---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Add observables to TISC Case

# Add observables to TISC Case {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Add observables to TISC case records.

## Before you begin

Role required: sn_si.analyst, sn_sec_tisc.case_write

## Procedure

1. Navigate to WorkspacesSecurity Incident Response WorkspaceSecurity IncidentsAll.
2. Locate and open any specific security incident that you're investigating.  
   This can also be done by searching for the incident ID or browsing from Quick Filters section or filtering through incident state.
3. Select the Related Records tab on the workspace.  
   You can perform the action of adding observables to TISC case(s) using various tabs from the Security Incident Response Workspace.  
   Note:  
   You can navigate through:
   * Observables details page from the Related Records tab
   * InvestigationEntry Points ListsAssociated Observables
   {#observables-to-case__ul_g25_xlb_h1c}
4. Select the observables to add to case records.  
   Note:  
   You can also select an Observable record to open the Observables details page in a different tab and add case records.
5. Select Add to TISC Case.
6. In the Link TISC Case dialog box, select the cases to link the artifacts.  
7. Select Link.  
   The linked case is displayed in the TISC Cases list. Select the case record to view the case in the TISC Workspace. You can also select the case record from the security incident Activity stream.
8. **Optional:** Select Create new TISC case to create a TISC case within the workflow.
**Related tasks**   

* [Add security incident to TISC case](https://www.servicenow.com/docs/oRyoXHXc6vM0yC1H_dAqDQ "Add security incidents to TISC case records.")
* [Send Observables to TISC](https://www.servicenow.com/docs/VJNWnxlhS9MGhvva17pqgw "Using this feature the security analyst can push the observables data from SIR to TISC. Using the TISC Context, you can check if the observables are present in TISC, if not security analyst can push the data whenever required.")
* [Send Threat Lookup to TISC](https://www.servicenow.com/docs/QQdzzepm419PH_VxjzMw9w "Using this feature the security analyst can push the threat lookup data from SIR to TISC. Using the TISC Context, you can check if the threat lookup results are present in TISC, if not security analyst can push the data whenever required.")
* [Send Sighting Search to TISC](https://www.servicenow.com/docs/lrH4qlEmdq1zowWEOb~Cbw "Using this feature the security analyst can push the sighting search data from SIR to TISC. Using the TISC Context, the analyst can check if the sighting search data is present in TISC, if not the security analyst can push the data whenever required.")
* [Send Observable Enrichment to TISC](https://www.servicenow.com/docs/d_zRa7QF_uxPqTH8ByInUg "Using this feature the security analyst can push the sighting search data from SIR to TISC. Using the TISC Context, the analyst can check if the sighting search data is present in TISC, if not the security analyst can push the data whenever required.")  
**Related reference**   

* [System properties to send data](https://www.servicenow.com/docs/xQZzhDOp9JP7rBFciK40Ow "Review the system properties for TISC integrations to combine with SIRW. You can configure these properties to control how both applications manages the integrations.")

*[\>]: and then