Thank you for your feedback.
Form temporarily unavailable. Please try again or contact to submit your comments.

Publish observables to a third-party watchlist

Log in to subscribe to topics and get notified when content changes.

Publish observables to a third-party watchlist

You can publish one or more observables or associated indicators to a third-party watchlist. Currently, the only implementation that supports this functionality is CrowdStrike Falcon Host.

Before you begin

Role required: sn_si.analyst

About this task

Note: If no implementations are available, capability actions are not displayed in product menus.


  1. Navigate to a security incident.
  2. Select Observables from the Related List tab.
  3. Click Publish to Watchlist in the Actions on selected rows... drop-down menu.
    Run Publish to Watchlist
    The dialog box appears.
    Publish to Watchlist dialog box
  4. Enter or choose the implementation.
    Note: A workflow is triggered by the Security Operations Integration - Publish to Watchlist capability when you select the CrowdStrike Falcon Host implementation.
  5. Click Submit.