---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Identify indicator sources

# Identify indicator sources {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Indicator sources are normally tracked automatically as part of the threat import
process, but more sources can be manually added.

## Before you begin

Role required: sn_ti.write

## Procedure

1. Navigate to AllThreat IntelligenceIoC RepositoryIndicators.
2. Click the indicator to which you want to add indicator sources.
3. Click the Indicator Sources related list.
4. Click Edit.
5. As needed, use the filters to locate the indicator source you want to associate with the IoC.
6. Using the slushbucket, add the indicator source to the Indicator Sources list.
7. Click Save.
{#t_IdentifyIndicatorSources__steps_kdz_krt_gv}
**Related tasks**   

* [View an IoC](https://servicenow-prod.fluidtopics.net/~ASRrR0edM07oQ3MI4sOtw "IoCs, sometimes referred to as indicators, are most typically retrieved from a threat data source as STIX data. If needed, you can also create IoCs.")
* [Add a related observable to an IoC](https://servicenow-prod.fluidtopics.net/w_0XCjdjEV0QPH711n0k7A "In addition to importing observables as STIX data, you can add related observables to an IoC manually.")
* [Add a related attack mode/method to an IoC](https://servicenow-prod.fluidtopics.net/71yN6_imDcaKJra0hbuZzg "In addition to importing related attack modes/methods as STIX data, you can add related attack modes/methods to an IoC manually.")
* [Identify associated indicator types](https://servicenow-prod.fluidtopics.net/j7jI7NXQ5rkkVjy1BU_RQQ "If an IoC has no associated indicator types defined, it tracks all types of observables. However, if you associate one or more types of indicators to an IoC, it limits the types of observables that can be associated with the IoC.")
* [Add associated tasks to an IoC](https://servicenow-prod.fluidtopics.net/aTdxtr6vXl9OPurAvip5Kw "In addition to importing associated tasks (such as changes and incidents) as STIX data, you can add them to an IoC manually.")

*[\>]: and then