Threat Intelligence Security Center

The TISC uses the following entities to store and organize vulnerability, product, and vendor intelligence data.

After you have created a case, you can view or add artifacts, such as security incidents, CIs, and indicators of compromise, to the case. These artifacts act as clues in solving the case.

Add observables such as IP addresses, domains, and hashes to External Dynamic Lists (EDLs) to automatically update threat intelligence feeds in your security infrastructure.

Add observables, indicators, or other objects to the case.

Field descriptions for the AI Report Styling Configuration form. Use these settings to configure the theme of the AI-generated threat intelligence reports.

Automated correlation automatically establishes relationships between threat intelligence records based on predefined rules, helping you identify connections between observables, indicators, and threat objects.

View threat intelligence feeds that automatically imports security data into your TISC ServiceNow instance. This enables real-time threat detection and response capabilities.

Campaign is defined as grouping of adversarial behaviors that describes a set of malicious activities or attacks, sometimes called waves that occur over a period of time against a specific set of targets.

Download and configure the CrowdStrike Falcon EDR integration to enable endpoint detection and response capabilities in your ServiceNow instance.

Enable or disable the Correlation rules or customize them according to your business requirements.

Enrich one or more observables to identify whether they're associated with known threats. The results are based on the enrichment integrations active in your environment.

Configure the appearance of AI-generated threat intelligence case reports by setting colors, fonts, and organizational details in the report styling record.

Configure sighting search integration to search your organization logs for one or more observables to determine how many times each observable appears, within a specified date range or number of days.

Scan selected observables for malware using Threat Intelligence to determine if they are malicious. Use this lookup to assess security threats from IP addresses, URLs, file hashes, and other observable types.

Confirm the relationships between the two SDOs.

Courses of action is an action taken either to prevent an attack or to respond to an attack that is in progress.

Cases are used to track information about a campaign or threat actor threatening your organization. After a case is created, you can add artifacts that allow you to review and analyze all related information from a single case or case task.

Create External Dynamic List (EDLs) for Palo Alto Networks. After you create EDLs, you can start creating entries for those EDLs.

Create taxonomies for the data source records.

Configure CrowdStrike Falcon EDR integration to enable continuous endpoint monitoring and receive real-time security alerts based on Threat Intelligence data from TISC.

Set up CrowdStrike Falcon Intelligence integration to perform threat lookups on observables in Threat Intelligence Security Center.

Edit the prompts in the threat intelligence extraction use cases to change how AI extracts threat entities from the documents that your analysts upload.

Customize the ServiceNow Otto for Threat Intelligence Security Center (TISC) skills to suit your requirements.

Data grows rapidly in tables with increased adoption of the platform. Some tables come within the base system with various data management policies, but other users are needed to implemented by themselves.

Data components are used to identify specific properties or values of a data source.

Data sources represent the various subjects/topics of information that can be collected by sensors/logs. Data sources also include data components, which identify specific properties/values of a data source.

Define an Indicator.

Observables can be retrieved from scheduled feed ingestion or from the import assistant. However, you can create observables, as needed.

Define courses of action to prevent an attack or to respond to an attack that is in progress.

Define a data component to identify the properties or values of a data source

Define a data source to represent the various subjects or topics of information.

Create inbound data exclusion rules in order to filter any type of data or any kind of incoming source records data.

Define identities who represent actual individuals, organizations, or groups.

Define the potential relationships between the objects.

Define relationships between the indicator object and other Use the relationships objects to link together two observables or an observable and SDO to explain how they relate to each other..

Define marking definitions to handle and share the requirements for the data.

Define relationships between the indicator object and other SDOs.

Define the potential relationships between the objects.

Define relationships between SDOs, except the indicator object.

Define relationships between SDOs and the observable object (SCO).

Define object sighting that describes that an object (malware, tool, threat actor, and so on) was seen.

Use this section to confirm the relationships between the observables.

Define relationships between observables.

Conveys information about cyber security related entities such as files, systems, and networks using the STIX Cyber-observable Objects (SCOs).

A threat intelligence feed is a real-time, continuous data stream that gathers information related to cyber risks or threats. RSS Feeds provides an easy way to stay up to date with your favorite security blogs or latest cyber security news.

Use this feature to add or remove observables in bulk.

Define threat actors who are individuals, groups, or organizations who act with malicious intent.

