View lookup results

Regardless of the method used to submit a lookup request (via a security incident or the catalog, or from a forwarded email), you can view results in a couple of ways.

Before you begin

Role required: sn_ti.admin

Procedure

  1. The easiest way to view the results of your lookup request is to look at the lookup request itself. Navigate to Threat Intelligence > IoC Lookup > Lookups.
    The Lookups screen lists the individual lookups performed. If you requested more than one item of a particular type to lookup, each item produces its own lookup (SCN) record. For example, if you entered two URLs to look up, the Lookups screen lists one record for each URL. The State column shows the current state of each record. That is, whether it is still performing a lookup. The Result column shows whether each lookup passed, failed, or is pending.
  2. Click the lookup number of the lookup for which you want to view details.
    The Reason field provides a plain text reason for the result of the lookup.