> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-management/indicator-relationships.md).

# Indicator Relationships

Relationships are connections between different Cortex XSOAR objects. These relationships can be IP addresses related to one another, domains impersonating legitimate domains, and more. These relationships enable us to enhance investigations with information about indicators and how they might be connected to other incidents or indicators. Within an incident, the Canvas enables you to see if there are any relationships between indicators in the incident and other indicators in the system.

{% hint style="info" %}

### Note

This feature is available only for users with a TIM license.
{% endhint %}

For example, if we have a phishing incident with several indicators, one of those indicators might lead to another indicator, which is a malicious threat actor. Once we know who the threat actor is, we can further investigate to see the incidents it was involved in, its known TTPs, and other indicators that might be related to the threat actor. Our initial incident which started off as a phishing investigation immediately becomes a true positive and it is related to a specific malicious entity.

{% hint style="info" %}

### Note

To fully benefit from the Indicator Relationships feature, make sure that your **Common Types** content pack is updated for new fields and layouts to be added and populated.
{% endhint %}

Relationships are created from threat intel feeds and enrichment integrations that support automatic creation of relationships. Based on the information that exists in the integrations, the relationships are formed.

In addition, you can manually create and modify relationships. This is especially useful when a specific threat report comes out, for example, Unit 42’s SolarStorm report. These reports contain indicators and relationships that might not exist in your system, or you might not be aware of their connection to one another.

If a relationship is no longer relevant, you can revoke it. This might be relevant for example, if a known malicious domain is no longer associated with a specific IP address.

**Example**

In this example, we will walk through a basic incident that has some indicators. We will see how you can use the relationships feature to further your investigation.

1. When opening our incident, we see that the severity is low, however the incident has two indicators.

   ![relationships\_new-incident.png](/files/v6yynWHVB2ogV9D4Pdyn)
2. When we click the file hash indicator, neither the **Info** nor **Relationships** tabs have any additional details. This would seem to indicate that the file is harmless.

   ![relationships\_harmless-file.png](/files/VPjgEfyFh5Ge2smdDSZd)
3. When we click on the IP address indicator, we immediately see under the **Info** tab that the indicator was ingested from a threat intel feed. This already bears further investigation.

   ![relationships\_ipIndicator-info.png](/files/7nQBAOboEefhNnMZow7O)
4. When we navigate to the **Relationships** tab, we see that this indicator is related to a campaign.

   ![relationships\_ipIndicator-relationships.png](/files/p7UEIs00oiTpW5w6WOI2)

   What started off as a low severity incident, has become a lot more threatening.
5. We navigate to the **Canvas** tab of our incident to see what else we can learn about these indicators.
6. Under the **Indicators** tab in the **Add entity to canvas** pane, we drag our IP indicator onto the canvas.
7. By hovering over the IP indicator, we can select the indicator menu, and click **Expand**.

   ![relationships\_ipIndicator-menu.png](/files/LIBn1HdBzelpByTZG6qn)

   The indicator for the campaign we saw earlier is now added to the canvas.
8. We hover over the campaign indicator we found and once again click **Expand**.

   The canvas is now populated with all of the indicators related to this campaign.

   ![relationships\_harmless-campaign.png](/files/BSbw94DafRbwYGmAQktm)

   We can now further research our incident by learning more about the threat actor behind the campaign, its techniques and possible targets, and more.

   By leveraging the relationships and canvas, we were able to get a more complete picture of our incident within a few clicks.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-management/indicator-relationships.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.