Define object-indicator relationships

task brazil Updated Sep 10, 2026 1 min read define-object-indicator-relationships.md

Define relationships between the indicator object and other SDOs.

Before you begin

Role required: sn_sec_tisc.analyst

Procedure

Navigate to Workspaces > Threat Intelligence Security Center.
Click on Threat Intel Library icon on the workspace.
Go to Relationships > Object-Indicator.
Click New.
Complete the fields in the form as appropriate.

Field	Description
Indicator	Select and define the indicator.
Object	Select and define the object.
Relationship Type	A description that provides more details and context about the relationship type. Define the relationship direction whether it is direct or inverse. Inverse - This is the type of relationship between the observable and object. Direct - This is the type of relationship between the object and observable.
Start Time	Specifies the time when the relationship is created.
Stop Time	Specifies the time when the relationship is stopped or removed.
Description	A brief description about the object relationships.

6. Click **Submit**.

Parent Topic:Relationships Objects

Keywords object-indicator relationshipsSDO relationshipsdefine relationships

102 lines · 2.4 KB Wrap lines

---
title: Define object-indicator relationships
description: Define relationships between the indicator object and other SDOs.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/threat-intelligence-security-center/define-object-indicator-relationships.html
release: brazil
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [object-indicator relationships, SDO relationships, define relationships]
breadcrumb: [Relationships Objects, TISC Library Repository, Threat Intel Library, Use, Threat Intelligence Security Center, Security Operations]
---

# Define object-indicator relationships

Define relationships between the indicator object and other SDOs.

## Before you begin

Role required: sn\_sec\_tisc.analyst

## Procedure

1.  Navigate to **Workspaces** &gt; **Threat Intelligence Security Center**.

2.  Click on **Threat Intel Library** icon on the workspace.

3.  Go to **Relationships** &gt; **Object-Indicator**.

4.  Click **New**.

5.  Complete the fields in the form as appropriate.

<table id="choicetable_uvs_2cc_nzb"><thead><tr><th align="left" id="d396718e110">

Field

</th><th align="left" id="d396718e113">

Description

</th></tr></thead><tbody><tr><td id="d396718e119">

**Indicator**

</td><td>

Select and define the indicator.

</td></tr><tr><td id="d396718e128">

**Object**

</td><td>

Select and define the object.

</td></tr><tr><td id="d396718e137">

**Relationship Type**

</td><td>

A description that provides more details and context about the relationship type. Define the relationship direction whether it is direct or inverse.

-   Inverse - This is the type of relationship between the observable and object.
-   Direct - This is the type of relationship between the object and observable.


</td></tr><tr><td id="d396718e156">

**Start Time**

</td><td>

Specifies the time when the relationship is created.

</td></tr><tr><td id="d396718e166">

**Stop Time**

</td><td>

Specifies the time when the relationship is stopped or removed.

</td></tr><tr><td id="d396718e175">

**Description**

</td><td>

A brief description about the object relationships.

</td></tr></tbody>
</table>6.  Click **Submit**.


**Parent Topic:**[Relationships Objects](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intelligence-security-center/relationship-objects.md)