---
sourceDocument: Zurich Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/security-management

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Verify expected results for WHOISIQ URL lookups

# Verify expected results for WHOISIQ
URL lookups {#ariaid-title1}

* Release version: Zurich
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

When a security incident generates observables for URLs or domains, the WHOISIQ API performs the observable
enrichment automatically upon security incident creation. The lookup results are displayed
on the Observable Enrichment Results and SSL Certificates tabs on the security incident record.

## Before you begin

Note:  
The figures in the following steps are shown with the Tabbed forms setting active in the System Settings.

Role required: sn_si.analyst

## About this task

Observable enrichment results are displayed on the Observable Enrichment Results tab at the bottom of the security incident record. For supported observables, an SSL certificate search is also run and the results are displayed on the SSL Certificates tab.

## Procedure

1. Open the security incident record you're working with and verify that the lookup has run successfully in the work notes.  
   Once the application is configured, the flow launches automatically upon incident creation. The execution and completion status of the lookup is displayed in the work notes in the Security Incident record.
2. If you can't verify that the lookup ran successfully, review the work notes for more information on how to proceed.
3. On the open security incident, select the Show All Related Lists related link.
4. Select the Observable Enrichment Results tab to select it.
5. In the Summary column, select the first item, Domain: uber.com Registrar: Markmonitor....  
   The record that is displayed contains information about the domain.
6. Navigate back to the Observable Enrichment Results tab, and, in the Summary column, select the second item, Found certificate with SHA1 hash....  
   This record indicates that an SSL Certificate was found with a file hash.
7. Navigate back to the security incident record and select the SSL Certificates tab.  
   The SSL Certificate results for the file hash are also displayed here.
If you can't view expected results, review the work notes. Also, verify the observable is supported for the lookup by the integration.
**Previous topic:** [RISKIQ SSL certificate lookups that return multiple certificates or no certificates](https://www.servicenow.com/docs/Qe82FW_8W~jyDYR5eLsfdg "A security incident analyst can use multiple SSL certificate results to determine whether a site is part of a common, recognizable entity. No SSL certificate results may indicate sites with obscure or suspicious names have no trusted certificates. Lookup results for observables that don't return SSL certificates, or that return multiple SSL certificates, are displayed on the Observable Enrichment Results tab on the security incident record.")  
**Next topic:** [Create an observable for manual WHOISIQ lookups](https://www.servicenow.com/docs/IZKFLiFgUNE~hS2vddhAOA "Security incident analysts use information from observable enrichment with the WHOISIQ API to learn more about the email addresses, names, and phone numbers of organizations.")  
**Related reference**   

* [Supported observables for RISKIQ and RISKIQ WHOISIQ](https://www.servicenow.com/docs/pL5lUP5aFcMFuU3arLS~NA "The RISKIQ API supports automatic SSL certificate lookups on IP address, file hash, Certificate Serial Number, domain, and URL observables. URL and domain observables are enriched automatically with the WHOISIQ API. For observable enrichment on other types of observables with the WHOISIQ API, create observables and run lookups manually from the Observables table.")