---
sourceDocument: Yokohama Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/security-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Send observables to EDR

# Send observables to EDR {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Send observables to the EDR security tool.

## Before you begin

Role required: sn_sec_tisc.analyst

## Procedure

1. Navigate to WorkspacesThreat Intelligence Security Center.
2. Click the Threat Intel Library icon.
3. Go to ObservablesAll Observables.
4. Open any observable record.
5. Select Send to EDR.  
   The Send to EDR Implementations modal screen is displayed.
6. Select the required implementation from the list.  
7. Click Next.
8. Select the run time details such as the Action Type and Description of the implementation.  
   The available options for the CrowdStrike during implementation run time details are:
   * No Action (Save the indicator for future use, but take no action): In the Observable form view, the threat severity of the observable is optional for CrowdStrike Falcon EDR.
   * Detect (Enable detections for the indicator at record's threat severity): In the Observable form view, the threat severity is mandatory for CrowdStrike Falcon EDR. The threat severity of the observable shouldn't be empty for that selected observable.
   {#send-to-edr__ul_yy1_j5x_cdc}
9. Click Submit.  
   The selected action is executed and an information message is displayed that Observable Send to EDR execution has started.  
   Note:  
   * Once the execution is initiated or completed, a work notes is posted on the activity stream of the form view.
   * Send to EDR action is also available on the observables list under Artifacts tab for a case record. For more information, see [Add artifacts to case(s) or case task(s)](https://www.servicenow.com/docs/ZRricc2uBumLGdHWLTI4og "After you have created a case, you can view or add artifacts, such as security incidents, CIs, and indicators of compromise, to the case. These artifacts act as clues in solving the case.").
   {#send-to-edr__ul_ykt_gjt_bcc}
{#send-to-edr__steps_tmd_xdc_h1c}

*[\>]: and then