ReversingLabs integration with ServiceNow Security Incident Response streamlines and accelerates threat investigation workflows. Through this integration, ReversingLabs performs automatic enrichment of observables — file hashes, URLs, domains, and IP addresses. Each enriched observable is tagged with critical context such as the ReversingLabs verdict (malicious, suspicious, known, or unknown) and the associated threat name, enabling analysts to quickly prioritize and triage incidents without pivoting to external tools. Analysis results are also added as a note to each observable. Additionally, the integration supports automated analysis of suspicious files uploaded through ServiceNow's Upload Secure File Attachments feature, allowing files attached to security incidents to be submitted to ReversingLabs for deep inspection. This combination of real-time enrichment and file analysis ensures that security teams have high-fidelity, actionable intelligence embedded directly in their incident response workflow.

**Bring ReversingLabs Threat Intelligence Into Your SOC Workflow**

Security analysts working security incidents in ServiceNow SIR often encounter observables — file hashes, domains, IP addresses, URLs — with no context. Manually querying external threat intelligence platforms is time-consuming and breaks analyst flow.

The  **ReversingLabs SIR Integration**  closes that gap. It automatically enriches observables with threat intelligence from ReversingLabs Spectra Analyze the moment they are created, giving analysts immediate context without leaving ServiceNow.