Import data using AI · SN Doc Reader

Upload an unstructured document and let AI extract the threat observables and objects from its content. Review and correct the extracted entities before you submit the import.

Before you begin

Important: Some generative AI skills, AI agents, and agentic workflows are turned on by default. For more information, see AI agents, skills, and agentic workflows on by default.

AI extraction is available only when the following prerequisites are met:

Threat Intelligence Security Center-Advanced must be installed.
ServiceNow Otto for Threat Intelligence Security Center (TISC) must be installed.
The Extract information from documents skill must be enabled. For more information, see Now Assist extract information from documents.

Role required: sn_sec_tisc.analyst

About this task

Threat advisories, vendor reports, and screenshots may carry indicators of compromise inside prose rather than in a structured file. AI extraction reads the content of an uploaded document, identifies the threat entities it contains, and presents them for your review. You can import them without transcribing each value.

Procedure

Navigate to Workspaces > Threat Intelligence Security Center.

Threat Intel Library page is displayed.
Select Import Intelligence.

Alternatively, navigate to Imports and exports > New import or Case Record > Import Intelligence.
Select the Import using AI card.

The supported file types are PDF, DOCX, JPEG, and PNG.

In Choose extraction type, select the type of extraction to run.

Extraction type	Description
Extract entities only	Returns the type and the value of each threat entity found in the document.
Extract entities with rationale	Returns the type and the value of each threat entity, and adds the AI-generated Analysis Score and Analysis Reasoning values. For the attributes captured in the reasoning, see AI extraction supported entities and fields.

Select Upload file and select the file to import.

Note:

Upload one file at a time, up to 5 MB. If you attach a file in an unsupported format, or attach more than one file, an error is displayed when you select Done. To replace the attached file, remove it and then attach the file you want.
Under Set definitions, fill in the fields.

Field	Description
TLP	Select the TLP indicator from the drop-down list to be applied for the imported records.
Confidence (0-100)	Define the confidence value. This value is applied to every imported record. It's separate from the AI-generated Analysis Score.
Expiry Period (days)	Enter the expiry period of the associated observables. The expiration date of each imported record is calculated from the current date and this value.Note: This is a mandatory field.
Add Observable(s) to security Control List	Select this option to add observables to the appropriate security control list. The available options in the drop-down list are Allow list, Deny list, and None. The default option is None.
Add Tags	Add tags to annotate records ingested from this source. Start typing the tag name in the Search bar to choose the available tags in the system or enter new tag name and select Add to assign it.
Select a Taxonomy	Select the taxonomy for the imported data. For more information, see Creating Taxonomies.

7. Select **Next**.

Use the import record link if you want to track the import separately.

\[Omitted image "tisc-import-assistant-review.png"\] Alt text: TISC AI Import Assistant Review Screen

The extracted entities are displayed on the review screen. If no threat entities are found in the document, the message `No threat entities were found in the provided content.` is displayed.

Review the extracted entities before submission.

Important:

Review the AI-generated results for accuracy. AI identifies and classifies the entities from the content of your document, and the classification can be incorrect.
- The content tree groups the extracted entities as Observables and Objects, with a count for each group.
- Select a group in the content tree to display its records in the list.
- The columns marked with the AI icon hold AI-extracted values. For the field descriptions, see AI extraction supported entities and fields.
To correct the classification of an entity, select the records, select Update Type, and then select the type to apply.

The records move to the group for the type you selected, and the counts in the content tree are updated.
To exclude entities from the import, select the records and select Delete.
Select Submit.

Note:
- The imported records are processed into source records and then into aggregated records. The Analysis Score and Analysis Reasoning values are carried into the Additional context section of the source and aggregated records.
- Depending on the approval rules configured for your instance, the import record can be routed to an approver before processing.
Select View Status to view the status of the record, or select Done.

The record displays the processed status once the submission is successful.
Select Go back to return to the previous page, or select Cancel to abort the import.

AI extraction supported entities and fields
Threat entity types that AI extraction identifies in an uploaded document, and the AI-generated fields that it adds to the extracted records.

Parent Topic:Import Intelligence in TISC

Related topics

Import data using structured file

Import data using standard format

Import data using raw text

Import data using unstructured file format

AI extraction supported entities and fields

Import Intelligence in TISC

title	Import data using AI
description	Upload an unstructured document and let AI extract the threat observables and objects from its content. Review and correct the extracted entities before you submit the import.
locale	en-US
canonical_url	https://www.servicenow.com/docs/r/security-management/threat-intelligence-security-center/import-data-using-ai.html
release	brazil
product	Threat Intelligence Security Center
classification	threat-intelligence-security-center
topic_type	task
last_updated	2026-09-10
reading_time_minutes	5
keywords	AI extractionImport IntelligenceThreat Intelligence Security Center
breadcrumb	Import Intelligence in TISCUseThreat Intelligence Security CenterSecurity Operations