Define a threat event when an event that results in unauthorized access to and acquisition of nonpublic information or the disruption or misuse of any information system.

Define threat groupings as objects that have a shared context.

Define threat notes that convey information to provide further context or analysis that is not available in existing objects.

Define threat opinions as an assessment of the accuracy of the information in a STIX object.

Define threat reports that describe a threat actor, malware, attack technique, including context and related details.

Define tools as legitimate software that is used to perform attacks.

A vulnerability is a weakness or flaw in a software or hardware component that can be exploited by attackers to compromise confidentiality, integrity, or availability.

Use this section to define the approval rules and integrate the approval flow within the Import Intelligence section after submitting the data import.

Access all downstream actions generated from a vulnerability record to track remediation progress and understand the scope of response activities.

The TISC application includes automated logic to manage records that were received repeatedly from the same source. When identical or matching records are ingested multiple times from same source, the application ensures that the most recent record remains active while previously stored instances are identified as duplicates.

Customize published report templates by modifying their content fields and related lists to better meet your reporting requirements.

Fetch the observables related records data.

Fetch vulnerability related data such as configuration items, vulnerable entries, and business context.

Identities represent actual individuals, organizations or groups, and classes of individuals, systems, or groups. Identities apply for STIX 2.x.

Upload an unstructured document and let AI extract the threat observables and objects from its content. Review and correct the extracted entities before you submit the import.

Import the observables data by copying and pasting raw text or entering the free text.

Upload the standard data in the supported file formats such as STIX 2.x JSON, MISP JSON.

Upload the structured data in the supported file formats such as CSV, XLSX or XLS.

Upload the data in an unstructured format supported using the file formats such as TXT, CSV, JSON, XLS, XLSX.

Use this feature to manually import threat intelligence data into the repository, enabling analysts to ingest the relevant information from external sources as needed.

Indicators are artifacts observed on a network or operating system that are likely to indicate an intrusion. Typical IoCs are virus signatures and IP addresses, MD5 hashes of malware files or URLs, or domain names.

The Infrastructure SDO represents a type of Tactics, Techniques, and Procedures (TTPs). They describe any systems, software services, and any associated physical or virtual resources intended to support some purpose of an attack. Infrastructure applies for STIX 2.x.

You can configure some of the inputs or triggers for a generative AI skill. Inputs or triggers permit you to determine how and when a skill is used.

Use this section to understand the Threat Intelligence Security Center integrations.

An Intrusion Set is a grouped set of adversarial behaviors and resources with common properties. An Intrusion Set usually involves a single organization. Intrusion set applies for STIX 2.x.

In the Investigation Canvas, you can view the MITRE ATT&CK techniques and sub-techniques associated with all nodes currently present on the canvas.

Link the records that are related to the corresponding threat intelligence objects.

A Location represents a geographic location. Locations are primarily used to give context to other SDOs. Locations apply for STIX 2.x.

Malware Analysis captures the metadata and results of a malware. Malware analysis applies for STIX 2.x.

Malware is a type of TTP that represents malicious code. It refers to a program that is covertly inserted into a system. Malware applies for STIX 2.x.

Sighting search configurations define queries that search for observables across your security environment during investigations. Configure these queries to determine how often specific indicators appear in your data sources.

Configure advanced search parameters to create complex queries with logic operators and other features supported by your log store. Use these parameters when basic search criteria are insufficient for your investigation needs.

You can use the Threat Lookup Finding Calculator to calculate the observable findings based on the responses received from threat lookup vendor.

The marking-definition object represents a specific marking. Data markings typically represent handling or sharing requirements for data.

MITRE ATT&CK Technique Extraction method describes how the extraction methods are performed and associated techniques are verified for observables, objects, and RSS feeds.

Extract MITRE techniques automatically from observables or objects ingested from various data sources and from threat lookup results on observable records.

Generate an AI-based, structured, threat intelligence case report from the data in a case and export it for stakeholder distribution.

Use to generate a concise summary of a case, including its key findings and recommended next steps.

Sightings denote that an object was seen. Objects may be a malware, tool, threat actor, and so on.

Using the Visualizer, you can view the relationships between objects, observables and indicators which provides context for you to further investigate. The Visualizer uses colors and icons to illustrate various information about the objects.

Observables represent stateful properties (such as the MD5 hash of a file or the value of a registry key) or measurable events (such as the creation of a registry key or the deletion of a file) that are pertinent to the operation of computers and networks.

