---
sourceDocument: Yokohama Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/security-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Observables

# Observables {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Observables represent stateful properties (such as the MD5 hash of a file or the value of a registry key) or measurable events (such as the creation of a registry key or the deletion of a file) that are pertinent to the
operation of computers and networks.  
Following are the type of observables available in the application:

* Artifact
* AS Number
* Directory
* Domain Name
* Email Address
* Email Message
* Email Subject
* File
* IPv4 Address
* IPv4 CIDR
* IPv6 Address
* IPv6 CIDR
* MAC Address
* MD5 Hash
* Mutex Name
* Network
* Other Observable
* Process
* SHA1 Hash
* SHA256 Hash
* SHA512 Hash
* Software
* URL
* User Account
* Windows Registry Key
* X.509 Certificate
{#observables__ul_hlc_xmz_31c}
* **[Define an Observable](https://www.servicenow.com/docs/oE9YfAgkKIQqklpItkOGYw)**   
  Observables can be retrieved from scheduled feed ingestion or from the import assistant. However, you can create observables, as needed.
* **[Observables source records](https://www.servicenow.com/docs/4CFJtoP0GU_32tBZpE52Cw)**   
  The source records contribute to an aggregated record as displayed in the form view. These source records are auto created from feeds or manually created by the user.
* **[Link Threat Intel Related Records](https://www.servicenow.com/docs/IbETEZMkQ~VZfPoMOxkxiQ)**   
  Link the related records that are related to the corresponding threat intel objects.
* **[Fetch Observables Data](https://www.servicenow.com/docs/AInUrgHpI8562mKHfU3sJg)**   
  Fetch the observables related records data.
* **[View details in Visualizer](https://www.servicenow.com/docs/Qpvgae7fPi74VNJ9OKkFkw)**   
  Using the Visualizer, you can view the relationships between objects, observables and indicators which provides context for you to further investigate. The Visualizer uses colors and icons to illustrate various information about the objects.
* **[Working with Internal Intelligence Records](https://www.servicenow.com/docs/C__jJZQYMjYBDzgtYgHI2w)**   
  Use this feature to work with the internal intelligence data that is collected from Configuration Database Management System (CMDB) into Threat Intelligence Security Center.
* **[Run Enrichment Actions from Observable](https://www.servicenow.com/docs/ci3~lCYUHJgmuuL5qbSH0w)**   
  Use this section to understand how enrichments actions are performed on observables and other objects.
* **[Add to Case](https://www.servicenow.com/docs/IvtsVEJaWv1zc0fiC1nHCA)**   
  Add observables, indicators, or other objects to the case.
* **[Run Enrichment operations in TISC](https://www.servicenow.com/docs/A7a8VOwB7I13RMht8mansQ)**   
  The following table below describes the interactions involved in running different enrichment operations from TISC.
* **[View Enrichment Results](https://www.servicenow.com/docs/iaJRt0YUxGw~HyFuXuVCcw)**   
  View observables, indicators, and various objects enrichment results.

**Related concepts**   

* [Indicators](https://www.servicenow.com/docs/B69N6Wdc7W0nI0ks7FqyYA "Indicators are artifacts observed on a network or operating system that are likely to indicate an intrusion. Typical IoCs are virus signatures and IP addresses, MD5 hashes of malware files or URLs, or domain names.")
* [Threat Entities](https://www.servicenow.com/docs/_5DGFV0RjbonAf2KRyZj9g "The Threat Entities module provides structured records used to manage threat intelligence objects in the TISC. These records align with STIX domain object concepts and help standardize how threat activity is documented and analyzed.")
* [Other Objects](https://www.servicenow.com/docs/NqecVRly6M6WQnxqn9Ixkw "Define and manage data classifications within TISC.")
* [Vulnerability](https://www.servicenow.com/docs/mObzIXRkQGKQMcKeLtA7JQ "A Vulnerability is a weakness or defect in a software or hardware component that attackers exploit. Vulnerabilities apply for STIX 2.x.")
* [Working with Reports in TISC](https://www.servicenow.com/docs/hPkrs37a6HKieeOtSSJxKg "The Reports module in the Threat Intelligence Library section enables you to create, manage, and publish reports that use any intelligence available in the Threat Intelligence Library.")
* [MITRE-ATT\&CK Repository](https://www.servicenow.com/docs/Y50sAsUgKJ4SYkPZ2Obf~g "The MITRE-ATT&CK repository is available under the Intelligence Library where the data from the MITRE sources are ingested.")
* [Relationships Objects](https://www.servicenow.com/docs/Kffra0ZJbg3rrW_AS5wO_g "Use the relationships objects to link together two observables or an observable and SDO to explain how they relate to each other.")
* [Potential Relationships](https://www.servicenow.com/docs/dc1NAg3gI_TtywVl9FXRcg "The application uses automated correlation to establish potentially possible relationships between two SDOs, two Observables or an observable and SDO.")
* [Vulnerability relationship mapping](https://www.servicenow.com/docs/ibGmPhY7zIIuaKPXbv8OzA "Use many-to-many (M2M) relationship records to map connections between vulnerabilities and other entities.")  
**Related tasks**   

* [Define RSS Feeds](https://www.servicenow.com/docs/izYjMP8Xu6MPWNyfL5cJxw "A threat intelligence feed is a real time, continuous data stream that gathers information related to cyber risks or threats. RSS Feeds provides an easy way to stay up to date with your favorite websites, such as blogs or latest cyber security news.")