{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":45600,"path":"security-management/threat-intelligence-security-center/tisc-ioc-enrichment.md","title":"Automated IOC Enrichment","bundle":null,"doc_type":null,"release":"australia","body":"\n# Automated IOC Enrichment\n\nLearn how to automate enrichment of IOC’s using flows when they match a certain criterion.\n\n## Before you begin\n\nRole required:\n\n-   System Administrator \\(view, create or edit\\)\n-   sn\\_sec\\_tisc.admin \\(view\\)\n\n## About this task\n\nAutomate enrichment of IOC’s triggers only when:\n\n-   the type of the observable is a domain name, IPv4 address, or IPv6 address.\n-   the observable is in a processed state.\n-   the observable does not have the tags enriched or Skip Enrichment.\n\n## Procedure\n\n1.  Navigate to **All** > **Threat Intelligence Security Center** > **Administration**.\n\n2.  Select **Automated Flows**.\n\n3.  Select **Automated IOC Enrichment** action link to view the respective rule details in the flow designer.\n\n4.  View the flow designer action for the following trigger:\n\n    ```\n    Observable Updated where (Type is Domain Name, or Type is IP address (V4), or Type is IP address (V6); and Processing Status is Processed; and TISC Tags does not contain Enriched, or TISC Tags does not contain Skip Enrichment, or TISC Tags does not contain Potential New Threat)\n    ```\n\n5.  **If the observable is an IPv4 or IPv6 address and it falls within an allowed CIDR range, then:**\n\n    1.  Add the observable to Allow List.\n\n    2.  Update the observables tags to Skip Enrichment.\n\n    3.  End the flow for this observable.\n\n6.  **Else, enrich the observable data with available capabilities:**\n\n    1.  Perform threat lookup and sighting search to gather additional information about the observable.\n\n    2.  Update the observable with enriched data.\n\n    3.  Add a tag **Enriched** to indicate that the IOC has been processed.\n\n7.  **Also, if the observables reputation is clean, then:**\n\n    1.  Mark observable as false positive and inactivate.\n\n8.  **Else, if observable reputation is unknown**\n\n    1.  Add tag **Not Potential Threat & Enriched** to indicate that it is not a threat.\n\n    \\[Omitted image \"tisc-automated-ioc-enrichment.png\"\\] Alt text: Automated IOC Enrichment in TISC.\n\n\n**Parent Topic:**[Working with automated flows](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-automated-flows.md)\n\n**Related topics**  \n\n\n[Automated sharing of high-risk IOC's with trusted partners]()\n\n[Automatically add threat intelligence to a TAXII collection]()\n\n[Create vulnerability assessment for zero day]()\n\n[Analyze, assess, and disseminate observables]()\n\n[Analyze and assess threat IoC’s]()\n\n[Vulnerability Management Support]()\n\n[Zero-day vulnerability tracking]()\n\n[Automatic Threat Actor priority tagging]()\n\n[Automated flows tables]()\n\n"}}