Palo Alto Networks integration after configuration enables the threat analysts to add malicious IP addresses, URLs, and domains to External Dynamic List (EDL) or remove these entries from EDL after confirmation as non-malicious or clean.

The application uses automated correlation to establish potentially possible relationships between two SDOs, two Observables or an observable and SDO.

The CrowdStrike feed enables users to ingest indicators, actors, reports, malware, vulnerabilities, and their associated context from the CrowdStrike Falcon Intelligence feed into TISC.

The following details the system properties for CrowdStrike.

Register the Microsoft Defender EDR in the Microsoft Azure portal and grant the read and write access to the application.

Use the relationships objects to link together two observables or an observable and SDO to explain how they relate to each other.

Delete records from Threat Intelligence library.

Remove observables from an External Dynamic List (EDL) to stop blocking or monitoring specific observables. Use this when observables are no longer relevant or incorrectly categorized.

The following section describes the system properties applicable to TISC reports.

When intelligence records are added to a case, all associated MITRE Techniques are automatically rolled up to the case level.

Use this section to understand how enrichments actions are performed on observables and other objects.

Use this section to understand how enrichments actions are performed on case(s).

Use this section to understand on how to upload the secure file attachments to the case(s).

Send observables to the EDR security tool.

Before you use the Threat Intelligence Security Center, you must download it from the ServiceNow Store.

Configure a webhook to subscribe to events in Threat Intelligence Security Center.

Before you use Shodan integration, you must download it from the ServiceNow Store.

The integration between the Threat Intelligence Security Center (TISC) and Splunk lets you filter and pull relevant threat intelligence observables data into Splunk.In Splunk, you can use this data to generate security alerts.

View the list of all the subscribed webhook triggers for the current webhook.

Threat Actors are individuals, groups, or organizations who act with malicious intent. Threat actors applies for STIX 2.x.

The Threat Analyst Workbench page consists of cases and case tasks that are under Threat Analysts and their team.

An event or situation that has the potential for causing undesirable consequences or impact.

A Threat Groupings object explicitly asserts that the referenced STIX Objects have a shared context. Threat groupings applies for STIX 2.x.

Configure threat intelligence data sources to automatically import security indicators into your ServiceNow instance. Use feeds to keep threat data current and enhance security monitoring capabilities.

The Threat Intelligence Security Center Catalog is a curated list of Threat Intelligence feeds and enrichment integrations available in the application. You can enable them after adding the required information and schedule the feed to automatically ingest Threat Intelligence data on a set frequency.

Structured Threat Information Expression (STIX) is a language and serialization format used to exchange cyberthreat intelligence (CTI). Trusted Automated Exchange of Intelligence Information (TAXII) is a protocol used to exchange cyberthreat intelligence (CTI) over HTTPS.

A threat library is defined as a group of organized objects and entities that serve the organizations with structured and unstructured security threat information.

Threat Intelligence Security Center (TISC) enables you to collaborate with threat intelligence teams by collecting, processing, and analyzing threat intelligence feeds in a centralized workspace.

A Threat Note conveys informative text to provide additional analysis not contained in the STIX Objects, Marking Definition objects, or Language Content objects which the Note relates to. Threat notes applies for STIX 2.x.

An Opinion is an assessment of the accuracy of the information in a STIX Object produced by a different entity. Threat opinions apply for STIX 2.x.

Threat Reports are collections of threat intelligence focused on one or more topics. Threat reports apply for STIX 2.x.

Define threat score for the observable(s) records that are generated based on the user defined parameters. The base system is provisioned with one threat scoring rule, which can be customized and enabled accordingly.

Allow access controls specific to a case.

By default, the Threat Hunting playbook is deactivated. Activate it in Workflow Studio to initiate the playbook automatically for the applicable Case records.

Use this section to create and add new entities, including observables or objects, directly from the investigation canvas.

If a Case does not meet the auto-trigger conditions for the Threat Hunting playbook, you can attach the playbook to the Case manually.

Add timeline events to the investigation canvas by adding the related entities to the canvas.

Create a vendor record to track organizations that supply products affected by vulnerabilities. Associate vendors with products or add vendor comments to document their responses and remediation guidance.

Configure the Threat Intelligence Security Center (TISC) integration with Splunk to import threat intelligence data, set up indicator collections, and analyze search matches using dashboards.

