--- sourceDocument: Yokohama Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/security-management Release : - yokohama ft:locale : - en-US ft:publication_title : - Yokohama Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Explore # Explore {#ariaid-title1} Release version: Yokohama Updated April 7, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Threat Intelligence Security Center (TISC) The Threat Intelligence Security Center (TISC) is a centralized ServiceNow application designed to help organizations collaborate with threat intelligence teams by collecting, processing, and analyzing diverse threat intelligence feeds. It streamlines the ingestion, normalization, deduplication, enrichment, and validation of threat data, enabling more effective threat detection, investigation, and response. Show full answer Show less TISC provides a dedicated workspace for threat intelligence analysts and administrators to manage feeds, conduct investigations, and share intelligence securely within and across organizations. ## Key Features * **Threat Intelligence Management:** Access a curated catalog of open-source (OSINT) and premium threat feeds; supports multiple data formats like STIX, MISP, and JSON; automatic observable extraction from files; enrichment and validation to reduce false positives and assign confidence scores. * **Integration Capabilities:** Enrich observables with threat intelligence using tools like Threat Lookup and Sighting Search; integrates with CrowdStrike Falcon EDR for real-time alerting; orchestrates security tools such as SIEMs, EDRs, and firewalls; includes a correlation rules engine to detect threat patterns. * **Threat Intelligence Analysis and Operations:** Customizable threat scoring; integration with internal sources (Vulnerability Response, Security Incident Response, CMDB); user-specific dashboards; graphical visualization tools; dedicated analyst workspace; threat case management with task tracking; MITRE ATT\&CK framework linkage; seamless integration with Security Incident Response; notification and alert rules; data retention and cleanup policies. * **Reporting and Collaboration:** Generate comprehensive reports and investigation summaries with customizable templates; support for multitenant environments for MSSPs through domain separation; extensive API support for integration with other security platforms. * **Roles and User Management:** Defined roles include Administrator (setup and maintenance), Analyst (intelligence analysis and research), and Read-only users, each with appropriate permissions to support efficient operations. ## Practical Benefits for ServiceNow Customers * **Centralized Threat Intelligence Management:** Simplifies threat data ingestion and management from multiple sources and formats, improving the breadth and quality of intelligence available. * **Enhanced Threat Analysis:** Enables analysts to conduct thorough investigations with tailored dashboards, visual tools, and case workflows, boosting investigative efficiency and accuracy. * **Seamless Security Ecosystem Integration:** Connects with existing security tools and internal data sources to create a unified threat detection and response environment. * **Improved Collaboration and Sharing:** Facilitates secure, governed sharing of threat intelligence both internally and with external partners or MSSPs, supporting coordinated defense strategies. * **Operational Efficiency and Governance:** Automates data processing, scoring, alerting, and reporting while enforcing data retention policies and audit logging to maintain security compliance and performance. ## Getting Started ServiceNow customers can set up TISC by configuring data sources, integrating with existing security tools, and assigning appropriate user roles. The application is available for download from the ServiceNow Store and includes resources for initial configuration and ongoing management. Threat Intelligence Security Center (TISC) enables you to collaborate with threat intelligence teams by collecting, processing, and analyzing threat intelligence feeds in a centralized workspace. TISC manages data collection and processing, including deduplication, normalization, and aggregation. It analyzes and disseminates threat intelligence and provides an administration workspace Threat Intelligence Security Center. Watch an overview about the Threat Intelligence Security Center application. ## Key features {#threat-intelligence-security-center-overview__section_kpl_kgq_gyb} Threat Intelligence Security Center (TISC) key features: Threat intelligence management: * Curated Catalog of OSINT Threat Feeds: Provides access to a broad selection of popular open-source threat intelligence feeds, providing wide coverage. * Premium Feed Integration: Enhances the quality