View MISP Feeds

task australia Updated Sep 10, 2026 1 min read view-oob-misp-feeds.md

Raw file servicenow.com

View configured MISP feeds to monitor threat intelligence sources and verify feed status in your ServiceNow instance.

Before you begin

Role required: sn_sec_tisc.analyst

Procedure

Navigate to Workspaces > Threat Intelligence Security Center.
Select the Integrations icon.

Select MISP.

The MISP feeds within the base system are described in this table.

Threat Feed	Description	URL
DigitalSide Threat Intel OSINT Feed	Data source to fetch Open Source Cyberthreat Intelligence information from DigitalSide Threat-Intel OSINT feed, which is mostly based on malware analysis and compromised URLs, IPs and domains.	https://osint.digitalside.it/Threat-Intel/digitalside-misp-feed/manifest.json
URLhaus IOCs	URLhaus is a project from abuse.ch with the goal of sharing malicious URLs that are being used for malware distribution.	https://urlhaus.abuse.ch/downloads/misp/manifest.json
Malware Bazaar	MalwareBazaar is a project from abuse.ch with the goal of sharing malware samples with the infosec community, AV vendors and threat intelligence providers.	https://bazaar.abuse.ch/downloads/misp/manifest.json
ThreatFox IOCs	ThreatFox is a free platform from abuse.ch with the goal of sharing indicators of compromise (IOCs) associated with malware with the infosec community, AV vendors and threat intelligence providers.	https://threatfox.abuse.ch/downloads/misp/manifest.json

Note:

Only REST endpoint URLs ending with [/manifest.json] are supported for MISP feed types.

Select Edit to edit the feed and make necessary updates.
Select Save to apply the changes.

Parent Topic:View Threat Intel Feeds

Keywords MISP feedsURLhausMalware BazaarThreatFox IOCs

52 lines · 2.8 KB Wrap lines

---
title: View MISP Feeds
description: View configured MISP feeds to monitor threat intelligence sources and verify feed status in your ServiceNow instance.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/view-oob-misp-feeds.html
release: australia
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [MISP feeds, URLhaus, Malware Bazaar, ThreatFox IOCs]
breadcrumb: [View Threat Intel Feeds, Threat Intelligence Feeds, Integrate, Threat Intelligence Security Center, Security Operations]
---

# View MISP Feeds

View configured MISP feeds to monitor threat intelligence sources and verify feed status in your ServiceNow instance.

## Before you begin

Role required: sn\_sec\_tisc.analyst

## Procedure

1.  Navigate to **Workspaces** &gt; **Threat Intelligence Security Center**.

2.  Select the **Integrations** icon.

3.  Select **MISP**.

    The MISP feeds within the base system are described in this table.

    |Threat Feed|Description|URL|
    |-----------|-----------|---|
    |DigitalSide Threat Intel OSINT Feed|Data source to fetch Open Source Cyberthreat Intelligence information from DigitalSide Threat-Intel OSINT feed, which is mostly based on malware analysis and compromised URLs, IPs and domains.|[https://osint.digitalside.it/Threat-Intel/digitalside-misp-feed/manifest.json](https://osint.digitalside.it/Threat-Intel/digitalside-misp-feed/manifest.json)|
    |URLhaus IOCs|URLhaus is a project from abuse.ch with the goal of sharing malicious URLs that are being used for malware distribution.|[https://urlhaus.abuse.ch/downloads/misp/manifest.json](https://urlhaus.abuse.ch/downloads/misp/manifest.json)|
    |Malware Bazaar|MalwareBazaar is a project from abuse.ch with the goal of sharing malware samples with the infosec community, AV vendors and threat intelligence providers.|[https://bazaar.abuse.ch/downloads/misp/manifest.json](https://bazaar.abuse.ch/downloads/misp/manifest.json)|
    |ThreatFox IOCs|ThreatFox is a free platform from abuse.ch with the goal of sharing indicators of compromise \(IOCs\) associated with malware with the infosec community, AV vendors and threat intelligence providers.|[https://threatfox.abuse.ch/downloads/misp/manifest.json](https://threatfox.abuse.ch/downloads/misp/manifest.json)|

    **Note:**

    Only REST endpoint URLs ending with \[`/manifest.json`\] are supported for MISP feed types.

4.  Select **Edit** to edit the feed and make necessary updates.

5.  Select **Save** to apply the changes.


**Parent Topic:**[View Threat Intel Feeds](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/base-system-threat-intel-feeds.md)