---
title: Send observables to EDR
description: Send observables to the EDR security tool.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/tisc-ms-defend-edr.html
release: australia
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 1
breadcrumb: [Microsoft Defender for EDR integration, TISC Security Tools integrations, TISC Integrations, Integrate, Threat Intelligence Security Center, Security Operations]
---

# Send observables to EDR

Send observables to the EDR security tool.

## Before you begin

Role required: sn\_sec\_tisc.analyst

## Procedure

1.  Navigate to **Workspaces** > **Threat Intelligence Security Center**.

2.  Click the **Threat Intel Library** icon.

3.  Go to **Observables** > **All Observables**.

4.  Open any observable record.

5.  Select **Send to EDR**.

    The Send to EDR **Implementations** modal screen is displayed.

6.  Select the required implementation from the list.

    For example, select the implementation associated to Microsoft Defender EDR.

7.  Click **Next**.

8.  Select the run time details such as the **Title** and **Description** of the implementation.

9.  Click **Submit**.

    The selected action is executed and an information message is displayed that Observable Send to EDR execution has started and the results of this execution will be available under the Activity Stream after the execution is complete.

    **Note:** Once the execution is initiated or completed, a work notes is posted on the activity stream of the form view and you can verify the execution progress accordingly.


**Parent Topic:**[Microsoft Defender for EDR integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-ms-defender-integration.md)