---
title: Using MISP to investigate and analyze threats
description: You can use the MISP data across the ServiceNow AI Platform Threat Intelligence module and the ServiceNow AI Platform SIR module to investigate and analyze threats to your organization.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/using-misp-to-detect-and-analyze-threats.html
release: australia
topic_type: concept
last_updated: "2026-03-12"
reading_time_minutes: 1
breadcrumb: [MISP integration for Security Operations, Threat Intelligence integrations, Threat Intelligence, Enterprise security case management applications, Security Operations]
---

# Using MISP to investigate and analyze threats

You can use the MISP data across the ServiceNow AI Platform Threat Intelligence module and the ServiceNow AI Platform SIR module to investigate and analyze threats to your organization.

-   **[Sighting searches in MISP](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/sightings-searches-in-misp.md)**  
You can perform sighting searches on observables in the MISP instance to determine how often certain types of attacks, such as phishing attacks or communications with a malicious IP or URL, occur in your network. Each occurrence is considered a sighting.
-   **[Observable enrichment in MISP](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/observable-enrichment-in-misp.md)**  
By enriching observables with additional information from various MISP sources during incident response investigations, you can contain identified threats.
-   **[Managing events in MISP](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/events-in-misp.md)**  
You can create events in MISP automatically or manually from the ServiceNow AI Platform. You can also edit the event data in MISP from the ServiceNow AI Platform.
-   **[Roll up MITRE-ATT&CK information using MISP enrichment results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/rollup-mitre-information-using-misp-enrichment-results.md)**  
Roll up the MISP enrichment results manually if you haven't enabled the automatic rollup of MISP information.

**Parent Topic:**[MISP integration for Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/misp-integration-for-security-operations.md)

**Related topics**  


[MISP administration]()