Add an IoC to an attack mode/method

---
title: Add an IoC to an attack mode/method
description: In addition to importing indicators as STIX data, you can add IoCs to an attack mode/method manually.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/t\_AddIoCToAttackMode.html
release: australia
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Attack modes and methods, IoC Repository, Threat Intelligence, Enterprise security case management applications, Security Operations]
---

# Add an IoC to an attack mode/method

In addition to importing indicators as STIX data, you can add IoCs to an attack mode/method manually.

## Before you begin

Role required: sn\_ti.admin

## Procedure

1.  Navigate to **All** > **Threat Intelligence** > **IoC Repository** > **Attack Mode/Method**.

2.  Click the attack mode to which you want to add an IoC.

3.  Click the **Related Indicators** related list.

4.  Click **Edit**.

5.  As needed, use the filters to locate the IoC you want to add.

6.  Using the slushbucket, add the IoC to the **Related Indicators** list.

7.  Click **Save**.


**Parent Topic:**[Attack modes and methods](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/c_AttackModeMethod.md)

**Related topics**  


[Define an attack mode/method]()

[Add a related attack mode method]()

[Add associated task to an attack mode/method]()