Identify observable sources

---
title: Identify observable sources
description: If an observable has no sources defined, it uses all types of sources. However, if you add one or more threat sources to an observable, it limits the sources used.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/t\_IdentifyObservbleSources.html
release: brazil
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Observables, IoC Repository, Threat Intelligence, Enterprise security case management applications, Security Operations]
---

# Identify observable sources

If an observable has no sources defined, it uses all types of sources. However, if you add one or more threat sources to an observable, it limits the sources used.

## Before you begin

Role required: sn\_ti.admin

## Procedure

1.  Navigate to **All** > **Threat Intelligence** > **IoC Repository** > **Observables**.

2.  Click the observable to which you want to add observable sources.

3.  Click the **Observable Sources** related list.

4.  Click **Edit**.

5.  As needed, use the filters to locate the source you want to associate with the observable.

6.  Using the slushbucket, add the observable source to the **Observable Sources** list.

7.  Click **Save**.


**Parent Topic:**[Observables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/c_Observables.md)

**Related topics**  


[Define an observable]()

[Add a related IoC to an observable]()

[Add associated tasks to an observable]()

[Add a related observable]()

[Load more IoC data]()

[Perform lookups on observables]()

[Perform threat enrichment on observables]()