---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Publish observables to a third-party watchlist

# Publish observables to a third-party watchlist {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
You can publish one or more observables or associated indicators to a third-party
watchlist. Currently, the only implementation that supports this functionality is
CrowdStrike Falcon Host.

## Before you begin

Role required: sn_si.analyst

## About this task

Note:  
If no implementations are available, capability actions are not displayed in product menus.

## Procedure

1. Navigate to a security incident.
2. Select Observables from the Related List tab.
3. Select Publish to Watchlist in the Actions on selected rows... drop-down menu.  
   The Publish to Watchlist dialog box appears.
4. Enter or choose the implementation.  
   Note:  
   A workflow is triggered by the [Security Operations Integration- Publish to Watchlist capability](https://www.servicenow.com/docs/Btwi4yu14anwhyK7cVwqbA "The Publish to Watchlist capability adds observables and indicators associated with a security incident to a third-party watchlist that monitors for security events and generates alerts. This capability is used as part of incident response during investigations.") when you select the CrowdStrike Falcon Host implementation.
5. Select Submit.
{#run-publish-watchlist__steps_wnh_jg1_xy}