Define an Observable

Observables can be retrieved from scheduled feed ingestion or from the import assistant. However, you can create observables, as needed.

Before you begin

Role required: sn_sec_tisc.analyst

Procedure

1. Navigate to Workspaces > Threat Intelligence Security Center > Threat Intel Library > Observables > All Observables.

2. Click New.

3. Select the Observable Type.

   Create New Observable record form is displayed.

   Note: Whenever you create new object records for observables, indicators, entities or objects a source record is created and a prompt message is displayed that the new object record is created and then the user is redirected to the aggregated record.

4. On the form, fill in the fields.

   Note: Whenever you either create a new observable or view the existing observables, the Attachments pane is by default displayed on the form view. You can either click the Attachments icon on the right-contextual menu or go to Preferences > Workspaces and disable the Show the sidebar. For more information, see Configure Next Experience Workspace preferences.

|Field|Description|
|-----|-----------|
|Resolves To|Specifies a list of references to one or more IP addresses or domain names that the domain name resolves to.|
|Is FQDN|A fully qualified domain name\(FQDN\) is the complete address of an internet host or computer. It provides its exact location within the domain name system \(DNS\) by specifying the hostname, domain name and top-level domain \(TLD\).|

|Field|Description|
|-----|-----------|
|Threat Level|Indicates the threat level of the observable record.|
|First Seen|The time that this observable record was first seen performing malicious activities.|
|Threat Severity|Indicates the threat severity of the observable record.|
|Last Seen|The time that this observable record was last seen performing malicious activities.|
|Usage Categories|Categories that the observable falls under, such as botnet or phishing.|
|Attack Phases|Represents attack phase in a kill chain such as LM, MITRE ATT&CK.|
|Additional Context|Add any additional context.|
|Sources|Specifies the threat source from which this record is created.|

**Important:** **Source Reported Score**: This field contains the aggregated value of threat scores reported by the sources from which the observable is ingested. To see this field on the observable record form, you must add it manually, as it is not available by default.

|Field|Description|
|-----|-----------|
|Resolves To|Specifies a list of references to one or more IP addresses or domain names that the domain name resolves to.|
|Is FQDN|A fully qualified domain name\(FQDN\) is the complete address of an internet host or computer. It provides its exact location within the domain name system \(DNS\) by specifying the hostname, domain name and top-level domain \(TLD\).|

**Note:** **Resolves To** and **Is FQDN** attributes are only applicable to the **Domain Name** type of observables.

|Field|Description|
|-----|-----------|
|Notes|Add any additional notes for an observable record.|

1. Click Save.

   After you save, a prompt message is displayed indicating that A new observable record is created. Click Continue to edit the record and create new relationships.

2. Click Continue.

   Important: After you create a new observable record, Prevent System Updates check box is displayed.

   Select this check box to prevent any updates from the system after the observable or indicator or STIX objects records are created.

   Field	Description
   Tags
   Select Tags	Select the tags that are associated with an observable.
   Add Tags	Add new tags.
   Taxonomies
   Select Taxonomy	Select the Taxonomy that is associated with an observable.
   Add Taxonomy Values	Add the Taxonomy values that are associated with an observable.

   Field	Description
   The source records details for an observable are displayed, if any.

What to do next

Following table lists the related records related to the Observables:

Note:

1. You can link and unlink the related records associated with this object. For more information, see Link Threat Intel Related Records.
2. Also, from the Related Records section, you can confirm the relationships between two Observables using the Potential Relationships section available on the Observables form view. For more information on see, Confirm Potential Relationships from Related Records.
3. You can add observables to cases. For more information, see Add to Case.
4. You can also run enrichment actions to observables. For more information, see Run Enrichment Actions within a case.

Parent Topic:Observables