---
title: Define Malware Analysis
description: Define malware analysis that captures the metadata and results of a particular static or dynamic analysis performed on a malware instance or family.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/tisc-define-malware-analysis.html
release: australia
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 5
breadcrumb: [Malware Analysis, Threat Entities, TISC Library Repository, Threat Intel Library, Use, Threat Intelligence Security Center, Security Operations]
---

# Define Malware Analysis

Define malware analysis that captures the metadata and results of a particular static or dynamic analysis performed on a malware instance or family.

## Before you begin

Role required: sn\_sec\_tisc.analyst

## Procedure

1.  Navigate to **Workspaces** > **Threat Intelligence Security Center**.

2.  Click on **Threat Intel Library** icon on the workspace.

3.  Go to **Malware Analysis** object.

4.  Click **New**.

    **Note:** Whenever you create new object records for observables, indicators, entities or objects a source record is created and a prompt message is displayed that the new object record is created and then the user is redirected to the aggregated record.

5.  On the form, fill in the fields.

<table id="table_h2f_q5q_myb"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

ID

</td><td>

Unique ID to identify the malware analysis.

</td></tr><tr><td>

Product

</td><td>

The name of the analysis engine or product that was used. Product names SHOULD be all lowercase with words separated by a dash "-".For cases where the name of a product cannot be specified, a value of anonymized must be used.

</td></tr><tr><td>

Version

</td><td>

The version of the analysis product that was used to perform the analysis.

</td></tr><tr><td>

Host VM

</td><td>

A description of the virtual machine environment used to host the guest operating system, if applicable that was used for the dynamic analysis of the malware instance or family.If this value is not included in conjunction with the operating\_system\_ref property, this means that the dynamic analysis may have been performed on bare metal \(i.e. without virtualization\) or the information was redacted.

The value of this property MUST be the identifier for a SCO software object.

</td></tr><tr><td>

Operating System

</td><td>

The operating system used for the dynamic analysis of the malware instance or family. This applies to virtualized operating systems as well as those running on bare metal.The value of this property MUST be the identifier for a SCO software object.

</td></tr><tr><td>

Configuration Version

</td><td>

The alternative names used to identify this malware or malware family.

</td></tr><tr><td>

Modules

</td><td>

The specific analysis modules that were used and configured in the product during this analysis run.

</td></tr><tr><td>

Analysis Engine Version

</td><td>

The version of the analysis engine or product \(including AV engines\) that was used to perform the analysis.

</td></tr><tr><td>

Analysis Definition Version

</td><td>

The version of the analysis definitions used by the analysis tool including AV tools.

</td></tr><tr><td>

Analysis Started

</td><td>

The date and time that the malware analysis was initiated.

</td></tr><tr><td>

Analysis Ended

</td><td>

The date and time that the malware analysis was ended.

</td></tr><tr><td>

Result

</td><td>

The classification result as determined by the scanner or tool analysis process.

</td></tr><tr><td>

Result Name

</td><td>

The classification result or name assigned to the malware instance by the scanner tool.

</td></tr><tr><td>

Submitted

</td><td>

The date and time that the malware was first submitted for scanning or analysis. This value will stay constant while the scanned date can change. For example, when Malware was submitted to a virus analysis tool.

</td></tr><tr><td>

Analysed Observable

</td><td>

Select the observable that was analysed.

</td></tr><tr><td>

TLP

</td><td>

TLP is used to ensure that sensitive information is shared with the appropriate audience. It employs four colors \(White, Green, Amber, and Red\) to indicate different degrees of sensitivity.

</td></tr><tr><td>

Confidence

</td><td>

Enter the confidence for this malware analysis.

</td></tr><tr><td>

Source

</td><td>

Specifies the threat source from which this object record is created.

</td></tr><tr><td>

Revoked

</td><td>

Indicates that the revoked objects are no longer considered valid by the object creator.

</td></tr></tbody>
</table>    |Field|Description|
    |-----|-----------|
    |Notes|Add any additional notes for the malware family record.|

<table id="table_r2q_jn2_nyb"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Additional Context

</td><td>

Add any additional context for this malware record.

</td></tr><tr><td>

Spec Version

</td><td>

The version of the STIX specification used to represent this object.The value of this property must be 2.1 for STIX Objects defined according to this specification.

</td></tr><tr><td>

Lang

</td><td>

This property identifies the language of the text content in this object.

</td></tr><tr><td>

Created Time In Source

</td><td>

Specifies the time the object is created in the source.

</td></tr><tr><td>

Extensions

</td><td>

Indicates the extensions of attack pattern.

</td></tr><tr><td>

Modified Time in Source

</td><td>

Specifies the time the object is modified in the source.

</td></tr><tr><td>

Processing Status

</td><td>

Represents the processing status of this object, malware.

</td></tr><tr><td>

Created

</td><td>

Specifies the date and time when the object is created in the source.

</td></tr><tr><td>

Updated

</td><td>

Specifies the date and time when the object was updated in the source.

</td></tr><tr><td>

Created By Ref

</td><td>

This property specifies that the identity object that describes the entity had created this object.

</td></tr></tbody>
</table>6.  Click **Save**.

    After you save, a prompt message is displayed indicating that A new observable record is created. Click **Continue** to edit the record and create new relationships.

7.  Click **Continue**.

    **Important:** After you create a new observable record, **Prevent System Updates** check box is displayed.

    Select this check box to prevent any updates from the system after the observable or indicator or STIX objects records are created.

    |Field|Description|
    |-----|-----------|
    |Tags|
    |Select Tags|Select the tags that are associated with the malware.|
    |Add Tags|Add new tags.|
    |Taxonomies|
    |Select Taxonomy|Select a Taxonomy that is associated with the malware.|
    |Add Taxonomy Values|Add Taxonomy values that are associated with the malware.|


## What to do next

Click any of the following related lists to view additional information about objects associated with the malware.

|Field|Description|
|-----|-----------|
|External References|Lists the external references which refer to non-STIX information. This property is used to provide one or more external object identifiers.|
|Malware|Lists malware records associated with this object.|
|Marketing Definitions|Lists the marketing definitions associated with this object.|
|Observables|Lists the observables associated with this object.|
|Sightings|Lists the sightings associated with this object.|

**Note:**

1.  You can link and unlink the related records associated with this object. For more information, see [Link Threat Intel Related Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/link-threat-intel-releated-records.md).
2.  The various SDOs within the TI library also contains the potential relationships. To establish a relationships between any two objects, you use the **Potential Relationships** link from the **Threat Intel Library** to confirm the relationships between the objects. For more information, see [Confirm object-object potential relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/define-object-object-potential-relationships.md).
3.  Also, use the **Related Records** section from the objects form view to confirm the relationships between two Objects using the **Potential Relationships** section available on the form view. For more information on see, [Confirm Potential Relationships from Related Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/confirm-potential-relationships.md).
4.  You can add objects to cases. For more information, see [Add to Case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/add-to-case.md).

**Parent Topic:**[Malware Analysis](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/malware-analysis.md)