Run a manual lookup on an observable when it does not automatically generate a
security incident. For observable enrichment lookups using the WHOISIQ API for email addresses,
organization names, phone numbers, or mailing addresses, initiate the lookup manually from
the Observables table.
Before you begin
Role required: sn_si.analyst
About this task
Create an observable for a manual lookup using the WHOISIQ API. For more information on how to create and edit an
observable, see Create an observable for manual WHOISIQ lookups.
Procedure
-
Navigate to and locate the observable in the list you're working with.
-
Select your observable in the Value column to open the record.
-
Select the Run Observable Enrichment related link to run the lookup.
-
In the Run Observable Enrichment window, move
RiskIQ Whois to the Selected list.
-
Select Submit.
Lookup results are displayed on the Observable Enrichment Results tab on the observable record.
If no results are returned for the observable, a message is displayed in the Summary column. If you don't see results, verify the observable is supported by the API.