Indicators

---
title: Indicators
description: Indicators are artifacts observed on a network or operating system that are likely to indicate an intrusion. Typical IoCs are virus signatures and IP addresses, MD5 hashes of malware files or URLs, or domain names.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/threat-intelligence-security-center/indicator.html
release: brazil
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [indicator, IOC, indicator of compromise, STIX indicator]
breadcrumb: [TISC Library Repository, Threat Intel Library, Use, Threat Intelligence Security Center, Security Operations]
---

# Indicators

Indicators are artifacts observed on a network or operating system that are likely to indicate an intrusion. Typical IoCs are virus signatures and IP addresses, MD5 hashes of malware files or URLs, or domain names.

-   **[Define an Indicator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intelligence-security-center/define-an-indicator.md)**  
Define an Indicator.
-   **[Observable extraction from indicator patterns](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intelligence-security-center/tisc-extract-observables-from-indicators.md)**  
Threat Intelligence Security Center extracts observables from indicators that use the STIX pattern type and links the extracted observables back to the source indicator.

**Parent Topic:**[TISC Library Repository](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intelligence-security-center/tisc-ioc.md)

**Related topics**  


[Observables]()

[Threat Entities]()

[Other Objects]()

[Vulnerability Artifacts]()

[View RSS Feeds]()

[Working with Reports in TISC]()

[MITRE-ATT&CK repository]()

[Relationships Objects]()

[Potential Relationships]()

[Vulnerability relationship mapping]()