Add a related IoC to an observable

In addition to importing observables as STIX data, you can add related observables to an IoC manually.

Before you begin

Role required: sn_ti.admin

Procedure

1. Navigate to All > Threat Intelligence > IoC Repository > Observables.
2. Click the observable to which you want to add a related IoC.
3. Click the Related Indicators related list.
4. Click Edit.
5. As needed, use the filters to locate the indicator you want to relate with the observable.
6. Using the slushbucket, add the indicator to the Related Indicators list.
7. Click Save.

Related tasks

• Define an observable
• Add associated tasks to an observable
• Add a related observable
• Load more IoC data
• Identify observable sources
• Perform lookups on observables
• Perform threat enrichment on observables