Define threat opinions

task brazil Updated Sep 10, 2026 1 min read define-threat-opinions.md
Raw file servicenow.com

Define threat opinions as an assessment of the accuracy of the information in a STIX object.

Before you begin

Role required: sn_ti.admin

Procedure

  1. Navigate to All > Threat Intelligence > IoC Repository > Threat Opinions.

  2. Click New.

  3. Complete the fields in the form as appropriate.

    Field Description
    Opinion The producer's opinion about the STIX object.
    Explanation The producer's explanation about the opinion.
    Authors Specifies the name of the author (example, an analyst).
    Source Specifies the threat source from which this record is created.
    Source ID Unique identifier for this object in the threat source.
    Created Time in Source Specifies the time the object is created in the source.
    Modified Time in Source Specifies the time the object is modified in the source.
  4. Click Submit.

What to do next

Click any of the following related lists to view additional information about objects associated with the threat opinion.

Related Links and Related Lists

Description

Show Relationships

Opens the STIX Visualizer where you can view the relationship of the STIX object.Show Relationships appears only when the object has an associated object.

Associated Objects

List of objects the threat opinion applies to.

Associated Indicators

List of indicators the threat opinion applies to.

Associated Observables

Lists observables associated with this object.

**Parent Topic:**[Threat opinions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-opinions.md)
Search documentation
Search document titles and file paths on the brazil branch