---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Send observables to EDR

# Send observables to EDR {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Send observables to the EDR security tool.

## Before you begin

Role required: sn_sec_tisc.analyst

## Procedure

1. Navigate to WorkspacesThreat Intelligence Security Center.
2. Click the Threat Intel Library icon.
3. Go to ObservablesAll Observables.
4. Open any observable record.
5. Select Send to EDR.  
   The Send to EDR Implementations modal screen is displayed.
6. Select the required implementation from the list.
7. Select Next.
8. Select the run time details such as the Action Type and Description of the implementation.  
   The available options for the CrowdStrike during implementation run time details are:
   * No Action (Save indicator in IOC management, but take no action.): The observable is saved in CrowdStrike IOC management and no detection or block action is applied.
   * Detect Only (Show as a detection and take no other action.): The observable is shown as a detection in CrowdStrike Falcon EDR and no other action is applied.
   * Block (Block and show as detection. Applies only to MD5 and SHA256 observable types.): The observable is blocked and shown as a detection.
   * Block, hide detection (Block and detect but hide from Activity \> Detections. Applies only to MD5 and SHA256 observable types.): The observable is blocked and detected, and the detection isn't shown in ActivityDetections in the CrowdStrike Falcon console.

   {#send-to-edr__ul_yy1_j5x_cdc}  
   Important:  
   When an observable has no threat severity, the severity low is sent for the Detect Only and Block actions.
9. Select Submit.  
   The selected action is executed and the information message Observable Send to EDR execution has started is displayed.  
   Note:  
   * After the execution is initiated or completed, a work note is posted on the activity stream of the form.
   * Send to EDR action is also available on the observables list under Artifacts tab for a case record. For more information, see [Add artifacts to cases or case tasks](https://www.servicenow.com/docs/jHJX9k4L2YuED_VKmK4UjQ "After you have created a case, you can view or add artifacts, such as security incidents, CIs, and indicators of compromise, to the case. These artifacts act as clues in solving the case.").
   {#send-to-edr__ul_ykt_gjt_bcc}
{#send-to-edr__steps_tmd_xdc_h1c}

*[\>]: and then