Map the Microsoft Defender for Endpoint indicator types

---
title: Map the Microsoft Defender for Endpoint indicator types
description: Map the ServiceNow Observable type with the Microsoft Defender for Endpoint indicator type. This mapping would be used in Observable Enrichment and Create Indicator actions in Microsoft Defender.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/map-the-ms-defender-for-endpoint-indicator-types.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Microsoft Defender for Endpoint integration, Security Incident Response integrations, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Map the Microsoft Defender for Endpoint indicator types

Map the ServiceNow Observable type with the Microsoft Defender for Endpoint indicator type. This mapping would be used in Observable Enrichment and Create Indicator actions in Microsoft Defender.

## Before you begin

Role required: sn\_si.admin or sn\_si.analyst \(read-only\)

## About this task

In a scenario where the observable type is not mapped to an indicator type, such observables are not eligible for Observable enrichment and indicator creation in Microsoft Defender for Endpoint.

## Procedure

1.  Navigate to **Microsoft Defender for Endpoint** > **Observable-Indicator Mapping**.

    \[Omitted image "observable\_indicator\_mapping.png"\] Alt text: Map the Microsoft Defender for Endpoint indicator types

2.  Add or update an Observable type in one of the following ways:

    -   To add new mapping, click **Add Observable Type**.
    -   To update the Observable to the Indicator type mapping, click any existing row.
3.  To save the mapping, click **Update**.