How are object relationships aggregated from source to aggregated tables in TISC? Issue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } ProblemA user is inquiring about the processing flow for object-to-object relationships in TISC Threat Intelligence, specifically how relationships are aggregated from the source table (sn_sec_tisc_m2m_object_source) to the aggregated table (sn_sec_tisc_m2m_object). The user is considering customizing their approach to create relationships directly in the aggregated table and seeks clarification on the out-of-the-box (OOTB) behavior to avoid data inconsistencies or unintended side effects. Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Not release specific. Cause<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Root Cause1. The aggregation process is event-driven, triggered by the Source Processing Queue after feed ingestion completes. 2. Direct insertion into the aggregated table skips critical steps like source attribution, de-duplication, and downstream logic (e.g., threat scoring, MITRE rollups). 3. Missing or incorrectly configured entries in the Source Processing Queue prevent the aggregation process from executing. Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } OOTB Processing Flow for Object records and its relationships : Ingestion Point-Of-View:The sn_sec_tisc_m2m_object_source records are not independently processed. They are aggregated as a side-effect when the parent object source records (sn_sec_tisc_object_source) on both endpoints complete the standard processing pipeline.Step 1 — Feed Ingestion:When a feed runs (TAXII, CrowdStrike, MISP, etc.), the response processor creates object source records in sn_sec_tisc_object_source and relationship records in sn_sec_tisc_m2m_object_source, where source_ref and target_ref point to those object source records.Step 2 — Trigger:Business Rule: "Set Source Records Ready for Processing" on sn_sec_cmn_integration_run fires when the feed run completes and creates a record in sn_sec_tisc_source_processing_queue.Step 3 — Processing (Scheduled Jobs, every 20 seconds):"Populate aggregated records for object source records" — finds or creates the aggregate record in sn_sec_tisc_object, links it via the parent field"De-duplicate Object Source Records" — identifies duplicate source records and marks them with processing_status = duplicate"Aggregate Object Source Records" — for each object source record with processing_status = ready_for_aggregation:Consolidates source-level field values into the aggregate recordLooks up sn_sec_tisc_m2m_object_source relationships where source_ref matches the object source record being aggregatedFor each relationship found, reads the parent (aggregate reference) of both the source_ref and target_ref object source recordsIf a matching relationship already exists in sn_sec_tisc_m2m_object (same source_ref + target_ref + relationship_type), it updates the metadataIf no match exists, it creates a new record in sn_sec_tisc_m2m_object with the aggregate-level source_ref, target_ref, and relationship_typeSource records with duplicate_of populated are marked processing_status = duplicate; others are marked processing_status = processedThis entire flow is designed for feed-based ingestion, where all entities are created together as part of a single integration run.