Define malware analysis

---
title: Define malware analysis
description: Define malware analysis that captures the metadata and results of a particular static or dynamic analysis performed on a malware instance or family.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/define-malware-analysis.html
release: australia
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Malware analysis, IoC Repository, Threat Intelligence, Enterprise security case management applications, Security Operations]
---

# Define malware analysis

Define malware analysis that captures the metadata and results of a particular static or dynamic analysis performed on a malware instance or family.

## Before you begin

Role required: sn\_ti.admin

## Procedure

1.  Navigate to **All** > **Threat Intelligence** > **IoC Repository** > **Malware Analysis**.

2.  Click **New**.

3.  Complete the fields in the form as appropriate.

    |Field|Description|
    |-----|-----------|
    |**Name**|Enter a descriptive name to identify the intrusion set.|
    |**Analysis Engine Version**|The version of the analysis engine or product \(including AV engines\) that was used to perform the analysis.|
    |**Analysis Definition Version**|The version of the analysis definitions used by the analysis tool \(including AV tools\).|
    |**Analysis Started**|The date and time that the malware analysis was initiated.|
    |**Analysis Ended**|The date and time that the malware analysis was ended.|
    |**Source**|Specifies the threat source from which this record is created.|
    |**Source ID**|Unique identifier for this object in the threat source.|
    |**Result**|The classification result as determined by the scanner or tool analysis process.|
    |**Result Name**|The classification result or name assigned to the malware instance by the scanner tool.|
    |**Created Time in Source**|Specifies the time the object is created in the source.|
    |**Modified Time in Source**|Specifies the time the object is modified in the source.|

4.  Click **Submit**.


## What to do next

Click any of the following related lists to view additional information on the objects associated with malware analysis.

<table id="table_ntp_vtv_wmb"><thead><tr><th>

Related Links and Related Lists

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Show Relationships

</td><td>

Opens the STIX Visualizer where you can view the relationship of the STIX object.Show Relationships appears only when the object has an associated object.

</td></tr><tr><td>

External References

</td><td>

Lists external references which refer to non-STIX information. This property is used to provide one or more external object identifiers.

</td></tr><tr><td>

Associated Malware

</td><td>

Lists the associated malware identified with this object.

</td></tr><tr><td>

Reported Observables

</td><td>

Lists observables reported as part of this object.

</td></tr><tr><td>

Installed Software

</td><td>

Lists any non-standard software installed on the operating system used for the dynamic analysis of the malware instance or family.

</td></tr></tbody>
</table>**Parent Topic:**[Malware analysis](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-malware-analysis.md)