---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# IoCs and observables in cases

# IoCs and observables in cases {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

In Threat Intelligence, you can
create cases from IoCs and observables, as well as add IoCs and observables to existing cases. You
can also create observables directly from a case.
* **[Create a case from IoCs or observables](https://servicenow-prod.fluidtopics.net/Wg2HQ5CJenZRoqL4hcuatQ)**   
  In Threat Intelligence, you can create a case from artifacts (IoCs or observables). After the IoCs or observables have been used to create a case, you can use Security Case Management to analyze the data.
* **[Add IoCs and observables to an existing case](https://servicenow-prod.fluidtopics.net/k7LgOZHvnOw7b_J1FA4pwg)**   
  You can add IoCs and observables to existing cases. After the security incidents have been added to cases, you can use Security Case Management to analyze the data.
* **[Create an observable from a case](https://servicenow-prod.fluidtopics.net/f2cLAaQu5BMnyeTaoZBuvw)**   
  New observables can be created from cases in Security Case Management.
* **[Run a sightings search on observables in a case](https://servicenow-prod.fluidtopics.net/XvGr49U2CMh76ejxomO4Mw)**   
  You can search for observables using the Sighting Search feature to determine how often they occur. Each occurrence is considered a sighting. You can limit the search to the number of sightings within a selected number of days or within a date range.

**Related concepts**   

* [Security incidents in cases](https://servicenow-prod.fluidtopics.net/XBtNos2KOnm8izozfspq6A "In Security Incident Response, you can create cases from security incidents, CIs, and affected users, as well as add those artifacts to existing cases.")
* [Configuration items in cases](https://servicenow-prod.fluidtopics.net/UbIFNlTe7tYZHzdZ701NIA "You can create a new case from one or more configuration items (CI) in the Configuration Item [cmdb_ci] table. You can also add CIs to existing cases.")
* [Affected users in cases](https://servicenow-prod.fluidtopics.net/h53gCYmkyckEDUd9uuMb3A "You can create a new case from one or more affected users in the User [sys_user] table. You can also add users to existing cases.")