---
sourceDocument: Zurich Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/security-management

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Configure new enrichment

# Configure new enrichment {#ariaid-title1}

* Release version: Zurich
* 
* Updated April 27, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Set up threat intelligence enrichment integrations to automatically gather additional context about observables, search for sightings, or perform threat lookups from external security vendors.

## Before you begin

Role required: sn_sec_tisc.admin

## Procedure

1. Navigate to WorkspacesThreat Intelligence Security Center.
2. Select the Integrations icon.  
   In the All Integrations section, select the Configure new enrichment action.
3. Choose an enrichment type from the Configure new enrichment dialog.  
   The Configure new enrichment dialog displays three enrichment types: Observable Enrichment, Sighting Search, and Threat Lookup.

4. From the enrichment types, select your preferred option and select Next.  
   The system displays available integrations.
5. Select an integration from the list of available integrations.  
   The system opens the Create Enrichment Integration page with pre-filled details for the selected integration, such as WHOIS integration.
6. Complete the Create Integration form fields.  
   {#tisc-config-new-enrich__table_zvp_mjl_bjc__entry__2}

   | Field | Description |
   |-|-|
   | Name | Name for the new enrichment integration. For example, <kbd class="ph userinput">WHOIS1</kbd>. |
   | Vendor Name | Name of the vendor. This field is automatically populated. For example, <kbd class="ph userinput">WHOIS</kbd>. |
   | Integration Type | Type of integration selected, such as Observable Enrichment. This field is automatically populated. The following Integration Types are supported: * Observable Enrichment * Sighting Search * Threat Lookup {#tisc-config-new-enrich__ul_awp_mjl_bjc} |
   | Description | Unique description for the new enrichment integration. |
   [Table 1. New enrichment integration form]

   {#tisc-config-new-enrich__table_zvp_mjl_bjc}
7. In the Integration Configuration section, configure the integration details.  
   The Integration Configuration section includes details such as API key, API Client ID or secret, username, and password. These details vary for different integrations.
8. To create the enrichment integration configuration, select Save.  
   The system validates the provided details and sets the enrichment integration status to inactive by default.
9. **Optional:** To store the integration configurations as draft only, select Save as Draft.  
   You cannot enable an integration when it is saved as draft. If you're not sure about the configuration details, you can use the Save as Draft option. After you get the configuration details, you can complete the draft version and create it.
10. To enable the enrichment integration, select Enable.  
    The integration status changes to enabled.  
    Note:  
    You can also enable, disable, or delete an enrichment integration using the Actions menu on the integration tile.
{#tisc-config-new-enrich__steps_od5_tll_bjc}
**Related concepts**   

* [TISC Security Tools Integrations](https://www.servicenow.com/docs/vOJjiz88iUcywQU68EX9EQ "TISC Endpoint Detection and Response (EDR) integrations focuses on identifying and addressing security threats at an endpoint level.")

*[\>]: and then