Security Operations Integration - Publish to Watchlist Flow
The Security Operations Integrations - Publish to Watchlist flow is a high-level flow independent of integrations. It adds observables to third-party watchlist that support the capability. Use it to fulfill an integration.
Before you begin
Role required: sn_si.analyst
About this task
This flow is visible and runs only when an integration is available. It is triggered from the Observables or Associated Indicators tab on a security incident.
Image omitted: publish-to-watchlist.png
Security Operations Integration - Publish to Watchlist capability flow
Security Operations Integration - Publish to Watchlist capability flow
Activities specific to this flow are described here. For more information on other activities, see Common Security Operations integration flows and orchestration activities.
Parent Topic:Security Operations Integration- Publish to Watchlist capability