Automated Correlation

  • Release version: Zurich
  • Updated March 26, 2026
  • 4 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Automated Correlation

    Automated correlation in ServiceNow's threat intelligence application helps identify and establish relationships between observables, indicators, and objects automatically. This process uses predefined correlation rules to link threat intelligence records, resulting in either confirmed or potential relationships. Confirmed relationships appear in the Related Records section of an object's details view, enhancing visibility into threat connections.

    Show full answer Show less

    Key Features

    • Relationship Types:
      • Relationships: Established links between two observables or between an observable and a Structured Data Object (SDO) explaining how they relate.
      • Potential Relationships: Possible connections inferred between two SDOs, two observables, or an observable and an SDO, based on correlation rules. These are initially deactivated by default to preserve system performance.
    • Predefined Correlation Rules: The system includes several base rules that automatically create relationships or potential relationships, such as:
      • Matching observables with the same file hash (creates confirmed relationships)
      • Observables with the same domain (creates potential relationships; disabled by default)
      • Matching observables as sources or destinations in network objects (creates confirmed relationships)
      • Relating observables based on communication with the same destination (confirmed relationships)
      • Linking root domains with subdomains and related domains to IPs via DNS resolution (confirmed relationships)
      • Matching domains with SSL certificates issued by the same authority (confirmed relationships)
      • Relating entities, indicators, or objects based on common observables (potential relationships; disabled by default)
    • Performance Consideration: Potential relationship rules are disabled by default to avoid performance degradation due to the large volume of generated relationships, especially in environments with substantial data ingestion.

    Practical Benefits for ServiceNow Customers

    By leveraging automated correlation, you can:

    • Gain deeper insights into how threat indicators and observables interconnect across your threat intelligence data.
    • Automatically identify confirmed and potential relationships, reducing manual effort and improving threat analysis efficiency.
    • Visualize related records directly within object views, enhancing situational awareness and speeding up investigation workflows.
    • Customize correlation rule activation to balance between comprehensive relationship mapping and system performance based on your data volume.

    Next Steps

    To optimize automated correlation:

    • Review and enable appropriate correlation rules based on your environment and performance considerations.
    • Utilize related records to confirm potential relationships when applicable.
    • Refer to related concepts such as the Data Model and TISC Library for deeper understanding and effective use of correlation features.

    Automated correlation helps you identify the relationships between observables, indicators, and objects.

    With the correlation process, the application automatically establishes the correlation between threat intelligence records based on the predefined rules. Based on the type of the rule that is applied, the relationship can be a confirmed relationship or a potential relationship. If the relationships between the objects are confirmed, those objects are automatically displayed on the details view of that object under the Related Records section.

    The following describes the relationships and potential relationships:
    • Relationships: Use the relationships objects to link together two observables or an observable and SDO to explain how they relate to each other.
    • Potential Relationships: Use the potential relationships to establish potentially possible relationships between two SDOs, two Observables or an observable and SDO by using the automated correlation.

      Correlation rules for potential relationships identify potential relationships between threat intelligence entities, indicators, and observables.

      Note:
      These rules are deactivated by default to prevent performance issues from excessive relationship creation. Enabling these rules can result in the creation of many potential relationships, depending on the volume of ingested data and shared observables.
    The following are the predefined correlation rules provisioned within the base system:
    Table 1. Correlation rules
    Name Description Definition Action Status
    Observables with same file hash The rule compares the observables' hash values of the same type and identifies if they share the same hash. The rule compares the hash values of the same type of the indicators and identifies if they share the same hash. Creates a Relationship Enabled
    URL Observables with same domain The rule examines the commonalities in the structure of URLs to identify if they share the same base domain. The rule examines the commonalities in the structure of URLs. Identifies if they share the same base domain and have a similar subdirectory structure. Creates a Potential Relationship Disabled
    Observable found as sources in network object The rule matches the Network source attribute value with IPV4, IPV6, or domain-name observables in the system and links as the Source of traffic. The rule matches the Source attribute value with IPV4, IPV6 or domain-name observables in the system and links as Source of traffic. Creates a Relationship Enabled
    Observable found as destination in network object The rule matches the Network destination attribute value with IPV4, IPV6, or domain-name observables in the system and links as the destination of the traffic. The rule matches the destination attribute value with IPV4, IPV6 or domain-name observables in the system and links as destination of traffic. Creates a Relationship Enabled
    Relate observables based on communication Based on network objects, the rule identifies all the observables (IPV4, IPV6, and domain name) that have communicated with the same destination (IPV4, IPV6, or domain name) and establishes a relationship between these observables.

    Also, related observables (IPV4, IPV6, and domain name) if they are related to the same network object as the source communicating with the destination.

    		 Based on network objects, the rule identifies all the indicators that have communicated with the same destination (IPV4, IPV6, mac-addr or domain-name) and establishes a relationship between these indicators as connected to the same C2 infrastructure. Creates a Relationship Enabled
    Related Root domain observables to sub domains The rule ties together a root domain with sub-domains and vice versa for domain type of observables. The rule ties together a root domain with sub-domains. Creates a Relationship Enabled
    Related domains to IPs based on DNS resolutions Using domain-ipv4 or domain-ipv6 attributes of domain observables, the rule establishes relationships between the domains and IPs. Using the attributes domain-ipv4 or domain-ipv6, the rule identifies all the domains or sub-domains that resolve to the same IP address and establishes relationships between the indicators, indicating their connection to the same C2 infrastructure. Creates a Relationship Enabled
    Matching domains with SSL Certificates The rule analyzes the SSL certificate information associated with the domain observables and establishes a relation between them. The rule analyzes the SSL certificate information associated with the indicators and identifies that both certificates are issued by the same certificate authority and share the same expiration date and establishes relationships between the indicators, indicating their connection to the same C2 infrastructure or threat campaign. Creates a Relationship Enabled
    Relate entities based on common observables The rule compares if the same observable is related to two different entities and relates them to each other. The rule compares if the same observable is related to two different entities and identifies them as related to each other. Creates a Potential Relationship Disabled
    Relate indicators based on common observables The rule compares if the same observable is related to two different indicators and relates them to each other. The rule compares if the same observable is related to two different indicators and identifies them as related to each other. Creates a Potential Relationship Disabled
    Relate indicators with objects based on common observables The rule compares if the same observable is related to indicators, and objects and relates them to each other. The rule compares if the same observable is related to indicators and objects and identifies them as related to each other. Creates a Potential Relationship Disabled