Define indicator-observable relationships

  • Versão de lançamento: Australia
  • Atualizado 12 de mar. de 2026
  • 1 min. de leitura
  • Define relationships between the indicator object and other SDOs.

    Antes de Iniciar

    Role required: sn_sec_tisc.analyst

    Procedimento

    1. Navigate to Workspaces > Threat Intelligence Security Center.
    2. Click on Threat Intel Library icon on the workspace.
    3. Go to Relationships > Indicator-Observable.
    4. Click New.
    5. Complete the fields in the form as appropriate.
      FieldDescription
      Observable Select and define the observable.
      Indicator Select and define the indicator object.
    6. Click Submit.