---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Automated correlation

# Automated correlation {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Automated correlation automatically establishes relationships between threat intelligence records based on predefined rules, helping you identify connections between observables, indicators, and threat objects.

The correlation process automatically establishes relationships or potential relationships between threat intelligence records based on predefined rules.{#automated-correlation-rules__automated-correlation-rules-para-1}

In the Related Records section, relationships are listed in the object details view and Potential relationships are listed separately.

The following list describes relationships and potential relationships.{#automated-correlation-rules__automated-correlation-rules-para-2}

* Relationships: Relates two observables or an observable and STIX Domain Object (SDO).
* Potential relationships: Establish potentially possible relationships between two SDOs, two observables, or an observable and SDO by using automated correlation.

{#automated-correlation-rules__ul_im1_skw_pzb}  
Important:  
Automated correlation is disabled by default. Set <var class="keyword varname"> sn_sec_tisc.disable_correlation_rules</var> to <kbd class="ph userinput">true</kbd> to enable it. For more information, see [Components installed with Threat Intelligence Security Center](https://www.servicenow.com/docs/G0_ZATRkTb~mNlN~ZcEnQg "Several types of components are installed when you download and activate the Threat Intelligence Security Center application, including user roles and properties.").

## Correlation rule considerations {#automated-correlation-rules__section_rjm_bg5_gkc}

* The correlation rules that generate potential relationships are disabled by default. To enable these rules, see [Configure correlation rules](https://www.servicenow.com/docs/OEluEsUfnome_Wh~Uo6Jrg "Enable or disable the Correlation rules or customize them according to your business requirements.").
* Each potential relationship table has a default limit of 1,000,000 records for each domain. This is done to maintain optimal instance performance while managing threat intelligence data volume.
* The following observables must be of malicious or suspicious reputation for the correlation rule to trigger: Artifact, Domain Name, File, IPv4 address, IPv6 address, MD5 Hash, SHA1 Hash, SHA256 Hash, SHA512 Hash, and URL.

{#automated-correlation-rules__ul_vgc_cg5_gkc}  
Note:  
The following rules are deprecated:

* Relate Indicators with Objects Based on Common Observables
* Relate Observables Based on Communication
{#automated-correlation-rules__ul_g35_5vy_kkc}
{#automated-correlation-rules__table_dqb_dq2_nzb__entry__4}

| Name | Description | Action | Default status |
|-|-|-|-|
| File Hash Linkage | Links files, artifacts, and hash observables that share the same hash values so that you can identify variants and copies of known malicious files. | Creates a relationship | Enabled |
| URL Domain Grouping | Groups URL observables that share the same domain and path, regardless of protocol, port number, or query parameters. | Creates a potential relationship | Disabled |
| Network Source Attribution | Links network observables to the domain and IP address (IPv4 and IPv6) observables that are the source of the traffic. | Creates a relationship | Enabled |
| Network Destination Attribution | Links network observables to the domain and IP address (IPv4 and IPv6) observables that are the destination of the traffic. | Creates a relationship | Enabled |
| Communication Path Correlation | Maps communication flows by relating the source and destination observables that are recorded in a network observable. | Creates a potential relationship | Disabled |
| Subdomain \& Parent Domain Linking | Relates a domain observable to its immediate parent domain and its direct subdomains. | Creates a relationship | Enabled |
| Domain-to-IP Resolution Mapping | Connects domain observables to the IP addresses that they resolve to in DNS records. | Creates a relationship | Enabled |
| Certificate-Domain Association | Associates SSL/TLS certificate observables with their corresponding domain names. | Creates a relationship | Enabled |
[Table 1. Correlation rules]

{#automated-correlation-rules__table_dqb_dq2_nzb}
* **[Configure correlation rules](https://www.servicenow.com/docs/OEluEsUfnome_Wh~Uo6Jrg)**   
  Enable or disable the Correlation rules or customize them according to your business requirements.
* **[Configure potential relationship table limits](https://www.servicenow.com/docs/VYOeGQqqWeajLTmByLvmdg)**   
  Configure the maximum potential relationship records that automated correlation can create. By default, each potential relationship table has a limit of 1,000,000 records for each domain.

**Related concepts**   

* [TISC Data Model](https://www.servicenow.com/docs/BnUsWmTNLCr2MZKwYKUmyQ "The data model and architecture of threat intelligence security center module is designed to support threat intelligence platform capabilities and different security views that provides detailed data for threat analysts.")
* [TISC Library Objects form view](https://www.servicenow.com/docs/5P8LTAFdDDueBvmeOAe~3Q "The Threat Intelligence Security Center objects home page consists of the following features.")
* [TISC Library Repository](https://www.servicenow.com/docs/wx~51IhiHiI5TPJRZrnUzg "IoC repository contains STIX objects, each of these objects contain a specific piece of information.")
* [Access Vulnerability Downstream actions](https://www.servicenow.com/docs/3e6xcc6fbkCoQMZ5uBlk5g "Access all downstream actions generated from a vulnerability record to track remediation progress and understand the scope of response activities.")  
**Related tasks**   

* [Deleting threat intelligence library records](https://www.servicenow.com/docs/nAYDxd86QiSwbddjEOdYEQ "Delete threat intelligence library records such as observables, indicators, and objects.")
* [Export intelligence data](https://www.servicenow.com/docs/M3zvjOPa3b5SMWJk0y9yUw "Use the export feature to manually export the intelligence data in various formats.")
* [Confirm Potential Relationships from Related Records](https://www.servicenow.com/docs/V8xDTjhYzkWxipWqyTErYA "Confirm the relationships between the two SDOs.")