The Administration section provides access to Rules Engine module that allow the administrators to configure rule-driven processing of data within TISC.

Security Control Lists (SCLs) are predefined classification list that helps the Threat Intelligence Analysts determine how observables should be treated within the application and across security tools.

Threat entity types that AI extraction identifies in an uploaded document, and the AI-generated fields that it adds to the extracted records.

Use this section to view all the manually exported records.

Learn how to analyze an IOC’s which are a threat and notifying the security incident team.

The following table lists all the available API endpoints provided as part of TISC.

Define approval rules to control whether certain profiles or groups require approval before processing the inbound intelligence.

Define approval rules to control whether certain users require approval before sharing the shared intelligence.

Approving External Dynamic List (EDL) entries is part of the pre configuration. You must approve the EDL entries before the entries are activated on EDLs for the firewall to retrieve the entry and apply the security policy.

Associate one or more MITRE technique to a case.

Attack patterns are a type of Tactics, Techniques, and Procedures (TTPs) that describe the methods that adversaries attempt to compromise targets.

Use these defined steps to learn how you can use the automated flows in TISC and its capabilities.

Automated Outbound Intelligence Sharing enables the seamless and automatic distribution of intelligence records to external systems.

Automated TAXII Collections automatically add intelligence records to TAXII Server Collections for seamless distribution to trusted external partners.

Learn how to automate sharing of high-risk IOC's with trusted partners.

Import redaction categories. Bulk importing of redaction categories and their associated values.

This section describes the various actions that you can perform on the investigation canvas.

View Case Reports.

Several types of components are installed when you download and activate the Threat Intelligence Security Center application, including user roles and properties.

Configure API credentials and enrichment behavior through the dedicated Have I Been Pwned (HIBP) configuration tile in TISC integration settings.

Inbound Intel Sharing Groups enable administrators to group similar inbound intelligence sharing profiles together. These groups can be used to define approval rules that apply to all profiles within the group.

This section describes the inbound intelligence sharing profiles used to receive intelligence from external organizations into TISC.

Outbound Intel Sharing Groups allow you to combine multiple profiles and use them collectively when sharing data.

Set up threat intelligence enrichment integrations to automatically gather additional context about observables, search for sightings, or perform threat lookups from external security vendors.

You can share threat intelligence data between TISC instances using one of the following methods.

The Timeline component in the investigation canvas provides a chronological overview of all events related to a selected entity. This feature enables analysts to track actions, updates, and changes over time, offering a comprehensive historical perspective of the entity’s activity. As a result, it supports effective temporal threat analysis.

Use this section to configure tooltips for node map relationships on the investigation canvas.

You can maintain TAXII feeds for sharing STIX-formatted information. Each TAXII feed contains one or more TAXII collections.

Configure the TISC add-on in Splunk to connect your account, define data inputs, and pull observable records into the KV store for search and analysis.

Set up the features, components, and integrations that you need to provide service and support to your customers.

Create canvas to add observables from threat intelligence library.

Use generative AI to draft a structured case report from the data in the selected case, then review and publish it.

Generate a case report from a published report template, such as a post-investigation report or an executive summary, and then preview, publish, and share it.

Create a case report from the Reports module in Threat Intel Library.

Create case tasks to associate with case(s).

Create a Common Weakness Enumeration (CWE) record to represent a weakness identified in a system or product, and link it to relevant vulnerabilities.

This section outlines the functionality that enables users to share intelligence records directly from the Threat Intelligence (TI) Library within the TISC application.

Create an intelligence report from the Reports module in the Threat Intelligence Library by using a published intelligence template and populating it with intelligence from library lists and slash commands, independent of a case.

Create a threat intelligence record directly from a related records list and link it to the record that you're viewing, without leaving your investigation.

Create New Product feature allows you to record the product’s version, vendor, and classification details, to ensure products are accurately linked to vulnerabilities and related records.

Create a remediation record to document a fix or workaround for a vulnerability affecting a specific product.

Create a security incident to track and manage remediation efforts for identified vulnerabilities. This process helps prioritize security responses and maintain audit trails.

Create security incidents and associate observables to the security incidents from a TISC case.

Use this section to learn how to configure and define TAXII collections for sharing intelligence.

Users can be created in the ServiceNow TISC instance with any valid user role [sn_sec_tisc.api_obs_read_access].

