---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Link and unlink TISC records to a security incident

# Link and unlink TISC records to a security incident {#ariaid-title1}

Release version: Australia  
Updated August 18, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Link TISC records such as observables, threat actors, and malware to a security incident, or unlink records that you no longer need.

## Before you begin

Role required: sn_si.analyst, sn_sec_tisc.library_write, sn_sec_tisc.case_write

## About this task

From the TISC Context tab of a security incident, you can associate a TISC record directly with the security incident without creating a TISC case first. Linking a record only associates it with the security incident. It doesn't create a copy of the record in Security Incident Response Workspace.

You can also link a security incident from the TISC side. For more information, see [View Internal Intelligence Records](https://www.servicenow.com/docs/t~_O9a~miiWfdW8W4AibKA "View the internal intelligence records collected from CMDB, Security Incident Response (SIR), Vulnerability Response (VR) these records.").

## Procedure

1. Navigate to WorkspacesSecurity Incident Response WorkspaceSecurity IncidentsAll.
2. Open the security incident you're investigating.
3. Select TISC Context.
4. Select the option that has the record you want to link or unlink.  
   The TISC Context tab contains the following options.{#tisc-link-unlink-records-sir__table_lnk_unl_lists__entry__2}

   | Name | Description |
   |-|-|
   | TISC Cases | The TISC cases associated with the security incident. In earlier releases this list was labeled Cases. |
   | Observables | The TISC observables associated with the security incident. |
   | Vulnerabilities | The vulnerabilities associated with the security incident. |
   | Campaigns | The campaigns associated with the security incident. |
   | Intrusion Sets | The intrusion sets associated with the security incident. |
   | Malware | The malware associated with the security incident. |
   | Threat Actors | The threat actors associated with the security incident. |
   | Threat Reports | The threat reports associated with the security incident. |
   [ ]

   {#tisc-link-unlink-records-sir__table_lnk_unl_lists}  
   Note:  
   The Threat Actors list includes threat actor motivation columns, and the Malware list includes malware capability columns.
5. To link records, select Link.
   1. In the link window, apply the advanced filters to narrow the list of available records.
   2. Select one or more records.
   3. Select Link for TISC Cases or Add for the other options.

   {#tisc-link-unlink-records-sir__substeps_lnk_lnk_unl}  
   The selected records are associated with the security incident. When you close the link window, a single consolidated work note is posted on the security incident for all the records that were linked. Records that failed to link, and records that were already linked, are excluded from the work note.
6. To remove links, select one or more records and select Unlink.  
   A confirmation window is displayed. After you confirm, the association is removed.
7. **Optional:** To create an Observable in the SIR Workspace and link it, select Create and Link to SI.
8. **Optional:** To view the enrichment results for an Observable, select View Enrichment Results.
9. **Optional:** In TISC Cases, select View Related Artifacts to view the related records or entities.
10. Select View Related Info to view information, such as the threat actors, attack patterns, campaigns, or cases related to the incident.  
    View Related Info is available for all the options except TISC Cases.
{#tisc-link-unlink-records-sir__steps_lnk_unl_sir}

## Result

Linking or Unlinking immediately reflects in TISC in the Internal Intelligence tab of records.
**Related concepts**   

* [TISC integration with SIR Workspace](https://www.servicenow.com/docs/8ejNJMWpYZ5wSnsLuZ9KQQ "TISC integration with SIR Workspace provides threat intelligence context for observables and threat entities in the security incident workspace.")  
**Related tasks**   

* [View Internal Intelligence Records](https://www.servicenow.com/docs/t~_O9a~miiWfdW8W4AibKA "View the internal intelligence records collected from CMDB, Security Incident Response (SIR), Vulnerability Response (VR) these records.")

*[\>]: and then