Annotate security artifacts
As you are analyzing a case, you can add annotations to any artifact.
Before you begin
The Threat Intelligence plugin must be activated to use Security Case Management.
Role required:
- sn_ti.case_user_write for adding annotations
- sn_ti.case_user_read to view annotations
Procedure
-
Open a case that contains artifacts that you want to annotate.
-
Click the Case Artifacts related list.
-
Click the tab associated with the artifacts you want to annotate.
For example, click Indicators of Compromise to add annotations to IoCs.
-
To add an annotation to one or more artifacts, perform the following steps:
-
Select the artifacts to which you want to add an annotation.
-
Click Annotate.
[Omitted image "annotations.png"] Alt text: Add an annotation
-
Type the annotation and click Annotate.
The annotation is added to the selected artifacts.
-
-
To view annotations for an artifact, click the View annotations ([Omitted image "annotation-icon.png"] Alt text: View Annotations) icon.
The existing annotations appear in the Annotations dialog box.
[Omitted image "annotations-dialog.png"] Alt text: Annotations dialog box
-
You can also enter a new annotation for the artifact in the Security Annotation box, and click Annotate.
Parent Topic:Security artifact analysis
Related topics
Related details for case artifacts
---
title: Annotate security artifacts
description: As you are analyzing a case, you can add annotations to any artifact.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/annotate-artifacts.html
release: australia
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Security artifact analysis, Security Case Management, Threat Intelligence, Enterprise security case management applications, Security Operations]
---
# Annotate security artifacts
As you are analyzing a case, you can add annotations to any artifact.
## Before you begin
The Threat Intelligence plugin must be activated to use Security Case Management.
Role required:
- sn\_ti.case\_user\_write for adding annotations
- sn\_ti.case\_user\_read to view annotations
## Procedure
1. Open a case that contains artifacts that you want to annotate.
2. Click the **Case Artifacts** related list.
3. Click the tab associated with the artifacts you want to annotate.
For example, click **Indicators of Compromise** to add annotations to IoCs.
4. To add an annotation to one or more artifacts, perform the following steps:
1. Select the artifacts to which you want to add an annotation.
2. Click **Annotate**.
\[Omitted image "annotations.png"\] Alt text: Add an annotation
3. Type the annotation and click **Annotate**.
The annotation is added to the selected artifacts.
5. To view annotations for an artifact, click the View annotations \(\[Omitted image "annotation-icon.png"\] Alt text: View Annotations\) icon.
The existing annotations appear in the Annotations dialog box.
\[Omitted image "annotations-dialog.png"\] Alt text: Annotations dialog box
6. You can also enter a new annotation for the artifact in the **Security Annotation** box, and click **Annotate**.
**Parent Topic:**[Security artifact analysis](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/sec-artifact-analysis.md)
**Related topics**
[Related details for case artifacts]()
[Security artifact exclusion and inclusion]()
[Search for security artifacts]()
| title | Annotate security artifacts |
| description | As you are analyzing a case, you can add annotations to any artifact. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/security-management/annotate-artifacts.html |
| release | australia |
| topic_type | task |
| last_updated | 2026-09-10 |
| reading_time_minutes | 1 |
| breadcrumb | Security artifact analysisSecurity Case ManagementThreat IntelligenceEnterprise security case management applicationsSecurity Operations |