---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/pt-BR/security-management

 Release :

    - australia

ft:locale :

    - pt-BR

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# IoCs and observables in cases

# IoCs and observables in cases {#ariaid-title1}

* Versão de lançamento: Australia
* 
* Atualizado 12 de mar. de 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 min. de leitura

In Threat Intelligence, you can
create cases from IoCs and observables, as well as add IoCs and observables to existing cases. You
can also create observables directly from a case.
* **[Create a case from IoCs or observables](https://servicenow-prod.fluidtopics.net/608IAfJqFEgHlfMZSdzVNA)**   
  In Threat Intelligence, you can create a case from artifacts (IoCs or observables). After the IoCs or observables have been used to create a case, you can use Security Case Management to analyze the data.
* **[Add IoCs and observables to an existing case](https://servicenow-prod.fluidtopics.net/6zDtK9u~ZNSdbtFt8RJP_g)**   
  You can add IoCs and observables to existing cases. After the security incidents have been added to cases, you can use Security Case Management to analyze the data.
* **[Create an observable from a case](https://servicenow-prod.fluidtopics.net/tpPW6TuaL_f1rdNu2n1INA)**   
  New observables can be created from cases in Security Case Management.
* **[Run a sightings search on observables in a case](https://servicenow-prod.fluidtopics.net/vS47LdRxa6WgUpIZsMCpGQ)**   
  You can search for observables using the Sighting Search feature to determine how often they occur. Each occurrence is considered a sighting. You can limit the search to the number of sightings within a selected number of days or within a date range.

**Conceitos relacionados**   

* [Security incidents in cases](https://servicenow-prod.fluidtopics.net/Zfap2dy4fL1vzzmTNLrWlw "In Security Incident Response, you can create cases from security incidents, CIs, and affected users, as well as add those artifacts to existing cases.")
* [Configuration items in cases](https://servicenow-prod.fluidtopics.net/M92V2ILIbpljG6V6Tm9NJw "You can create a new case from one or more configuration items (CI) in the Configuration Item [cmdb_ci] table. You can also add CIs to existing cases.")
* [Affected users in cases](https://servicenow-prod.fluidtopics.net/6yStT90dhAABjXzyS7X4yA "You can create a new case from one or more affected users in the User [sys_user] table. You can also add users to existing cases.")