---
title: Working with TISC Context
description: TISC context facilitates viewing threat intelligence data such as observables within the security incident response workspace.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/security-incident-response/working-with-tisc-context.html
release: brazil
product: Security Incident Response
classification: security-incident-response
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [TISC integration within SIR Workspace, Working with Security Incident Records, Use, Security Incident Response Workspace, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Working with TISC Context

TISC context facilitates viewing threat intelligence data such as observables within the security incident response workspace.

This helps security analysts to detect, investigate, and respond to security incidents more effectively from the workspace.

TISC Context in Security Incident Response workspace allows the security analysts to add security incidents or observables to TISC Case\(s\) directly from the workspace, also view the enrichment results, and view observables related information which are related threat actors, attack patterns, campaigns, and so on.

Using this section, you can do the following:

1.  Associate observables to a TISC case.
2.  View associated observables information.
3.  View observables enrichment results.

For more detailed information and procedure, see the following sections, and for more information on how the integration works between TISC and SIR workspaces, see [TISC integration with SIR Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intelligence-security-center/tisc-integration-with-sir-workspace.md) in [Threat Intelligence Security Center](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intelligence-security-center/tisc-landing-page.md).

-   **[Add observables to TISC Case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/tisc-si-case.md)**  
Use this section to add security incidents or observables to a TISC case.
-   **[Link and unlink TISC records to a security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/tisc-link-unlink-records-sir.md)**  
Link TISC records such as observables, threat actors, and malware to a security incident, or unlink records that you no longer need.
-   **[View related info from TISC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/tisc-related-info-sir.md)**  
Use this section to view the related info such as related threat actors, attack patterns, campaigns, and cases from TISC in Security Incident Response Workspace.
-   **[View Enrichment Results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/tisccontext-enrich-results.md)**  
TISC context facilitates viewing threat intelligence data such as observables within the security incident response workspace.

**Parent Topic:**[TISC integration within SIR Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/tisc-sir-workspace.md)