Threat Intelligence Orchestration
concept brazil Updated Sep 10, 2026 2 min read c_ThreatIntelligenceOrchestration.md
Threat Intelligence Orchestration activities allow users to determine whether a threat has been seen before in other security incidents or on other systems using workflow orchestration.
For more information on editing Security Incident Response Orchestration workflows or creating custom workflows, see Getting started with workflows and Workflow editor Workflow editor.
- Set up Threat Intelligence Orchestration
Prior to using Threat Intelligence Orchestration, perform steps to set up various parts of the system, including populating the CMDB, configuring the MID Server, and configuring credentials. - Threat Intelligence Orchestration workflows and activities
The base system includes workflows and workflow activities you can use to automate actions on your instance.
Parent Topic:Threat Intelligence
Related topics
Understanding Threat Intelligence
MITRE-ATT&CK framework overview
Threat Intelligence administration
47 lines · 2.4 KB
--- title: Threat Intelligence Orchestration description: Threat Intelligence Orchestration activities allow users to determine whether a threat has been seen before in other security incidents or on other systems using workflow orchestration. locale: en-US canonical_url: https://www.servicenow.com/docs/r/security-management/c\_ThreatIntelligenceOrchestration.html release: brazil topic_type: concept last_updated: "2026-09-10" reading_time_minutes: 2 breadcrumb: [Threat Intelligence, Enterprise security case management applications, Security Operations] --- # Threat Intelligence Orchestration Threat Intelligence Orchestration activities allow users to determine whether a threat has been seen before in other security incidents or on other systems using workflow orchestration. For more information on editing Security Incident Response Orchestration workflows or creating custom workflows, see [Getting started with workflows](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/build-workflows/c_WorkflowOverview.md) and [Workflow editor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/build-workflows/workflow-editor.md) [Workflow editor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/build-workflows/workflow-editor.md). - **[Set up Threat Intelligence Orchestration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/t_ThreatIntelligenceOrchestrationSetup.md)** Prior to using Threat Intelligence Orchestration, perform steps to set up various parts of the system, including populating the CMDB, configuring the MID Server, and configuring credentials. - **[Threat Intelligence Orchestration workflows and activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-orch-wfs-and-activities.md)** The base system includes workflows and workflow activities you can use to automate actions on your instance. **Parent Topic:**[Threat Intelligence](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intel-landing-page.md) **Related topics** [Understanding Threat Intelligence]() [Set up Threat Intelligence]() [IoC Repository]() [MITRE-ATT&CK framework overview]() [MITRE D3FEND framework]() [MITRE ATLAS framework]() [Threat Intelligence administration]() [Threat Intelligence integrations]() [Security Case Management]()
| title | Threat Intelligence Orchestration |
| description | Threat Intelligence Orchestration activities allow users to determine whether a threat has been seen before in other security incidents or on other systems using workflow orchestration. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/security-management/c\_ThreatIntelligenceOrchestration.html |
| release | brazil |
| topic_type | concept |
| last_updated | 2026-09-10 |
| reading_time_minutes | 2 |
| breadcrumb | Threat IntelligenceEnterprise security case management applicationsSecurity Operations |