Define observable-observable relationships

task australia Updated Sep 10, 2026 1 min read define-observable-observable.md

Define relationships between observables.

Before you begin

Role required: sn_sec_tisc.analyst

Procedure

Navigate to Workspaces > Threat Intelligence Security Center.
Click on Threat Intel Library icon on the workspace.
Go to Relationships > Observable-Observable.
Click New.
Complete the fields in the form as appropriate.

Field	Description
Source Observable	Select and define the source object.
Target Observable	Select and define the target object.
Relationship Type	A description that provides more details and context about the relationship type. The available options are:Define the relationship direction whether it is direct or inverse. Inverse - This is the type of relationship between the observable and object. Direct - This is the type of relationship between the object and observable.
Basis For Correlation	Name of the correlation rule based on which the system has identified as the related records of that observable. This rule is auto populated.

6. Click **Submit**.

Parent Topic:Relationships Objects

Keywords observable-observable relationshipsdefine relationships

86 lines · 2.3 KB Wrap lines

---
title: Define observable-observable relationships
description: Define relationships between observables.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/define-observable-observable.html
release: australia
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [observable-observable relationships, define relationships]
breadcrumb: [Relationships Objects, TISC Library Repository, Threat Intel Library, Use, Threat Intelligence Security Center, Security Operations]
---

# Define observable-observable relationships

Define relationships between observables.

## Before you begin

Role required: sn\_sec\_tisc.analyst

## Procedure

1.  Navigate to **Workspaces** &gt; **Threat Intelligence Security Center**.

2.  Click on **Threat Intel Library** icon on the workspace.

3.  Go to **Relationships** &gt; **Observable-Observable**.

4.  Click **New**.

5.  Complete the fields in the form as appropriate.

<table id="choicetable_sq4_yvf_wmb"><thead><tr><th align="left" id="d397235e107">

Field

</th><th align="left" id="d397235e110">

Description

</th></tr></thead><tbody><tr><td id="d397235e116">

**Source Observable**

</td><td>

Select and define the source object.

</td></tr><tr><td id="d397235e125">

**Target Observable**

</td><td>

Select and define the target object.

</td></tr><tr><td id="d397235e134">

**Relationship Type**

</td><td>

A description that provides more details and context about the relationship type. The available options are:Define the relationship direction whether it is direct or inverse.

-   Inverse - This is the type of relationship between the observable and object.
-   Direct - This is the type of relationship between the object and observable.


</td></tr><tr><td id="d397235e153">

**Basis For Correlation**

</td><td>

Name of the correlation rule based on which the system has identified as the related records of that observable. This rule is auto populated.

</td></tr></tbody>
</table>6.  Click **Submit**.


**Parent Topic:**[Relationships Objects](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/relationship-objects.md)