---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management
Release :
- australia
ft:locale :
- en-US
ft:publication_title :
- Australia Security Management
ft:clusterId :
- security
bundleId :
- security
workflow :
- Technology
---
# Automated correlation
# Automated correlation {#ariaid-title1}
Release version: Australia
Updated April 6, 2026
 2 minutes to read
Summarize
 Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
## Summary of Automated correlation
Automated correlation in ServiceNow Threat Intelligence Security Center (TISC) automatically establishes relationships between threat intelligence records using predefined rules.
This feature helps you identify connections between observables, indicators, and threat objects, enhancing your ability to analyze and respond to threats effectively.
Relationships are shown in the Related Records section within object details, while potential relationships are listed separately.
Show full answer Show less
By default, automated correlation is disabled and must be enabled by setting **snsectisc.disablecorrelationrules** to false.
## Key Features
* **Relationship Types:**
* **Relationships:** Direct connections between two observables or between an observable and a STIX Domain Object (SDO).
* **Potential Relationships:** Possible connections between two SDOs, two observables, or an observable and SDO based on correlation rules.
* **Correlation Rules:** Rules define how relationships and potential relationships are generated. Some rules are enabled by default, while others are disabled and can be customized to fit your business needs.
* **Performance Limits:** Potential relationship tables have a default limit of 1,000,000 records per domain to ensure optimal system performance.
* **Reputation Requirement:** Correlation rules trigger only for observables with malicious or suspicious reputations, including artifacts, domains, files, IP addresses, hashes, and URLs.
* **Deprecated Rules:** Certain rules related to relating indicators and observables based on communication are deprecated and should not be used.
## Common Correlation Rules
| Name | Description | Action | Default Status |
|-|-|-|-|
| File Hash Linkage | Links files, artifacts, and hash observables sharing the same hash values to identify variants of malicious files. | Creates a relationship | Enabled |
| URL Domain Grouping | Groups URLs sharing the same domain and path, ignoring protocol and parameters. | Creates a potential relationship | Disabled |
| Network Source Attribution | Links network observables to their source domain and IP addresses. | Creates a relationship | Enabled |
| Network Destination Attribution | Links network observables to their destination domain and IP addresses. | Creates a relationship | Enabled |
| Communication Path Correlation | Relates source and destination observables within network communication flows. | Creates a potential relationship | Disabled |
| Subdomain \& Parent Domain Linking | Relates domains to their immediate parent and subdomains. | Creates a relationship | Enabled |
| Domain-to-IP Resolution Mapping | Connects domains to IP addresses they resolve to via DNS. | Creates a relationship | Enabled |
| Certificate-Domain Association | Associates SSL/TLS certificates with domain names. | Creates a relationship | Enabled |
## Configuration and Management
* You can enable or disable correlation rules or customize them to align with your organization's threat intelligence strategy.
* Adjust the maximum number of potential relationship records to balance between data volume and system performance.
## Practical Benefits
By leveraging automated correlation, ServiceNow customers can uncover hidden relationships within threat data, prioritize investigation efforts, and improve the accuracy of threat detection and response. This capability enhances situational awareness and supports proactive security operations.
Automated correlation automatically establishes relationships between threat intelligence records based on predefined rules, helping you identify connections between observables, indicators, and threat objects.
The correlation process automatically establishes relationships or potential relationships between threat intelligence records based on predefined rules.{#automated-correlation-rules__automated-correlation-rules-para-1}
In the Related Records section, relationships are listed in the object details view and Potential relationships are listed separately.
The following list describes relationships and potential relationships.{#automated-correlation-rules__automated-correlation-rules-para-2}
* Relationships: Relates two observables or an observable and STIX Domain Object (SDO).
* Potential relationships: Establish potentially possible relationships between two SDOs, two observables, or an observable and SDO by using automated correlation.
{#automated-correlation-rules__ul_im1_skw_pzb}
Important:
Automated correlation is disabled by default. Set sn_sec_tisc.disable_correlation_rules to true to enable it. For more information, see [Components installed with Threat Intelligence Security Center](https://www.servicenow.com/docs/Z3CD1gb_~TCDTOHp3KJ52g "Several types of components are installed when you download and activate the Threat Intelligence Security Center application, including user roles and properties.").