of threat intelligence by integrating premium feeds. * Automated Observable Extraction: Automatically identifies and extracts the commonly used observable types from uploaded files, streamlining the threat data ingestion process. * Diverse Data Aggregation: Supports multiple data formats including STIX, MISP, JSON, and others, enabling seamless feed consolidation. * Enrichment Capabilities \& Validation: Provides enrichment and validation capabilities by removing false positives, assigning confidence scores, validating indicators, and adding contextual information. {#threat-intelligence-security-center-overview__ul_kzz_xtf_1yb} Integration capabilities: * Enrich observables with threat intelligence using Threat Lookup, Sighting Search, and Observable Enrichment to assess whether an observable is malicious. * CrowdStrike Falcon EDR: Supports continuous monitoring and real time alerting. * Security tools integrations: Orchestrates security tools including SIEMs, EDRs, and firewalls. * Correlation Rules Engine: Automatically establishes relationships between intelligence records, enabling deeper insight into threat patterns. Threat Intelligence Analysis and operations: * Customizable Threat Scoring: Enables fine-tuning of threat scores for more nuanced and accurate threat assessment. * Internal Intelligence integration: Enables integration of internal intelligence sources, including Vulnerability Response (VR), Security Incident Response (SIR), and Configuration Management Database (CMDB). * User-Specific Dashboards: Tailors visualizations and data views according to Threat Intelligence personas, improving user experience and relevance. * Graphical Visualization Tools: Provides intuitive graphical visualizations such as relationship graphs and interactive investigation canvases to simplify analysis of complex threat intelligence data. * Dedicated Analyst Workspace: Provides a dedicated, streamlined Threat Intelligence Analyst workspace that enables threat intelligence analysts to focus on investigation and analysis. * Threat Case Management: Supports investigative workflows with task tracking and case handling. * MITRE-ATT\&CK Integration: Enables users to link case records with MITRE-ATT\&CK framework data for enhanced kill chain analysis. * Seamless SIR Integration: Provides a smooth data migration and interoperability between Security Incident Response and Threat Intelligence Security Center applications. * Notification \& Alert Rules: Establishes trigger alerts to notify teams based on evolving threat intelligence. * Data Retention \& Cleanup Policies: Enables organizations to define data management rules to maintain application performance and conformance. * Reporting \& Collaboration: Generates comprehensive status reports and investigation summaries using rich-text editors and customizable templates. * Domain Separation for MSSPs: Supports multitenant environments, enabling Managed Security Service Providers (MSSPs) to segregate customer data securely. * Extensive API integration: Offers TISC API for seamless connectivity with other security tools and platforms. ## Threat Intelligence Security Center users and roles {#threat-intelligence-security-center-overview__section_q2g_h45_v3c} {#threat-intelligence-security-center-overview__table_bnq_m45_v3c__entry__3} | User | Description | Contains roles | |-|-|-| | Administrator | Administers and configures the initial setup and ongoing maintenance of the Threat Intelligence Security Center, including configuring data sources and managing settings. | * sn_sec_tisc.admin * sn_sec_tisc.read {#threat-intelligence-security-center-overview__ul_zsb_j5t_z3c} | | Analyst | Threat Intelligence Analysts conduct analysis and research tasks requested by the team. They can import ad hoc intelligence to support their work and use the system's tools for analysis, collaboration, and managing the intelligence library. | * sn_sec_tisc.analyst * sn_sec_tisc.read {#threat-intelligence-security-center-overview__ul_vgh_l5t_z3c} | [ ] {#threat-intelligence-security-center-overview__table_bnq_m45_v3c} ## Threat Intelligence Security Center benefits {#threat-intelligence-security-center-overview__section_cg1_h5t_z3c} The following table describes the key features and benefits of Threat Intelligence Security Center. {#threat-intelligence-security-center-overview__table_ftc_dwt_z3c__entry__4} | Feature | Benefit | Users | Contains roles | |-|-|-|-| | Dashboards/Home page | Threat Intelligence Security Center home page provides high-level visibility into an organization's threat intelligence, data feeds overview, intelligence sharing and security posture. | * Administrators * Analysts {#threat-intelligence-security-center-overview__ul_nss_k45_z3c} | * sn_sec_tisc.read * sn_sec_tisc.analyst * sn_sec_tisc.admin {#threat-intelligence-security-center-overview__ul_lw5_rn5_z3c} | | Threat Intel Library | TISC threat library is a collection of organized objects and entities that provides structured and unstructured security threat information. Threat information is available as feeds from sources such as STIX, MISP, and others. | * Administrators * Analysts {#threat-intelligence-security-center-overview__ul_fjj_p45_z3c} | * sn_sec_tisc.read * sn_sec_tisc.analyst * sn_sec_tisc.admin {#threat-intelligence-security-center-overview__ul_hpl_5n5_z3c} | | Integrations | TISC integrations module centrally manages and configures all Threat Intelligence feed sources and enrichment integrations from a single location, enabling automated and scheduled ingestion of Threat Intelligence data. | * Administrators * Analysts {#threat-intelligence-security-center-overview__ul_yxn_p45_z3c} | * sn_sec_tisc.read * sn_sec_tisc.analyst * sn_sec_tisc.admin {#threat-intelligence-security-center-overview__ul_qks_yn5_z3c} | | Administration | TISC Administration module centrally configures and manages all aspects of TISC data administration. This includes filtering and approval rules, threat scoring, security control lists, taxonomies, notifications, and report templates. | Administrators | * sn_sec_tisc.read * sn_sec_tisc.admin {#threat-intelligence-security-center-overview__ul_krl_zn5_z3c} | | Imports/Exports | * TISC Imports module: Flexibly import Threat Intelligence data from multiple sources and formats including structured files, standard formats such as STIX and MISP, raw text, and unstructured files. Track import jobs and approvals in a single view. * TISC Exports module: Export observables, indicators, and cases individually or in bulk in recommended formats such as CSV and STIX 2.1. {#threat-intelligence-security-center-overview__ul_hym_zw5_z3c} | * Administrators * Analysts {#threat-intelligence-security-center-overview__ul_zlx_q45_z3c} | * sn_sec_tisc.read * sn_sec_tisc.analyst * sn_sec_tisc.admin {#threat-intelligence-security-center-overview__ul_alt_145_z3c} | | Threat Analyst Workbench | Manage end-to-end threat investigations from a single workspace to create and track cases and case tasks. Collect internal intelligence records such as observables, threat actors, and campaigns, and visualize complex relationships using the Investigation Canvas. Accelerate analysis by adding artifacts, running enrichment actions, generating investigation and executive summary reports, and creating security incidents directly from cases. | * Administrators * Analysts {#threat-intelligence-security-center-overview__ul_iyb_r45_z3c} | * sn_sec_tisc.read * sn_sec_tisc.analyst * sn_sec_tisc.admin {#threat-intelligence-security-center-overview__ul_pld_b45_z3c} | | Threat Intelligence Sharing | Securely share threat intelligence within and across organizations using automated and manual sharing workflows. Control what is shared through customizable templates, redaction capabilities, and configurable approval rules for both inbound and outbound intelligence. Maintain conformance and traceability through comprehensive audit logging, data retention policies, and bi-directional TISC - to - TISC exchange, while managing TAXII user and group access for secure, governed data sharing. | * Administrators * Analysts {#threat-intelligence-security-center-overview__ul_a1j_r45_z3c} | * sn_sec_tisc.read * sn_sec_tisc.analyst * sn_sec_tisc.admin {#threat-intelligence-security-center-overview__ul_nwj_b45_z3c} | [ ] {#threat-intelligence-security-center-overview__table_ftc_dwt_z3c} * **[TISC Key terminology](https://www.servicenow.com/docs/HIPuyp~OnJonNCqwsFsnpQ)** Key terms and definitions used in TISC to help you understand threat intelligence concepts and navigate the interface effectively. * **[TISC Workspace](https://www.servicenow.com/docs/z9KN0brWgqb0dEkk~7XvdQ)** View a centralized dashboard of threat intelligence data including feeds overview, trending threats, and intelligence sharing metrics. Monitor your security posture with trending intelligence data. **Related concepts** * [Configuring Threat Intelligence Security Center](https://www.servicenow.com/docs/tdbEeqliyJhFw~TfLS6hBw "Set up the features, components, and integrations that you need to provide service and support to your customers.") * [Set up Threat Intelligence Security Center](https://www.servicenow.com/docs/aJeyXjYMTYO76_dSVTSfhQ "Before you use the Threat Intelligence Security Center, you must download it from the ServiceNow Store.") **Related tasks** * [Download TISC application from ServiceNow Store](https://www.servicenow.com/docs/8GZ3KIMN221LfWEZdlcZlw "Download and install the Threat Intelligence Security Center application to enable threat intelligence capabilities in your ServiceNow instance.")