---
title: Add Observables to EDLs
description: Add observables such as IP addresses, domains, and hashes to External Dynamic Lists \(EDLs\) to automatically update threat intelligence feeds in your security infrastructure.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/add-obsesrvables-edl.html
release: australia
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 1
breadcrumb: [Palo Alto Networks integration, Firewall integration, TISC Security Tools integrations, TISC Integrations, Integrate, Threat Intelligence Security Center, Security Operations]
---

# Add Observables to EDLs

Add observables such as IP addresses, domains, and hashes to External Dynamic Lists \(EDLs\) to automatically update threat intelligence feeds in your security infrastructure.

## Before you begin

Role required: sn\_sec\_tisc.analyst

## Procedure

1.  Navigate to **Workspaces** > **Threat Intelligence Security Center**.

2.  Select the **Threat Analyst Workbench** icon.

3.  Navigate to **Observables** > **All Observables**.

4.  Open any observable record.

5.  Select **Add to EDL** button to add the observables to the list.

    The **Add to EDL** modal screen appears. Proceed to add observables to the EDLs.

6.  Select **Remove** to remove the observables from the EDLs.

    For more information, see [Remove Observables from EDL](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/remove-observables-edl.md).


**Parent Topic:**[Palo Alto Networks integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/palo-alto-networks-integration.md)

**Related topics**  


[Approve EDL entries for Palo Alto Networks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-approve-edl-entries.md)