Create a vulnerability assessment to evaluate and document security risks from zero day vulnerabilities in your environment. Use this when you want to assess the potential impact of newly discovered vulnerabilities that lack available patches.

Integrate CrowdStrike Falcon Intelligence with Security Operations to enhance threat detection and response capabilities with real-time cyber security intelligence.

Configure the CrowdStrike NextGen SIEM integration with your Falcon API credentials so that analysts can search CrowdStrike log data for activity that matches an observable.

Use the left navigation to navigate to the Administration module within Threat Intelligence Security Center. View the following modules of TISC data administration to set filtering rules, approval rules, define threat score, and manage notifications.

The Threat Intelligence Security Center is provisioned with archival rules in the base system for the TISC table. The related records are also added in the base system to the TISC archive rule.

Threat Intelligence Security Center supports manual export of observables, indicators, and cases in the recommended formats.

Data Migration Job Configuration in TISC enables you to move the existing Threat intelligence plugin data to TISC plugin data directly.

Data migration is a process when you move all your data from a classic UI to TISC.

Threat Intelligence Security Center (TISC) provides a solution that automates the data collection and processing which helps reduce the burden on Threat Intel Analysts by avoiding manual steps involved.

The following details the system properties for Microsoft Defender EDR.

Define an attack pattern to help threat analysts categorize the attacks.

Define a campaign to group adversarial behaviors.

Define an Infrastructure that is any systems, software services, and any associated physical or virtual resources intended to support some purpose of an attack.

Define an intrusion set that is a grouped set of adversarial behaviors and resources with common properties.

Define a geographic location to provide more context to other STIX Domain Objects (SDOs).

Define malware analysis that captures the metadata and results of a particular static or dynamic analysis performed on a malware instance or family.

Define a malware that represents malicious code.

Delete threat intelligence library records such as observables, indicators, and objects.

View the destroy rules that are provisioned in the base system.

Learn how to analyze and disseminate observables which are related to threat.

If any conkeyrefs are broken, re-add them from the doc/source/reuse/domain-separation/domain-separation-overview.dita file.Domain separation is supported for Threat Intelligence Security Center. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

Download and install the Threat Intelligence Security Center application to enable threat intelligence capabilities in your ServiceNow instance.

Duplicate a threat feed to create an exact copy with all associated observables, indicators, and actors when you want to modify settings without affecting the original feed.

Create a copy of a report template to make incremental updates.

Activate approval workflows to require approval or rejection of EDL entries before they take effect.

TISC Endpoint Detection and Response (EDR) integrations focuses on identifying and addressing security threats at an endpoint level.

Elasticsearch is a distributed, RESTful search and analytics engine that easily integrates with Security Operations.

This section provides a clear visibility to the TISC administrators on the emails that are sent out using the configured email notification rules.

Use email notifications to send selected users email notifications about specific tasks within the application, such as updates to observables/indicators/various other objects.

Use this feature to restrict a case and provide list of groups and users who can access it.

The Threat Intelligence Security Center base system does not include any pre-configured integrations. This section provides instructions for configuring both ServiceNow and third-party integrations.

Use this error logs section to view all the audit entries which are marked as error in the status for a particular webhook.

Define expiration rules for various observables or a combination of various source objects or indicators source that are created in TISC.

Expiration rules are basically helpful to set the expiration time for the source records. The aggregate record inherits the highest expiration time from its corresponding sources records.

Use the export feature to manually export the intelligence data in various formats.

This section describes the record limitations and its properties while exporting data.

This section describes the external user access for case tasks.

Threat Intelligence Security Center extracts observables from indicators that use the STIX pattern type and links the extracted observables back to the source indicator.

Field Mapping allows you to configure how each field in a data feed such as Text, CSV or JSON is interpreted and assigned to the corresponding observable.

The following tables helps you to understand the relationship tables between entities and enrichment tables that are used in automated flows.

Sighting Search Configurations define how threat intelligence data is searched and matched against your environment. Configure these settings to customize threat detection and improve security monitoring accuracy.

Run the Have I Been Pwned (HIBP) enrichment on an email address or domain name observable to determine whether it has been involved in a known data breach.

The Have I Been Pwned (HIBP) integration enables you to enrich email address and domain observables with breach data directly within the TISC.

Import the taxonomy records.

Inbound intelligence sharing in TISC allows you to create profiles of external systems or devices that can submit intelligence to it.