## Correlation rule considerations {#automated-correlation-rules__section_rjm_bg5_gkc}
* The correlation rules that generate potential relationships are disabled by default. To enable these rules, see [Configure correlation rules](https://www.servicenow.com/docs/GoJl67CqJkLYIa_6EQSPjw "Enable or disable the Correlation rules or customize them according to your business requirements.").
* Each potential relationship table has a default limit of 1,000,000 records for each domain. This is done to maintain optimal instance performance while managing threat intelligence data volume.
* The following observables must be of malicious or suspicious reputation for the correlation rule to trigger: Artifact, Domain Name, File, IPv4 address, IPv6 address, MD5 Hash, SHA1 Hash, SHA256 Hash, SHA512 Hash, and URL.
{#automated-correlation-rules__ul_vgc_cg5_gkc}
Note:
The following rules are deprecated:
* Relate Indicators with Objects Based on Common Observables
* Relate Observables Based on Communication
{#automated-correlation-rules__ul_g35_5vy_kkc}
{#automated-correlation-rules__table_dqb_dq2_nzb__entry__4}
| Name | Description | Action | Default status |
|-|-|-|-|
| File Hash Linkage | Links files, artifacts, and hash observables that share the same hash values so that you can identify variants and copies of known malicious files. | Creates a relationship | Enabled |
| URL Domain Grouping | Groups URL observables that share the same domain and path, regardless of protocol, port number, or query parameters. | Creates a potential relationship | Disabled |
| Network Source Attribution | Links network observables to the domain and IP address (IPv4 and IPv6) observables that are the source of the traffic. | Creates a relationship | Enabled |
| Network Destination Attribution | Links network observables to the domain and IP address (IPv4 and IPv6) observables that are the destination of the traffic. | Creates a relationship | Enabled |
| Communication Path Correlation | Maps communication flows by relating the source and destination observables that are recorded in a network observable. | Creates a potential relationship | Disabled |
| Subdomain \& Parent Domain Linking | Relates a domain observable to its immediate parent domain and its direct subdomains. | Creates a relationship | Enabled |
| Domain-to-IP Resolution Mapping | Connects domain observables to the IP addresses that they resolve to in DNS records. | Creates a relationship | Enabled |
| Certificate-Domain Association | Associates SSL/TLS certificate observables with their corresponding domain names. | Creates a relationship | Enabled |
[Table 1. Correlation rules]
{#automated-correlation-rules__table_dqb_dq2_nzb}
* **[Configure correlation rules](https://www.servicenow.com/docs/GoJl67CqJkLYIa_6EQSPjw)**
Enable or disable the Correlation rules or customize them according to your business requirements.
* **[Configure potential relationship table limits](https://www.servicenow.com/docs/q94w1FxEA6~j4OKlQocFBQ)**
Configure the maximum potential relationship records that automated correlation can create. By default, each potential relationship table has a limit of 1,000,000 records for each domain.
**Related concepts**
* [TISC Data Model](https://www.servicenow.com/docs/IYhNIuDDe46ffpO552UcOA "The data model and architecture of threat intelligence security center module is designed to support threat intelligence platform capabilities and different security views that provides detailed data for threat analysts.")
* [TISC Library Objects form view](https://www.servicenow.com/docs/wcpLnk6kmrmzTBQAPm2RxA "The Threat Intelligence Security Center objects home page consists of the following features.")
* [TISC Library Repository](https://www.servicenow.com/docs/4G3NQv0L~ouF_cvQvhfm1w "IoC repository contains STIX objects, each of these objects contain a specific piece of information.")
* [Access Vulnerability Downstream actions](https://www.servicenow.com/docs/T1aOjuKwsjuB9Hk2MCUSoQ "Access all downstream actions generated from a vulnerability record to track remediation progress and understand the scope of response activities.")
**Related tasks**
* [Deleting threat intelligence library records](https://www.servicenow.com/docs/9h~3flpHUbUKTpRcxeekdA "Delete threat intelligence library records such as observables, indicators, and objects.")
* [Export intelligence data](https://www.servicenow.com/docs/w4RXvxKA~u3VcMYMpR4T9Q "Use the export feature to manually export the intelligence data in various formats.")
* [Confirm Potential Relationships from Related Records](https://www.servicenow.com/docs/TQHhkN60eRr8MHck5BQqaw "Confirm the relationships between the two SDOs.")