Define indicator-observable relationships

Define relationships between the indicator object and other SDOs.

Before you begin

Role required: sn_sec_tisc.analyst

Procedure

1. Navigate to Workspaces > Threat Intelligence Security Center.
2. Click on Threat Intel Library icon on the workspace.
3. Go to Relationships > Indicator-Observable.
4. Click New.
5. Complete the fields in the form as appropriate.

   Field	Description
   Observable	Select and define the observable.
   Indicator	Select and define the indicator object.

6. Click Submit.