---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Indicators

# Indicators {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Indicators are artifacts observed on a network or operating system that are likely to indicate an intrusion. Typical IoCs are virus signatures and IP addresses, MD5 hashes of malware files or URLs, or domain names.
* **[Define an Indicator](https://www.servicenow.com/docs/Lcrg53_N2jAPj4vx2ifKyA)**   
  Define an Indicator.
* **[Observable extraction from indicator patterns](https://www.servicenow.com/docs/L2AVVQuxhyBcFPA8N7tkAw)**   
  Threat Intelligence Security Center extracts observables from indicators that use the STIX pattern type and links the extracted observables back to the source indicator.

**Related concepts**   

* [Observables](https://www.servicenow.com/docs/TpRZ5xJslvI75bF2VSkHlw "Observables represent stateful properties (such as the MD5 hash of a file or the value of a registry key) or measurable events (such as the creation of a registry key or the deletion of a file) that are pertinent to the operation of computers and networks.")
* [Threat Entities](https://www.servicenow.com/docs/frmc_5b8GD1hi8oHyHRbKA "The Threat Entities module provides structured records used to manage threat intelligence objects in the TISC. These records align with STIX domain object concepts and help standardize how threat activity is documented and analyzed.")
* [Other Objects](https://www.servicenow.com/docs/Mm3MU9o5tc7NXV5ioctVoA "Define and manage data classifications within TISC.")
* [Vulnerability Artifacts](https://www.servicenow.com/docs/mWK6AUMFzZ1KgbP~zosWLQ "A Vulnerability is a weakness or defect in a software or hardware component that attackers exploit. Vulnerabilities apply for STIX 2.x.")
* [Working with Reports in TISC](https://www.servicenow.com/docs/9p3J4EDtDbwGioeDsHcI4Q "The Reports module in the Threat Intelligence Library section enables you to create, manage, and publish reports that use any intelligence available in the Threat Intelligence Library.")
* [MITRE-ATT\&CK repository](https://www.servicenow.com/docs/ku1Y8HlYCrL_WVXzCVI5aw "The MITRE-ATT&CK repository stores MITRE data separately from Threat Intel Library data in the Intelligence Library.")
* [Relationships Objects](https://www.servicenow.com/docs/J~q6TTZl8g7YV7RLAD7Iqw "Use the relationships objects to link together two observables or an observable and SDO to explain how they relate to each other.")
* [Potential Relationships](https://www.servicenow.com/docs/Xwr1amghwyW_~JIz1oUIsA "The application uses automated correlation to establish potentially possible relationships between two SDOs, two Observables or an observable and SDO.")
* [Vulnerability relationship mapping](https://www.servicenow.com/docs/EqW4oDZ3kuGXvZxjXcvZIw "Use many-to-many (M2M) relationship records to map connections between vulnerabilities and other entities.")  
**Related tasks**   

* [View RSS Feeds](https://www.servicenow.com/docs/9gDqem16jDBh5GzTMlDgkQ "A threat intelligence feed is a real-time, continuous data stream that gathers information related to cyber risks or threats. RSS Feeds provides an easy way to stay up to date with your favorite security blogs or latest cyber security news.")