---
sourceDocument: Yokohama Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/security-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Confirm indicator-indicator potential relationships

# Confirm indicator-indicator potential relationships {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Define the potential relationships between the objects.

## Before you begin

Role required: sn_sec_tisc.analyst

## Procedure

1. Navigate to WorkspacesThreat Intelligence Security Center.
2. Click on Threat Intel Library icon on the workspace.
3. Go to Potential Relationshipsindicator-indicator.
4. Select the observable record.
5. Click Confirm Relation.  
   A Potential relationship record is ideally confirmed based on automated correlation rules. Once you confirm the relationship, then the observables record will move to the Relationships section which means that the relation between the observables to observables is confirmed.

   The record shows a confirmed relation only when the correlation rules are matched. For example, a potential relationship is confirmed when two observables
   of type URLs has the same domain name.

   Alternatively, you can also create new observables record by linking the observables from the list of observables and confirm the relationships from the related records
   tab of each observable.
   1. Open any Observable record.
   2. Go to Related Records tab.
   3. Click the Link button.
   4. Select one or more observable(s).
   5. Click Link.  
      This will create a new relationship between the selected observable record and the newly linked observables.
   {#define-indicator-indicator-potential-relationships__substeps_btv_cfd_nzb}
6. Click Delete to delete the relationships.
{#define-indicator-indicator-potential-relationships__steps_wdq_3sc_nzb}

*[\>]: and then