Threat Lookup Finding Calculators

  • Release version: Zurich
  • Updated July 31, 2025
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Threat Lookup Finding Calculators

    The Threat Lookup Finding Calculator in ServiceNow helps you determine observable findings based on responses received from various threat intelligence integrations. You can create a custom calculator for your integrations by using or modifying the provided sample script to identify observable findings according to your organization’s needs. For third-party integrations that supply computed results, the calculator maps those results to the supported findings within the ServiceNow system.

    Show full answer Show less

    Rollup Threat Lookup Results

    When multiple threat lookup results exist for the same observable across different vendors, ServiceNow aggregates these results to determine an overall observable finding. The system uses the most recent lookup results and applies the following logic:

    • Malicious: If any vendor reports an observable as Malicious, the overall finding is Malicious.
    • Suspicious: If no vendors report Malicious but at least one reports Suspicious, the overall finding is Suspicious.
    • Clean: If all vendors report Clean, the overall finding is Clean.
    • Unknown: If no vendors report Malicious or Suspicious, but one reports Unknown, the overall finding is Unknown.

    Observable Finding Override Modes

    ServiceNow allows you to control how threat lookup results update observable findings through configurable override modes. These settings are accessed via Threat Intelligence > Administration > Properties, using the Observable finding override mode property. The available modes are:

    • Default: The system always recalculates observable findings from threat lookup results, overwriting any previous values.
    • Override: Users can manually override findings for a limited validity period during which the system does not change the finding.
    • Precedence: Findings adhere to a priority order. Severity upgrades from threat lookup results are applied immediately, while downgrades are deferred until a configured expiry period per observable type. The Precedence expiry field on each observable type record defines how long a higher-severity finding is retained before downgrades are applied (default is 0 days). You must also configure the Observable finding precedence order property to set the priority ranking, with the default order being Malicious, Suspicious, Unknown, Clean (Malicious having the highest priority).

    Threat Lookup Finding Calculator helps you calculate the observable findings based on the responses received.

    You can create a Threat Lookup Finding Calculator for your integration and use a script to determine how you want to identify the various observable findings. The Threat Lookup Finding Calculator includes a sample script that comes with the base system, which you can use to identify the observable findings or you can modify this script according to your requirements.

    For third-party integrations that provide the computed results, the Threat Lookup Finding Calculator maps the results to supported findings in the base system.

    Rollup Threat Lookup Results

    When you have multiple threat lookup results for an observable from the various integration vendors, then the recent threat lookup results from all the vendors are considered, and the overall observable findings are marked as follows:
    Table 1. Rollup Threat Lookup Findings
    Latest Observable Finding Overall Observable Finding
    Malicious If one of the integration vendors reports the observable as Malicious, then the overall observable finding is marked as Malicious.
    Suspicious If none of the integration vendors report the observable as Malicious, one of them reports it as Suspicious, and then the overall observable finding is marked as Suspicious.
    Clean If all the integration vendors report the observable as Clean, then the overall observable finding is marked as Clean.
    Unknown If none of the integration vendors report the observable as Malicious or Suspicious and one of them report it as Unknown, then the overall observable finding is marked as Unknown.

    Observable finding override modes

    You can control how threat lookup results update observable findings by configuring the override mode. Navigate to Threat Intelligence > Administration > Properties and set the Observable finding override mode property to one of the following values:

    • Default — The system always recalculates findings from threat lookup results. Any previous finding value is overwritten.
    • Override — Users can manually override the observable finding for a limited time. The system does not change the finding during the configured validity period.
    • Precedence — Findings follow a defined priority order. Severity upgrades from threat lookup results are applied immediately, while downgrades are deferred until the per-observable-type expiry window elapses. The Precedence expiry field on each observable type record defines how many days a higher-severity finding is retained before the system applies a downgrade. The default value is 0 days.

    When using precedence mode, configure the Observable finding precedence order property to define the priority ranking. The default order is Malicious, Suspicious, Unknown, Clean, where Malicious has the highest priority.