Define object-observable relationships

task australia Updated Sep 10, 2026 1 min read define-object-observable.md

Define relationships between SDOs and the observable object (SCO).

Before you begin

Role required: sn_ti.admin

Procedure

Navigate to All > Threat Intelligence > IoC Repository > Object-Observable-Relationships.
Click New.

Complete the fields in the form as appropriate.

Field	Description
Object	Select and define the source object.
Type	Enter a descriptive name to identify the object type.
Observable	Select and define the observable.
Relationship Type	A description that provides more details and context about the relationship type.
Source	Specifies the threat source from which this record is created.
Source ID	Uniquely identifies the source object.

Click Submit.

Parent Topic:Relationships

43 lines · 1.5 KB Wrap lines

---
title: Define object-observable relationships
description: Define relationships between SDOs and the observable object \(SCO\).
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/define-object-observable.html
release: australia
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Relationships, IoC Repository, Threat Intelligence, Enterprise security case management applications, Security Operations]
---

# Define object-observable relationships

Define relationships between SDOs and the observable object \(SCO\).

## Before you begin

Role required: sn\_ti.admin

## Procedure

1.  Navigate to **All** &gt; **Threat Intelligence** &gt; **IoC Repository** &gt; **Object-Observable-Relationships**.

2.  Click **New**.

3.  Complete the fields in the form as appropriate.

    |Field|Description|
    |-----|-----------|
    |**Object**|Select and define the source object.|
    |**Type**|Enter a descriptive name to identify the object type.|
    |**Observable**|Select and define the observable.|
    |**Relationship Type**|A description that provides more details and context about the relationship type.|
    |**Source**|Specifies the threat source from which this record is created.|
    |**Source ID**|Uniquely identifies the source object.|

4.  Click **Submit**.


**Parent Topic:**[Relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/stix-relationships.md)