Create indicators
Create and manage threat indicators that synchronize directly with CrowdStrike Falcon Insight, enabling consistent, up‑to‑date threat intelligence across your security environment.
Before you begin
Role required: sn_si.analyst
Procedure
-
Navigate to Security Incidents > Show All Incidents.
-
Select the security incident that contains the observables for which you want to create indicators in CrowdStrike Falcon Insight.
-
Select Associated Observables related lists.
-
Select the observables.
-
From the Actions on selected rows, select Create Indicator in CrowdStrike.
-
On the form, fill in the fields.
|
Field |
Description |
|---|---|
|
Selected Observables |
Observables that are affected. This action can be used to create indicators for multiple observables.Note: Indicators won't be created in CrowdStrike if the supported observable types are not mapped. Supported observable types include:
|
|
Source |
Integration profile configuration used to create the indicator. |
|
Description |
Purpose of the indicator. |
|
Platforms |
Platforms where this indicator applies. Options include:- Windows
|
|
Action |
Actions to be performed when the Indicator is discovered in the organization. Options include:- Detect
|
|
Mobile Action |
Action applied on supported mobile platforms. Options include:- Detect
|
|
Severity |
Severity assigned to the Indicator. Options include:- Low
|
|
Expiration |
Date and time when the indicator will automatically expire |
|
Tags |
Custom label to categorize/group indicators. |
|
Apply Globally |
Option to apply indicator to all the hosts.When cleared, the configuration applies only to selected host groups. |
|
Host Groups |
Specify which CrowdStrike host groups should receive this configuration. |
-
Validate the activity and UI messages.
-
Select CrowdStrike Indicator tab to view the results.
--- title: Create indicators description: Create and manage threat indicators that synchronize directly with CrowdStrike Falcon Insight, enabling consistent, up‑to‑date threat intelligence across your security environment. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/create-indicator-cs-falcon-insight.html release: australia product: Security Incident Response classification: security-incident-response topic_type: task last_updated: "2026-09-10" reading_time_minutes: 1 breadcrumb: [CrowdStrike Falcon Insight integration, Security Incident Response integrations, Security Incident Response, Enterprise security case management applications, Security Operations] --- # Create indicators Create and manage threat indicators that synchronize directly with CrowdStrike Falcon Insight, enabling consistent, up‑to‑date threat intelligence across your security environment. ## Before you begin Role required: sn\_si.analyst ## Procedure 1. Navigate to **Security Incidents** > **Show All Incidents**. 2. Select the security incident that contains the observables for which you want to create indicators in CrowdStrike Falcon Insight. 3. Select **Associated Observables** related lists. 4. Select the observables. 5. From the **Actions** on selected rows, select **Create Indicator in CrowdStrike**. 6. On the form, fill in the fields. <table id="table_z2k_d5w_3sb"><thead><tr><th> Field </th><th> Description </th></tr></thead><tbody><tr><td> Selected Observables </td><td> Observables that are affected. This action can be used to create indicators for multiple observables.**Note:** Indicators won't be created in CrowdStrike if the supported observable types are not mapped. Supported observable types include: - **Domain** - **MD5** - **SHA-256** - **IPv4** - **IPv6** </td></tr><tr><td> Source </td><td> Integration profile configuration used to create the indicator. </td></tr><tr><td> Description </td><td> Purpose of the indicator. </td></tr><tr><td> Platforms </td><td> Platforms where this indicator applies. Options include:- **Windows** - **Mac** - **Linux** - **Android** - **iOS** </td></tr><tr><td> Action </td><td> Actions to be performed when the Indicator is discovered in the organization. Options include:- **Detect** - **Prevent \(hash only\)** - **Prevent \(hidden UI\) \(hash only\)** - **Allow \(hash only\)** - **No Action** </td></tr><tr><td> Mobile Action </td><td> Action applied on supported mobile platforms. Options include:- **Detect** - **Prevent \(hash only\)** - **Allow \(hash only\)** - **No Action** </td></tr><tr><td> Severity </td><td> Severity assigned to the Indicator. Options include:- **Low** - **Medium** - **High** - **Critical** </td></tr><tr><td> Expiration </td><td> Date and time when the indicator will automatically expire </td></tr><tr><td> Tags </td><td> Custom label to categorize/group indicators. </td></tr><tr><td> Apply Globally </td><td> Option to apply indicator to all the hosts.When cleared, the configuration applies only to selected host groups. </td></tr><tr><td> Host Groups </td><td> Specify which CrowdStrike host groups should receive this configuration. </td></tr></tbody> </table>7. Select **Create Indicator** 8. Validate the activity and UI messages. 9. Select **CrowdStrike Indicator** tab to view the results.
| title | Create indicators |
| description | Create and manage threat indicators that synchronize directly with CrowdStrike Falcon Insight, enabling consistent, up‑to‑date threat intelligence across your security environment. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/create-indicator-cs-falcon-insight.html |
| release | australia |
| product | Security Incident Response |
| classification | security-incident-response |
| topic_type | task |
| last_updated | 2026-09-10 |
| reading_time_minutes | 1 |
| breadcrumb | CrowdStrike Falcon Insight integrationSecurity Incident Response integrationsSecurity Incident ResponseEnterprise security case management applicationsSecurity Operations |