{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":45568,"path":"security-management/threat-intelligence-security-center/tisc-disseminate-observables.md","title":"Analyze, assess, and disseminate observables","bundle":null,"doc_type":null,"release":"australia","body":"\n# Analyze, assess, and disseminate observables\n\nLearn how to analyze and disseminate observables which are related to threat.\n\n## Before you begin\n\nRole required:\n\n-   System Administrator \\(view, create or edit\\)\n-   sn\\_sec\\_tisc.admin \\(view\\)\n\n## About this task\n\nWhenever a sighting search enrichment is requested, it returns with no sightings.\n\n## Procedure\n\n1.  Navigate to **All** > **Threat Intelligence Security Center** > **Administration**.\n\n2.  Select **Automated Flows**.\n\n3.  Select **Analyze, assess and disseminate on the IoCs related to threat** action link to view the respective rule details in the flow designer.\n\n4.  View the flow designer action for the following trigger:\n\n    ```\n    Sighting Created where (Sighting count is 0)\n    ```\n\n5.  **The observable has a threat score greater than 80, confidence greater than 80 and reputation is malicious:**\n\n    1.  Add the observable to deny list.\n\n    2.  End the flow for this observable.\n\n6.  **Else, the observable reputation is suspicious, and the threat score is in the range of 60-80:**\n\n    1.  Add a tag called Potential New Threat.\n\n    2.  Add the observable to watch list.\n\n    3.  Create a case task with CTI team to track this observable and analyze further.\n\n    4.  Link observable to the case for investigation.\n\n        \\[Omitted image \"tisc-analyse-disseminate.png\"\\] Alt text: Analyze, assess, and disseminate on the IoC’s related to threat.\n\n\n**Parent Topic:**[Working with automated flows](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-automated-flows.md)\n\n**Related topics**  \n\n\n[Automated IOC Enrichment]()\n\n[Automated sharing of high-risk IOC's with trusted partners]()\n\n[Automatically add threat intelligence to a TAXII collection]()\n\n[Create vulnerability assessment for zero day]()\n\n[Analyze and assess threat IoC’s]()\n\n[Vulnerability Management Support]()\n\n[Zero-day vulnerability tracking]()\n\n[Automatic Threat Actor priority tagging]()\n\n[Automated flows tables]()\n\n"}}