When an incident is received on the Enforce server it is put into the database. Then the lookup plug-ins and/or scripts are run to populate custom attributes in the database.
Custom attributes can also be re-populated at any time by clicking on the Lookup option in the Attribute section of the Incident Snapshot screen. This action replaces the existing values that are stored in the custom attribute fields with the values returned by the new run of the lookup plug-ins or scripts. (Note that if the new lookup returns null or empty values for any custom attribute fields, those empty values overwrite the existing values.)
More information about Incident Persister stages can be found in the below article Incident Persister stages overview (broadcom.com).