> ## Documentation Index > Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt > Use this file to discover all available pages before exploring further. # About Observables > Track and manage observables like IP addresses, domains, and file hashes in Blink case management. Observables refer to data that indicates a system may have been infiltrated by a cyber threat. They provide cybersecurity teams with crucial knowledge after a data breach or another breach in security. In this section, you can create and manage Observables for your Cases. To learn more about Observables and their role in Alerts and Case Management, please refer to our detailed guide available [here](/docs/case-management/blinks-automated-case-management/blinks-automated-case-management). *** ## Types of Observables 1. Unknown 2. Hostname 3. IP Address 4. MAC Address 5. URL String 6. Username 7. Email Address 8. URL String 9. File Name 10. Hash 11. Process Name 12. Resource UID 13. Port 14. Subnet 15. Command Line 16. Country 17. Process ID 18. HTTP User Agent 19. CWE Object : uid 20. CVE Object: uid 21. User Credential ID 22. Endpoint 23. User 24. Email 25. Uniform Resource Locator 26. File 27. Process 28. Geo Location 29. Container 30. Registry Key 31. Registry Value 32. Fingerprint 33. Other *** ## Creating a New Observable **Note:** * You can assign multiple observables to a single case or a single observable to many cases. * You can also create observables directly from the main Observable table. Simply navigate to the Observable table and click on the 'New Observable' button located in the top-right corner and fill out the required parameters. To attach an Observable to a Case, first double-click on the desired Case. In the [overview section](/docs/case-management/cases/case-overview#case-overview) of the selected Case, go to the ['Observables' tab](/docs/case-management/cases/case-overview#linked-observable). Then, click the "New Record" button in the top-right corner.
| Fields | Description | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Name | The name of the Observable. | | Observable Type | The type of the Observable. | | Content Type | The content value of the Observable | | Description (Optional) | A written description for the Observable | | Reputation | An observable's reputation is a rating that shows how safe or risky it is based on its actions or traits. This helps users decide if they can trust the observable or if they should be cautious. The reputation options range from **Unknown** (no information) to **Malicious** (potentially harmful), with levels like **Very Safe**, **Safe**, **Exercise Caution**, and **Suspicious/Risky** to indicate varying degrees of trustworthiness. | | Enrichment Data | The enrichment data that provides additional information and context on the Observable | | Linked Cases | The Name and ID of the Case(s) you want to link to this current Observable. | | Linked Attachments | The Name and ID of the Attachment(s) you want to link to this current Observable. | | Linked Tasks | The Name and ID of the Task(s) you want to link to this current Observable. | | Linked Alerts | The Name and ID of the Alerts(s) you want to link to this current Observable. Hover over the 'Linked Alerts' column in the observables table to see the relations associated with each observable. | | Linked Observables | The Name and ID of the Observable(s) you want to link to this current Observable. |
Once completed, select the **Add Observables** button in the bottom-right corner. *** ## Observable Relations Hover over the 'Linked Alerts' column in the observables table to see the relations associated with each observable. Please note, you cannot make any changes directly to the relations, via the 'Linked Alerts' column in the observable table. To make any changes, you can do so via the [Add or Update Observable Relation](/docs/case-management/case-management-workflow-actions/observable-actions#add-or-update-observable-relation) action. *** ## Editing Observables **NOTE** Please note that you can also **Edit Observable(s)** directly within the **table tab** of a **case overview**. Simply double-click on the table row to make any necessary changes. Once you have completed your edits, click anywhere on the screen to save the changes. Select the Observables you would like to edit and click on it. The 'Edit Record' Form will appear. Make any necessary changes to the fields, then click 'Save' in the bottom-right corner. The changes you made will be reflected in the selected observables. *** ## Deleting an Observable

Navigate to the observable you want to delete and select icon.

The **delete** option will appear. Click 'Delete', and the selected observable will be removed from your existing observables.