---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Automatic security incident observable log data enrichment

# Automatic security incident observable log data enrichment {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
When certain applications and integrations are set up, including Threat Intelligence and the Palo Alto Networks - Firewall integration, observables
information in a security incident can be automatically enriched with threat log data whenever
the Source IP for its observables is modified.

When a modification occurs, a business rule initiates a workflow that retrieves data from
threat logs on your firewall and enriches the observables information in the security
incident.  
Before observables can be enriched, the following steps must be performed.

* [Threat Intelligence](https://www.servicenow.com/docs/HoHQ~xSOv5OaKF6Fr4RTGg#install-threat-lp5 "Before you run Threat Intelligence in your instance, you must download it from the ServiceNow Store.") must be activated.
* The [Palo Alto Networks Firewall](https://www.servicenow.com/docs/G3Gl~B6TxZRDoM35zar0TA "The Integration Configuration feature allows you to quickly activate and set up third-party security integrations, including Palo Alto Networks - Firewall. Before you can use the Palo Alto Networks - Firewall, you must download it from the ServiceNow Store.") integration must be activated and configured. This can also include [Set up SSH credentials to the MID Server](https://www.servicenow.com/docs/3OrOzv_7yn4C3EwuiuOd3w "Palo Alto Networks Firewall sends API calls to the MID Server. As such, ensure that SSH credentials have been created for the MID Server.").
{#si-observ-data-enrich__ul_rfj_ytx_1x}

After that setup has been completed, the act of changing the Source IP of observables
associated with a security incident causes a business rule to execute the Security Operations Palo Alto Networks - Get Log Data workflow. Workflow activities queue up
a search query on the firewall and return a Job ID that is used to retrieve threat logs data from
the firewall and attach them as an XML file to the security incident.
**Related tasks**   

* [Get AutoFocus Session Info Enrichment Flow](https://www.servicenow.com/docs/xHbFnnaTvVS~1GPmYe0hcw#search-for-malicious-content "When the Security Operations Palo Alto Networks- Get AutoFocus Session Info Enrichment flow is executed, it queues a search query with AutoFocus for gathering information about a specified source IP. If AutoFocus has knowledge about previous sessions originating from that IP address, a JSON-formatted report is returned.")
* [Palo Alto Networks Firewall Launcher Workflow](https://www.servicenow.com/docs/aTZ5KVKm6yg1VVNNDzN7Cg "Security Operations Integration Palo Alto Networks Firewall Launcher workflow is the Palo Alto Networks Firewall implementation launched by the Security Operations Integration - Block Request capability workflow.")
* [Get Log Data Flow](https://www.servicenow.com/docs/YR1joeAuadNAPLB9bMTBzQ#get-threat-log-data "If Security Incident Response, Threat Intelligence, and Palo Alto Networks - Firewall are activated, the Security Operations Palo Alto Networks - Get Log Data flow automatically executes when the Source IP for observables in a security incident is changed.")
* [Get WildFire Data Enrichment Flow](https://www.servicenow.com/docs/_AWjuKl~W0QJI7nk2ZWo6w#enrich-wildfire-data "When the Security Operations Palo Alto Networks - Get WildFire Data Enrichment flow is executed, a hash file is uploaded to WildFire. The data is enriched, and reports are downloaded to the instance to aid in processing potential malware attacks.")