Add to Case

---
title: Add to Case
description: Add observables, indicators, or other objects to the case.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/add-to-case.html
release: australia
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [add to case, observables to case, case objects]
breadcrumb: [Observables, TISC Library Repository, Threat Intel Library, Use, Threat Intelligence Security Center, Security Operations]
---

# Add to Case

Add observables, indicators, or other objects to the case.

## Before you begin

Role required: sn\_sec\_tisc.analyst

Following is the procedure that shows how to add a case to an observable record.

## Procedure

1.  Navigate to **Workspaces** > **Threat Intelligence Security Center** > **Threat Intel Library** > **Observables** > **All Observables**.

2.  Select the observable\(s\).

3.  Click **Add to Case** button.

    This displays only the cases where the record is not already associated.

    \[Omitted image "tisc-add-to-case-steps.png"\] Alt text: Add to Case

4.  Verify if you want to add the record to the existing cases and if so select the exiting case otherwise click **Create New Case**.

    Create a new case by entering the following information.

<table id="table_ubx_bh5_tzb"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Case ID

</td><td>

A unique identifier for the case. This is system generated ID.

</td></tr><tr><td>

Short Description

</td><td>

Summary of the request or issue that is being investigated or a short description.

</td></tr><tr><td>

Case Type

</td><td>

Select the type of case being investigated. The possible options for the investigation are:

 -   Threat Hunting
-   Request for Information
-   Vulnerability Management Case
-   Compliance Case
-   Incident Response Case
-   Collaboration Case
-   Others


</td></tr><tr><td>

Priority

</td><td>

An assessment of the severity of the request or issue.

</td></tr><tr><td>

Assignment Group

</td><td>

The assigned group responsible for working on the case.

</td></tr><tr><td>

Assigned to

</td><td>

The Analyst who is responsible for working on a case.

</td></tr></tbody>
</table>5.  Click **Create** if you are creating a new case.

    **Note:** The new case is added to the existing case list.

6.  Select the newly added case\(s\).

7.  Click **Add**.

    An information message is displayed that the selected records are added to case\(s\) successfully.


**Parent Topic:**[Observables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/observables.md)