n2.  Select **Automated Flows**.\n\n3.  Select **Analyze, assess the IoCs related to the threat and create incident** action link to view the respective rule details in the flow designer.\n\n4.  View the flow designer action for the following trigger:\n\n    ```\n    Sighting Created where (Sighting count greater than 0, and Observable. Reputation is Malicious, and Observable. Threat Score greater than 80, and Observable. Confidence greater than 80)\n    ```\n\n5.  **If Sighting Created where \\(Sighting count greater than 0, and Observable. Reputation is Malicious, and Observable. Threat Score greater than 80, and Observable. Confidence greater than 80\\), then:**\n\n    1.  Create an security incident and add the observable to the incident.\n\n    2.  Add Observables to Security Incident V1.\n\n    3.  Send an email communication.\n\n        \\[Omitted image \"tisc-analyze-assess-IoCs.png\"\\] Alt text: Analyze, assess the IoC’s related to the threat and create incident.\n\n\n**Parent Topic:**[Working with automated flows](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-automated-flows.md)\n\n**Related topics**  \n\n\n[Automated IOC Enrichment]()\n\n[Automated sharing of high-risk IOC's with trusted partners]()\n\n[Automatically add threat intelligence to a TAXII collection]()\n\n[Create vulnerability assessment for zero day]()\n\n[Analyze, assess, and disseminate observables]()\n\n[Vulnerability Management Support]()\n\n[Zero-day vulnerability tracking]()\n\n[Automatic Threat Actor priority tagging]()\n\n[Automated flows tables]()\n\n"}}