Thank you for your feedback.
Form temporarily unavailable. Please try again or contact to submit your comments.
  • Madrid
  • London
  • Kingston
  • Jakarta
  • Istanbul
  • Helsinki
  • Geneva
  • Store

Run Publish to Watchlist

Log in to subscribe to topics and get notified when content changes.

Run Publish to Watchlist

Publish to Watchlist takes observables or associated indicators and publishes them to a third-party watchlist.

Before you begin

Role required: sn_si.analyst

About this task

Note: If no implementations are available, capability actions are not displayed in product menus.

The Security Operations Integration - Publish to Watchlist workflow is triggered from the related list on a security incident.

The following example is for observables.


  1. Navigate to a security incident.
  2. Select Observables from the Related List tab.
  3. Click Publish to Watchlist in the Actions on selected rows... drop-down menu.
    Run Publish to Watchlist
    The dialog box appears.
    Publish to Watchlist dialog box
  4. Enter or choose the implementation.
  5. Click Submit.