{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44449,"path":"security-management/security-incident-response/create-si-observable.md","title":"Create a security incident observable","bundle":null,"doc_type":null,"release":"australia","body":"\n# Create a security incident observable\n\nYou can create and view an observable within a security incident and take appropriate action. Having observables available in the security incident is scalable and reduces response time.\n\n## Before you begin\n\nRole required:\n\n- sn\\_ti\\_observable.write \\(write\\)\n- sn\\_ti\\_observable.read \\(read\\)\n- sn\\_ti\\_observable.admin \\(delete\\)\n\n## Procedure\n\n1. Navigate to **Security Incident**.\n\n2. Choose an incident.\n\n3. Select the **Security Incident Observables** related list tab.\n\n4. Select **New**.\n\n5. Fill in the fields on the form, as appropriate.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nSelect classification tag\n\n\n\nIf you set up and activated [security tags](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/create-class-group-and-tags.md) to add metadata to the record, you can select one or more tags to specify the degree of sensitivity of the observable. If you did not set up or activate security tags, this drop-down list is not displayed.\n\n
\n\nValue\n\n\n\nThe value \\(for example, IP address or hash\\) associated with the observable.**Note:** If a threat scan on an IP address or hash, returned malware or some other failure, the IP address or hash value is automatically added to the Observable \\[sn\\_ti\\_observable\\] table. As such, it can be searched for from the Observables form.\n\n
\n\nObservable type\n\n\n\nSelect the observable classification, such as an IP address or file hash. These observable types are defined in the **Observable Types** module.\n\n
\n\nIncident count\n\n\n\nThe number of times the observable value has been encountered.\n\n
\n\nIs composition\n\n\n\nThis field displays only after the observable record has been saved.If the **Observable Type** is set to anything other that **Observable Composition**, and this new observable is a composition, select this check box.\n\n If the **Observable Type** is already set to **Observable Composition**, the check box is selected and read-only.\n\n An observable composition is an observable that contains child observables.\n\n
\n\nFinding\n\n\n\nSelect one of the following:- **Malicious**: Indicates that the observable is harmful to the organization.\n- **Suspicious**: Indicates that the observable might be harmful to the organization.\n- **Clean**: Indicates that the observable is not harmful to the organization.\n- **Unknown**: Indicates that we are yet to determine the observable's finding.\n- Default value: Unknown. For more information, see [Threat Lookup Finding Calculators](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-lookup-finding-calculators.md).\n\n **Note:** After an upgrade, existing observables are marked Malicious.\n\n
\n\nOperator\n\n\n\nThis field appears only when the **Is composition** check box is selected. Depending on your setting in this field, the observables and their children are considered when deciding whether an associated indicator is present. Set this field to **AND** if all the child observables must be present for an associated indicator to be considered present.\n\n Set it to **OR** if any of the child observables are present for an associated indicator to be considered present.\n\n
\n\nMust not be present\n\n\n\nThis field displays only after the observable record has been saved.If selected, this field signifies that the absence of the observable is the potential issue \\(for example, a missing registry key\\).\n\n
\n\nLocation\n\n\n\nUsing the settings in two properties and a script include definition, you can load [Load more IoC data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/t_LoadAdditionalIoCData.md) in this field.\n\n
\n\nNotes\n\n\n\nEnter any additional notes about the observable.\n\n
6. Right-click in the form header and click **Save**.\n\n You can now click any of the following related lists to view additional information.\n\n |Related List|Description|\n |------------|-----------|\n |Related Indicators|Lists indicators that have been identified by the threat source.|\n |Associated Tasks|Lists changes associated with the observable.|\n |Child Observables|Lists related observables that have been identified by the threat source.|\n |Matching Resources for IP|If the observable is an IP address, this list shows any resources \\(configuration items\\) that have a matching IP address.|\n |Observable Sources|Lists the sources of this observable, along with the confidence level of the source.|\n |Security Annotations|Lists security annotations added to this observable.|\n\n7. Returning to the security incident the following information is available.\n\n **Note:** When you add an observable to the security incident, the system checks for any other configuration items or users associated with it. The **Related Configuration Items** and **Related Users** related list tabs are updated accordingly.\n\n\n
\n\nColumn\n\n\n\nDefinition\n\n
\n\nObservable\n\n\n\nThe value \\(for example, IP address or hash\\) associated with the observable.\n\n
\n\nObservable Type\n\n\n\nThe specific type of observable.\n\n
\n\nContext\n\n\n\nSelected by the user. Choices are:- IP - Source or Destination\n\n**Note:** If Threat Intelligence and Palo Alto Networks - Firewall are activated, changing or adding a value to this field causes the [Get Log Data Flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/get-threat-log-data.md) [Security Operations Palo Alto Networks - Get Log Data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/get-threat-log-data.md) workflow to execute. The workflow retrieves enriched threat log data from the firewall and attaches it to the security incident. The information is also parsed and displayed in the [Firewall Logs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/t_ManuallyCreateSecurityIncident.md) section under the **Enrichment Data** tab.\n\n- URL - Referrer\n\n**Note:** When the user clicks a link in a phishing email, a referrer is the URL of the final jump before the malware URL is accessed.\n\n
\n\nIncident Count\n\n\n\nThe number of incidents that this observable appears in. This value is automatically updated when the observable is added to another incident manually or through a workflow.\n\n
\n\nUpdated\n\n\n\nData and time the list was last updated.\n\n
**Note:** If the Threat Intelligence plugin is installed, you can also view the observable in the **Observables** list in the **IoC Repository**.\n\n\n**Related topics** \n\n\n[Edit a security incident observable list](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/edit-si-observable.md)\n\n[Add multiple security incident observables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/add-multiple-si-observables.md)\n\n"}}