---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Create an observable for manual WHOISIQ lookups

# Create an observable for manual WHOISIQ lookups {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Security incident analysts use information from observable enrichment with the WHOISIQ API to learn more about the
email addresses, names, and phone numbers of organizations.

## Before you begin

Role required: sn_si.analyst

## Procedure

1. Navigate to AllIoC RepositoryObservables.  
   Under the navigation panel, the Observables module is displayed.
2. Select the Observables module to display the Observables list.
3. Select New to create an observable.
4. On Observable form, fill in the fields.

   | Field | Description |
   | Value | Email address, organization name, phone number, or mailing address. For example, <kbd class="ph userinput">test1gmail.com</kbd> |
   | Observable type | The field is automatically cleared. |
   | Finding | The field is automatically set to Unknown. |
   |-|-|

   {#manually-attch-obsv-whoisiq__choicetable_g4y_2pl_fdb}
5. Select Submit.  
   you're returned to the Observables list. In the Value column, your new observable is displayed.  
   Note:  
   If you can't locate your observable on the part of the list that is displayed, use the search functionality to find it.
6. Edit the Observable type field to change the type from Unknown to Email address to match your observable.
   1. In the Observable type column, single-click to the right of the Unknown text to select it.  
      The selected field is outlined in blue.
   2. With the field outlined in blue, double-click anywhere inside the highlighted field to open the editor.
   3. In the field that is displayed, enter the observable type (<kbd class="ph userinput">Email address</kbd>) and select the green check mark to save the value.  
      In the Observable type column on the list, Email Address is displayed for your new observable.
   {#manually-attch-obsv-whoisiq__substeps_snp_wkp_xdb}
{#manually-attch-obsv-whoisiq__steps_qyb_2ql_fdb}

## What to do next

If you have created and edited an observable for lookup, run the observable enrichment lookup from the Observable record with the WHOISIQ API.
**Previous topic:** [Verify expected results for WHOISIQ URL lookups](https://www.servicenow.com/docs/w6j~TJryNb2X_D5Qq~ZSzA "When a security incident generates observables for URLs or domains, the WHOISIQ API performs the observable enrichment automatically upon security incident creation. The lookup results are displayed on the Observable Enrichment Results and SSL Certificates tabs on the security incident record.")  
**Next topic:** [Verify expected results for manual WHOISIQ lookups](https://www.servicenow.com/docs/FLQ4hCRH~1pSWtbXUEFUYw "Run a manual lookup on an observable when it does not automatically generate a security incident. For observable enrichment lookups using the WHOISIQ API for email addresses, organization names, phone numbers, or mailing addresses, initiate the lookup manually from the Observables table.")

*[\>]: and then