TISC integration with SIR Workspace provides threat intelligence context for observables and threat entities in the security incident workspace.

This section provides instructions for configuring and enabling the Threat Intelligence integrations.

Threat intelligence sharing provide a centralized view of various threat data sharing sources. The feature allows you to monitor the threat records that are being processed for intelligence sharing and manage the approval workflows for different types of intelligence data.

Outbound Intel Sharing Templates enable you to define and control the data shared externally from the Threat Intelligence Security Center (TISC).

Threat Intelligence external sharing in TISC outlines the guidelines and functionalities for both automated and sharing from GUI of threat intelligence within and across organizations. This feature focuses on key areas such as sharing exclusion rules, approvals, data retention, and auditing to confirm secure, compliant, and efficient intelligence sharing.

The Investigation Canvas is a key significant feature, which provides more valuable information for the Threat Intelligence (TI) analysts. It provides a structured framework by mapping one to one or one to many relationships and visualizing information related to observables, indicators of compromise (IOCs), or entities.

Learn how to automate enrichment of IOC’s using flows when they match a certain criterion.

IoC repository contains STIX objects, each of these objects contain a specific piece of information.

Display all JSON feeds configured in your ServiceNow instance to review their settings and status. Use this to monitor data integration endpoints and troubleshoot feed issues.

This section provides a curated list of key Knowledge Base (KB) articles related to Threat Intelligence Security Center (TISC). These resources include best practices, configuration guidance, compatibility information, and operational workflows to help you effectively manage threat intelligence and security within TISC.

Key terms and definitions used in TISC to help you understand threat intelligence concepts and navigate the interface effectively.

The Threat Intelligence Security Center (TISC) platform provides technology solution for aggregation, management and operationalization of threat intelligence.

The Threat Intelligence Security Center objects home page consists of the following features.

Use this section to link a canvas from a case.

Use this section to create and link a case(s) from an investigation canvas.

Use this section to link an existing case from the investigation canvas.

Use Relationship Graph to link the nodes. Use filters to select specific nodes to investigate.

Manage the groups that are imported from the MITRE TAXII collections. Groups are sets of related intrusion activity that are tracked by a common name in the security community. Analysts track clusters of activities using various terms such as threat groups, activity groups, threat actors, intrusion sets, and campaigns. In STIX, groups are known as intrusion sets.

Manage the malware information that you imported from the MITRE TAXII collections. It is a type of TTP that represents malicious code.

Manage the matrices that are imported from the MITRE TAXII collections. Matrices are a collection of tactics and techniques. You can view the matrices to review if your collections are available in the MITRE-ATT&CK repository.

Manage the mitigations that are imported from the MITRE TAXII collections. Mitigations enable you to prevent an adversary from successfully executing techniques or sub-techniques against your organization. In STIX, mitigations are known as course of actions.

Manage the techniques that are imported from the MITRE TAXII collections. The techniques contain various ways attackers have developed to employ a given tactic. You can review and deactivate techniques that are not relevant to your organization. In STIX, techniques are known as attack patterns.

This section describes how to configure manual sharing via GUI and automated intelligence sharing between TISC instances. It outlines the setup of inbound and outbound intelligence profiles, required roles, authentication configuration, and exclusion rules in both the source and target instances.

The MITRE-ATT&CK repository stores MITRE data separately from Threat Intel Library data in the Intelligence Library.

MITRE filters enables you to create and save filters for Tactics, Techniques, and Procedures (TTPs) associated with specific adversaries and other MITRE technique attributes.

Manage the MITRE relationships information that you imported from the MITRE TAXII collections.

Manage the tools information that you imported from the MITRE TAXII collections. Tools are legitimate software that are used by threat actors to perform attacks.

Fields on the review record that MITRE ingestion creates for a revoked tactic and technique pair, and the values that each field can hold.

Roll up of MITRE technique associations from observables, indicators, objects, and security incidents which are linked or unlinked from a case record.

Send observables to the EDR security tool.

Install and configure the Microsoft Defender for EDR integration from the ServiceNow Store.

Integration with the Microsoft Defender for EDR allows Cyber Threat Intelligence (CTI) analysts to automatically push malicious or suspicious IP addresses, domains, file hashes, and URLs to Microsoft Defender for continuous monitoring and real-time alerting.

Configure a new threat intelligence feed.