---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Observable extraction from indicator patterns

# Observable extraction from indicator patterns {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Threat Intelligence Security Center extracts observables from indicators that use the STIX pattern type and links the extracted observables back to the source indicator.

## Key benefits {#tisc-extract-observables-from-indicators__section_benefits}

Observable extraction from indicator patterns provides the following
benefits:

* The system automatically creates individual observable records from pattern of Indicators of the STIX pattern type.
* Extracted observables inherit the confidence, threat level, and severity values from the source indicator.
* Each extracted observable maintains a link to its source indicator, preserving traceability to the original pattern.
{#tisc-extract-observables-from-indicators__ul_extract_benefits}

## Extracted values {#tisc-extract-observables-from-indicators__section_extracted_values}

Extraction covers every observable type described in [Observables](https://www.servicenow.com/docs/xgzMahxnlxClgvKD1IlUWQ "Observables represent stateful properties (such as the MD5 hash of a file or the value of a registry key) or measurable events (such as the creation of a registry key or the deletion of a file) that are pertinent to the operation of computers and networks.") except Email Message and Network. The system stores unrecognized STIX object types, such as vendor extensions, as Other Observables.{#tisc-extract-observables-from-indicators__tisc-extract-observables-from-indicators-values-para-1}

Within a pattern, only comparisons that resolve to a single literal value produce an observable. The system extracts comparisons that use the equals, IN, and
ISSUBSET operators. The system skips comparisons that use inequality, greater-than, less-than, LIKE, MATCHES, ISSUPERSET, or EXISTS operators, and any comparison preceded by NOT.{#tisc-extract-observables-from-indicators__tisc-extract-observables-from-indicators-values-para-2}

Each extracted observable inherits the Confidence, Expiration Time, TLP, Threat Level, and Threat Severity values of the indicator source record, along with its source and source execution run values. The Additional Context field records the
ID of the indicator the observable was extracted from.{#tisc-extract-observables-from-indicators__tisc-extract-observables-from-indicators-values-para-3}

## Considerations {#tisc-extract-observables-from-indicators__section_considerations}

Consider the following when working with extracted observables:{#tisc-extract-observables-from-indicators__tisc-extract-observables-from-indicators-considerations-para-1}

* Extraction runs only when an indicator record is created. Editing the Pattern field on an existing aggregated indicator record doesn't extract observables from the revised pattern.
* The system creates relationships between the indicator and each extracted observable only. The system does not create relationships between the extracted observables themselves.
* If an observable with the same value, type, and source already exists, that record is linked.
* An extracted value longer than 256 characters is truncated to 256 characters.
* Extraction is enabled by default. To turn it off, set the sn_sec_tisc.extract_observables_from_indicator property to false.
{#tisc-extract-observables-from-indicators__ul_extract_considerations}
**Related concepts**   

* [Observables](https://www.servicenow.com/docs/xgzMahxnlxClgvKD1IlUWQ "Observables represent stateful properties (such as the MD5 hash of a file or the value of a registry key) or measurable events (such as the creation of a registry key or the deletion of a file) that are pertinent to the operation of computers and networks.")