Confirm observable-observable potential relationship

task brazil Updated Sep 10, 2026 1 min read define-observable-observable-potential-relationship.md

Raw file servicenow.com

Use this section to confirm the relationships between the observables.

Before you begin

Role required: sn_sec_tisc.analyst

Procedure

Navigate to Workspaces > Threat Intelligence Security Center.
Click on Threat Intel Library icon on the workspace.
Go to Potential Relationships > Observable-Observable.
Select the observable(s) record.
Click Confirm Relation.

A Potential relationship record is ideally created which is identified based on its correlation rules. Once you confirm the relationship, then the observables record will move to the Relationships section which means that the relation between the observables to observables is confirmed. The record shows a confirmed relation only when the correlation rules are matched. For example, a potential relationship can be created when two observables of type URLs has same domain name.

Alternatively, you can also create new observables record by linking the observables from the list of observables and confirm the relationships from the related records tab of each observable.
1. Open any Observable record.
2. Go to Related Records tab.
3. Click the Link button.
4. Select one or more observable(s).
5. Click Link.
  
  This will create a new relationship between the selected observable record and the newly linked observables.
Click Delete to delete the relationships.

Parent Topic:Potential Relationships

Keywords observable-observable potential relationshipconfirm relationships

57 lines · 2.4 KB Wrap lines

---
title: Confirm observable-observable potential relationship
description: Use this section to confirm the relationships between the observables.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/threat-intelligence-security-center/define-observable-observable-potential-relationship.html
release: brazil
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [observable-observable potential relationship, confirm relationships]
breadcrumb: [Potential Relationships, TISC Library Repository, Threat Intel Library, Use, Threat Intelligence Security Center, Security Operations]
---

# Confirm observable-observable potential relationship

Use this section to confirm the relationships between the observables.

## Before you begin

Role required: sn\_sec\_tisc.analyst

## Procedure

1. Navigate to **Workspaces** &gt; **Threat Intelligence Security Center**.

2. Click on **Threat Intel Library** icon on the workspace.

3. Go to **Potential Relationships** &gt; **Observable-Observable**.

4. Select the observable\(s\) record.

5. Click **Confirm Relation**.

A Potential relationship record is ideally created which is identified based on its correlation rules. Once you confirm the relationship, then the observables record will move to the Relationships section which means that the relation between the observables to observables is confirmed. The record shows a confirmed relation only when the correlation rules are matched. For example, a potential relationship can be created when two observables of type URLs has same domain name.

Alternatively, you can also create new observables record by linking the observables from the list of observables and confirm the relationships from the related records tab of each observable.

1. Open any Observable record.

2. Go to **Related Records** tab.

3. Click the **Link** button.

4. Select one or more observable\(s\).

5. Click **Link**.

This will create a new relationship between the selected observable record and the newly linked observables.

6. Click **Delete** to delete the relationships.

**Parent Topic:**[Potential Relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intelligence-security-center/potential-relationships.md)