---
title: Observables
description: Observables represent stateful properties \(such as the MD5 hash of a file or the value of a registry key\) or measurable events \(such as the creation of a registry key or the deletion of a file\) that are pertinent to the operation of computers and networks.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/observables.html
release: australia
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: concept
last_updated: "2026-03-12"
reading_time_minutes: 3
breadcrumb: [TISC Library Repository, Threat Intel Library, Use, Threat Intelligence Security Center, Security Operations]
---

# Observables

Observables represent stateful properties \(such as the MD5 hash of a file or the value of a registry key\) or measurable events \(such as the creation of a registry key or the deletion of a file\) that are pertinent to the operation of computers and networks.

Following are the type of observables available in the application:

-   Artifact
-   AS Number
-   Directory
-   Domain Name
-   Email Address
-   Email Message
-   Email Subject
-   File
-   IPv4 Address
-   IPv4 CIDR
-   IPv6 Address
-   IPv6 CIDR
-   MAC Address
-   MD5 Hash
-   Mutex Name
-   Network
-   Other Observable
-   Process
-   SHA1 Hash
-   SHA256 Hash
-   SHA512 Hash
-   Software
-   URL
-   User Account
-   Windows Registry Key
-   X.509 Certificate

-   **[Define an Observable](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/define-an-observable.md)**  
Observables can be retrieved from scheduled feed ingestion or from the import assistant. However, you can create observables, as needed.
-   **[Observables source records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-observables-source-records.md)**  
The source records contribute to an aggregated record as displayed in the form view. These source records are auto created from feeds, extracted from indicator patterns, or manually created by the user.
-   **[Link Threat Intel Related Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/link-threat-intel-releated-records.md)**  
Link the records that are related to the corresponding threat intelligence objects.
-   **[Create a related record to link](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-create-new-related-record.md)**  
Create a threat intelligence record directly from a related records list and link it to the record that you're viewing, without leaving your investigation.
-   **[Fetch Observables Data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/fetch-observables-data.md)**  
Fetch the observables related records data.
-   **[View details in Visualizer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/objects-visualizer.md)**  
Using the Visualizer, you can view the relationships between objects, observables and indicators which provides context for you to further investigate. The Visualizer uses colors and icons to illustrate various information about the objects.
-   **[Working with Internal Intelligence Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/working-with-ti-internal-intelligence-records.md)**  
Use this feature to work with the internal intelligence data that is collected from Configuration Database Management System \(CMDB\) into Threat Intelligence Security Center.
-   **[Run Enrichment Actions from Observable](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/run-enrichment-actions-from-observable.md)**  
Use this section to understand how enrichments actions are performed on observables and other objects.
-   **[Add to Case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/add-to-case.md)**  
Add observables, indicators, or other objects to the case.
-   **[Run Enrichment operations in TISC](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-unified-experience-capabilities-and-modal-screens.md)**  
The following table below describes the interactions involved in running different enrichment operations from TISC.
-   **[View Enrichment Results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown)**  
View observables, indicators, and various objects enrichment results.

**Parent Topic:**[TISC Library Repository](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-ioc.md)

**Related topics**  


[Indicators]()

[Threat Entities]()

[Other Objects]()

[Vulnerability Artifacts]()

[View RSS Feeds]()

[Working with Reports in TISC]()

[MITRE-ATT&CK repository]()

[Relationships Objects]()

[Potential Relationships]()

[Vulnerability relationship mapping]()