--- title: Define object-indicator relationships description: Define relationships between the indicator object and other SDOs. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/define-object-indicator-relationships.html release: australia product: Threat Intelligence Security Center classification: threat-intelligence-security-center topic_type: task last_updated: "2026-03-12" reading_time_minutes: 1 breadcrumb: [Relationships Objects, TISC Library Repository, Threat Intel Library, Use, Threat Intelligence Security Center, Security Operations] --- # Define object-indicator relationships Define relationships between the indicator object and other SDOs. ## Before you begin Role required: sn\_sec\_tisc.analyst ## Procedure 1. Navigate to **Workspaces** > **Threat Intelligence Security Center**. 2. Click on **Threat Intel Library** icon on the workspace. 3. Go to **Relationships** > **Object-Indicator**. 4. Click **New**. 5. Complete the fields in the form as appropriate.
| Field | Description |
|---|---|
| **Indicator** | Select and define the indicator. |
| **Object** | Select and define the object. |
| **Relationship Type** | A description that provides more details and context about the relationship type. Define the relationship direction whether it is direct or inverse. - Inverse - This is the type of relationship between the observable and object. - Direct - This is the type of relationship between the object and observable. |
| **Start Time** | Specifies the time when the relationship is created. |
| **Stop Time** | Specifies the time when the relationship is stopped or removed. |
| **Description** | A brief description about the object relationships. |