--- sourceDocument: Australia Security Management sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Define Observed Data # Define Observed Data {#ariaid-title1} * Release version: Australia * * Updated March 12, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Conveys information about cyber security related entities such as files, systems, and networks using the STIX Cyber-observable Objects (SCOs). ## Before you begin Role required: sn_sec_tisc.analyst ## Procedure 1. Navigate to WorkspacesThreat Intelligence Security Center. 2. Click on Threat Intel Library icon on the workspace. 3. Go to Observed Data object. 4. Click New. Note: Whenever you create new object records for observables, indicators, entities or objects a source record is created and a prompt message is displayed that the new object record is created and then the user is redirected to the aggregated record. 5. On the form, fill in the fields. {#define-observed-data__table_h2f_q5q_myb__entry__2} | Field | Description | |-|-| | ID | Unique ID to identify the observed data. | | First Observed | The initial time when the data was seen. | | Last observed | The last time when the data was seen. | | Observed Count | The number of times that each Cyber-observable object was seen. The value must be an integer from 1 through 999,999,999. | | TLP | TLP is used to ensure that sensitive information is shared with the appropriate audience. It employs four colors (White, Green, Amber, and Red) to indicate different degrees of sensitivity. | | Confidence | Enter the confidence for the observed data | | Source | Specifies the threat source from which this object record is created. | | Revoked | Indicates that the revoked objects are no longer considered valid by the object creator. | [Table 1. Observed Data Details view] {#define-observed-data__table_h2f_q5q_myb} {#define-observed-data__table_xtw_tcd_nyb__entry__2} | Field | Description | |-|-| | Notes | Add any additional notes for this observed data. | [Table 2. Insights] {#define-observed-data__table_xtw_tcd_nyb} {#define-observed-data__table_ytw_tcd_nyb__entry__2} | Field | Description | |-|-| | Additional Context | Add any additional context for this observed data. | | Spec Version | The version of the STIX specification used to represent this object. The value of this property must be 2.1 for STIX Objects defined according to this specification. | | Lang | This property identifies the language of the text content in this object. | | Created | Specifies the date and time when the object is created in the source. | | Extensions | Indicates the extensions of attack pattern. | | Updated | Specifies the date and time when the object was updated in the source. | | Processing Status | Represents the processing status of this object, course of action. | [Table 3. Additional Information] {#define-observed-data__table_ytw_tcd_nyb} 6. Click Save. After you save, a prompt message is displayed indicating that A new observable record is created. Click Continue to edit the record and create new relationships. 7. Click Continue. Important: After you create a new observable record, Prevent System Updates check box is displayed. Select this check box to prevent any updates from the system after the observable or indicator or STIX objects records are created. {#define-observed-data__table_ztw_tcd_nyb__entry__2} | Field | Description | |-|-| | Tags || | Select Tags | Select the tags that are associated with the observed data. | | Add Tags | Add new tags. | | Taxonomies || | Select Taxonomy | Select a Taxonomy that is associated with this observed data. | | Add Taxonomy Values | Add Taxonomy values that are associated with this observed data. | [Table 4. Tags\&Taxonomies] {#define-observed-data__table_ztw_tcd_nyb} {#define-observed-data__steps_ybv_yrq_myb} ## What to do next Click any of the following related lists to view additional information about objects associated with the observed data.{#define-observed-data__table_b5w_tcd_nyb__entry__2} | Field | Description | |-|-| | External References | Lists the external references which refer to non-STIX information. This property is used to provide one or more external object identifiers. | | Indicators | Lists the related Indicators of Compromise (IoC) that have been identified by the threat source associated with this object. | | Infrastructure | Lists systems, software services, and any associated physical or virtual resources that are associated with this object. | | Marketing Definitions | Lists the marketing definitions associated with this object. | | Sightings | Lists the sightings associated with this object. | [Table 5. Related Records] {#define-observed-data__table_b5w_tcd_nyb} Note: 1. You can link and unlink the related records associated with this object. For more information, see [Link Threat Intel Related Records](https://servicenow-prod.fluidtopics.net/nf4MMSBnawUFJ~BXBWlsVw "Link the records that are related to the corresponding threat intelligence objects."). 2. The various SDOs within the TI library also contains the potential relationships. To establish a relationships between any two objects, you use the Potential Relationships link from the Threat Intel Library to confirm the relationships between the objects. For more information, see [Confirm object-object potential relationships](https://servicenow-prod.fluidtopics.net/0SsxnwCnaa2Zhb6iY_MDtA "Define the potential relationships between the objects."). 3. Also, use the Related Records section from the objects form view to confirm the relationships between two Objects using the Potential Relationships section available on the form view. For more information on see, [Confirm Potential Relationships from Related Records](https://servicenow-prod.fluidtopics.net/TQHhkN60eRr8MHck5BQqaw "Confirm the relationships between the two SDOs."). 4. You can add objects to cases. For more information, see [Add to Case](https://servicenow-prod.fluidtopics.net/A4MS4EYazp9wf3eJgI4hBA "Add observables, indicators, or other objects to the case."). {#define-observed-data__ol_pmd_bj3_pzb} *[\>]: and then