Define indicator-observable relationships

  • Freigeben Version: Australia
  • Aktualisiert 12. März 2026
  • 1 Minute Lesedauer
  • Define relationships between the indicator object and other SDOs.

    Vorbereitungen

    Role required: sn_sec_tisc.analyst

    Prozedur

    1. Navigate to Workspaces > Threat Intelligence Security Center.
    2. Click on Threat Intel Library icon on the workspace.
    3. Go to Relationships > Indicator-Observable.
    4. Click New.
    5. Complete the fields in the form as appropriate.
      FieldDescription
      Observable Select and define the observable.
      Indicator Select and define the indicator object.
    6. Click Submit.