Define object-indicator relationships

---
title: Define object-indicator relationships
description: Define relationships between the indicator object and other SDOs.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/define-object-indicator.html
release: australia
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Relationships, IoC Repository, Threat Intelligence, Enterprise security case management applications, Security Operations]
---

# Define object-indicator relationships

Define relationships between the indicator object and other SDOs.

## Before you begin

Role required: sn\_ti.admin

## Procedure

1.  Navigate to **All** > **Threat Intelligence** > **IoC Repository** > **Object-Indicator-Relationships**.

2.  Click **New**.

3.  Complete the fields in the form as appropriate.

    |Field|Description|
    |-----|-----------|
    |**Object**|Select and define the object.|
    |**Type**|Specifies the object type based on the object you selected.|
    |**Indicator**|Select the indicators of compromise.|
    |**Relationship Direction**|Define the relationship direction whether it is direct or inverse.|
    |**Relationship Type**|A description that provides more details and context about the relationship type.|
    |**Source**|Specifies the threat source from which this record is created.|
    |**Source ID**|Uniquely identifies the source object.|

4.  Click **Submit**.


**Parent Topic:**[Relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/stix-relationships.md)