Share observables from a security incident

task australia Updated Nov 6, 2026 1 min read share-observable.md

Raw file servicenow.com

Observables can be shared from a security incident in Security Incident Response to members in your trusted circle.

Before you begin

Role required: sn_si.analyst

Procedure

Navigate to a security incident.
Select the Observables tab from Show IoC Related List group.
Select an observable.
On the Observable form, select the Share observable related link.

The Observable Share dialog box appears.
Enter a Name for this threat share record.
Enter a Description of the selected observables.
Choose Circles to share the observables with.
Select Submit.

The observable(s) are shared with the specified Trusted Circle.
You can view the threat share records by selecting the Threat shares tab.
If any of the shared observables contain sightings, the sightings are also shared and can be viewed by selecting the Sightings tab.

Parent Topic:View Sightings Search Results

50 lines · 1.8 KB Wrap lines

---
title: Share observables from a security incident
description: Observables can be shared from a security incident in Security Incident Response to members in your trusted circle.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/share-observable.html
release: australia
topic_type: task
last_updated: "2026-11-06"
reading_time_minutes: 1
breadcrumb: [View Sightings Search Results, Create sightings search configuration records, Security Operations Integration- Sightings Search capability, Integration capabilities, Security Operations Integration Reference, Security Operations common functionality, Security Operations]
---

# Share observables from a security incident

Observables can be shared from a security incident in Security Incident Response to members in your trusted circle.

## Before you begin

Role required: sn\_si.analyst

## Procedure

1. Navigate to a security incident.

2. Select the **Observables** tab from **Show IoC** Related List group.

3. Select an observable.

4. On the **Observable** form, select the **Share observable** related link.

The Observable Share dialog box appears.

5. Enter a **Name** for this threat share record.

6. Enter a **Description** of the selected observables.

7. Choose **Circles** to share the observables with.

8. Select **Submit**.

The observable\(s\) are shared with the specified Trusted Circle.

9. You can view the threat share records by selecting the **Threat shares** tab.

10. If any of the shared observables contain sightings, the sightings are also shared and can be viewed by selecting the **Sightings** tab.

**Parent Topic:**[View Sightings Search Results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/view-sightings-search-results.md)