Threat Intel Library

---
title: Threat Intel Library
description: A threat library is defined as a group of organized objects and entities that serve the organizations with structured and unstructured security threat information.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/threat-intelligence-security-center/threat-intelligence-security-center-library.html
release: brazil
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [threat library, TISC library, intelligence records library]
breadcrumb: [Use, Threat Intelligence Security Center, Security Operations]
---

# Threat Intel Library

A threat library is defined as a group of organized objects and entities that serve the organizations with structured and unstructured security threat information.

The threat information is available in the form of feeds. The feeds provides you with valuable threat data from sources such as STIX, MISP, and so on, which lists threat intelligence entities.

Threat Intelligence Security Center library explains how to browse through the data, by performing basic and advanced searches, and filtering rules, invoke import assistant, manually add threat intelligence records, take necessary actions such as adding to allow list, deny list, and watch list.

The detailed view provides the insights to the intelligence records and from list views you can perform quick actions on one or more records.

-   **[TISC Data Model](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intelligence-security-center/understanding-the-data-model.md)**  
The data model and architecture of threat intelligence security center module is designed to support threat intelligence platform capabilities and different security views that provides detailed data for threat analysts.
-   **[TISC Library Objects form view](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intelligence-security-center/tisc-library-home-page-view.md)**  
The Threat Intelligence Security Center objects home page consists of the following features.
-   **[TISC Library Repository](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intelligence-security-center/tisc-ioc.md)**  
IoC repository contains STIX objects, each of these objects contain a specific piece of information.
-   **[Access Vulnerability Downstream actions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intelligence-security-center/downstream-actions-from-the-vulnerability-form-view.md)**  
Access all downstream actions generated from a vulnerability record to track remediation progress and understand the scope of response activities.
-   **[Deleting threat intelligence library records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intelligence-security-center/tisc-delete-lib-records.md)**  
Delete threat intelligence library records such as observables, indicators, and objects.
-   **[Export intelligence data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intelligence-security-center/tisc-export-observables.md)**  
Use the export feature to manually export the intelligence data in various formats.
-   **[Confirm Potential Relationships from Related Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intelligence-security-center/confirm-potential-relationships.md)**  
Confirm the relationships between the two SDOs.
-   **[Automated correlation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intelligence-security-center/automated-correlation-rules.md)**  
Automated correlation automatically establishes relationships between threat intelligence records based on predefined rules, helping you identify connections between observables, indicators, and threat objects.