--- sourceDocument: australia Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/australia/delta-zurich-australia Release : - australia ft:locale : - en-US ft:publication_title : - australia Combined Product Files ft:clusterId : - delta3az bundleId : - delta3az --- # Combined Threat Intelligence Security Center release notes for upgrades from Zurich to Australia # Combined Threat Intelligence Security Center release notes for upgrades from Zurich to Australia {#ariaid-title1} Release version: Australia Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 11 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined Threat Intelligence Security Center Release Notes for Upgrades from Zurich to Australia This consolidated release notes document outlines the key updates, new features, changes, and important upgrade information for ServiceNow's Threat Intelligence Security Center (TISC) as customers move from the Zurich to Australia releases. It provides practical guidance for preparing and executing the upgrade, highlighting enhancements that improve threat intelligence sharing, analysis, and automation capabilities relevant to ServiceNow customers managing security operations. Show full answer Show less ## Key Features * **External Threat Intelligence Sharing:** Support for secure, automated sharing of threat intelligence via STIX 2.1 and MISP formats enables collaboration across agencies, SIEMs, EDRs, and TAXII-based instances. * **Threat Intelligence Library Enhancements:** New report templates and custom MISP API feed configuration allow importing and generating reports outside case management, improving data consolidation and reporting efficiency. * **Investigation Canvas Improvements:** Timeline event customization, internal intelligence aggregation, node linking, and enhanced MITRE ATT\&CK integration facilitate effective visualization and investigation of threat data. * **AI-Powered Capabilities:** Introduction of ServiceNow Otto® as the AI platform brand, which includes generative AI skills for automated case report authoring and concise case summarization to speed up analyst workflows. * **Playbooks and Workflow Automation:** Out-of-the-box threat hunting playbooks provide guided, stage-based workflows to streamline case investigations and incident response. * **Splunk Integration Enhancements:** The TISC add-on now supports historical data ingestion and flexible expiration handling, improving data management within Splunk environments. * **Threat Feed and Indicator Enhancements:** CrowdStrike premium feed enhancements include malware ingestion, structured tagging of threat actor attributes, and enriched relationships between entities for deeper threat context. * **New Entity Support and Automation:** Support for CWEs, remediations, products, vendors, zero-day vulnerability automation, and vulnerability assessments directly from vulnerability records enable more comprehensive threat lifecycle management. * **Have I Been Pwned (HIBP) Integration:** Enables observable enrichment by identifying whether observables have been exposed in known data breaches. * **Tagging Rules Automation:** Configurable tagging rules automate classification of RSS feed records, enhancing data organization and searchability. * **UI and Theming:** The new Coral theme with a dark mode option improves user experience across web and mobile platforms. ## Key Changes * **Enhanced Data Import and Mapping:** Improved import processes support allow list observables and preserve raw data formatting during custom field mapping. * **Investigation Canvas Functional Updates:** Added clear canvas functionality, enhanced node grouping, and filtering options for MITRE ATT\&CK techniques improve investigation efficiency. * **Relationship Graph Enhancements:** Improved graph rendering and filtering allow analysts to explore immediate relationships quickly and focus on relevant threat entities. * **Threat Intelligence Library Organization:** Lists are now grouped by categories such as observables, indicators, and vulnerabilities for better navigation. * **RSS Feed Enhancements:** Expanded schema and parsers support tags, taxonomies, status, and expiration time for more detailed feed data. * **Export and Sharing Improvements:** STIX 2.1 exports now include Traffic Light Protocol (TLP) 2.0 marking definitions for consistent classification of intelligence objects. * **System Property Updates:** Renaming of certain report-related properties ensures alignment with the latest release conventions. ## Upgrade Preparation and Activation Before upgrading to Australia, review and complete all pre- and post-upgrade tasks as outlined. Activation of Threat Intelligence Security Center requires requesting the application from the ServiceNow Store. Customers should verify their product entitlements to access new AI capabilities and features introduced in Australia. ## Practical Benefits for ServiceNow Customers * Secure, automated sharing and ingestion of threat intelligence improve collaboration and situational awareness across security teams and external partners. * AI-powered report generation and summarization reduce manual effort, speeding up analysis and decision-making. * Enhanced workflow playbooks and integrations streamline investigations and incident response. * Richer data models and entity relationships provide a comprehensive view of threats, vulnerabilities, and remediation actions. * Improved UI themes and organizational enhancements facilitate a more intuitive and efficient user experience. Consolidated page of all release notes for Threat Intelligence Security Center from Zurich to Australia. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family Threat Intelligence Security Center release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Zurich to Australia. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading Threat Intelligence Security Center to Australia Before you upgrade to Australia, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-threatintelligencesecuritycenter-summary__entry__2} | Release | Release notes | |-|-| | Zurich | No updates for this release. | | Australia | No updates for this release. | [ ] ## New features Between your current release family and Australia, new features were introduced for Threat Intelligence Security Center. {#dfrn3-threatintelligencesecuritycenter-summary__entry__8} | Release | Release notes | |-|-| | Zurich | [Configuring Threat Intelligence External Sharing](https://www.servicenow.com/docs/access?context=tisc-intel-sharing&family=zurich&ft:locale=en-US) : Take advantage of external sharing for secure, automated, and on-demand dissemination of threat intelligence using STIX 2.1 and MISP formats. Supports sharing across external agencies (CISA, ISAC), integrations (SIEMs, EDRs), TAXII-based TISC instances, and inbound intelligence from external entities. [Configure report templates](https://www.servicenow.com/docs/access?context=tisc-report-templates&family=zurich&ft:locale=en-US) : Generate reports outside case management using base templates through a new reporting section in the Threat Intelligence Library. [Configure custom MISP API feed](https://www.servicenow.com/docs/access?context=tisc-premium-misp&family=zurich&ft:locale=en-US) : Import events, attributes, and objects from the MISP server into the Threat Intelligence Library. [Configure Custom Event Types for Timeline](https://www.servicenow.com/docs/access?context=tisc-config-timeline&family=zurich&ft:locale=en-US) and [Using Timeline in Investigation Canvas](https://www.servicenow.com/docs/access?context=tisc-timeline-events&family=zurich&ft:locale=en-US) : Define, visualize, and manage timeline events associated with nodes through the Investigation Canvas. [Configure TISC add-on in Splunk](https://www.servicenow.com/docs/access?context=tisc-configure-splunk&family=zurich&ft:locale=en-US) : Include optional attributes during configuration that can be stored in the Splunk KV Store. [Configure Premium Threat Feed for CrowdStrike](https://www.servicenow.com/docs/access?context=premium-threat-feed-for-crowdstrike&family=zurich&ft:locale=en-US) : Map CrowdStrike Indicator Malicious confidence to TISC confidence. [View Threat Intel Feeds](https://www.servicenow.com/docs/access?context=base-system-threat-intel-feeds&family=zurich&ft:locale=en-US) : Map specific source values to required observable fields during import process. | | Australia | [ServiceNow product tiers](https://www.servicenow.com/docs/access?context=ai-native-sku-overview&family=australia&ft:locale=en-US) : The ServiceNow AI Platform now brings you a new AI experience with three licensing tiers available: * Foundation: AI basics to deliver insights * Advanced: AI to boost productivity across relevant use cases * Prime: Act autonomously with all AI assets, and create your own Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents. [Generate a Case Report using generative AI](https://www.servicenow.com/docs/access?context=na-tisc-generate-ai-reports&family=australia&ft:locale=en-US) : Introduced the TISC Report Authoring skill to generate analyst‑grade threat intelligence reports from threat cases. Supports configurable styling and analyst-defined instructions for content and focus. [Summarize a case](https://www.servicenow.com/docs/access?context=now-assist-tisc-case-summarization&family=australia&ft:locale=en-US) : The TISC Case Summarization skill brings generative AI capabilities directly into threat intelligence workflows.  Analysts can generate concise AI-powered summaries of threat cases, including case overview, findings, key actions taken, and recommended next steps. [Automatic Threat Actor priority tagging](https://www.servicenow.com/docs/access?context=tisc-threat-actor-priority-tagging&family=australia&ft:locale=en-US) : Enable automatic tagging of threat actors based on their origin locations. [Configure TISC add-on in Splunk](https://www.servicenow.com/docs/access?context=tisc-configure-splunk&family=australia&ft:locale=en-US) : TISC Add-on for Splunk Enterprise adds historical data ingestion and flexible expiration handling. [Link nodes in the Relationship Graph](https://www.servicenow.com/docs/access?context=tisc-link-nodes&family=australia&ft:locale=en-US) : The relationship graphs show immediate relationships to the home node for quick rendering of the graph. Filters enable analysts to narrow down to specific nodes and relationships.  [MITRE ATT\&CK Technique Extraction Rules](https://www.servicenow.com/docs/access?context=mitre-extraction-rules&family=australia&ft:locale=en-US) : Enhanced MITRE™ extraction rule schema to add a combined Techniques and tactics regex extraction type. [Threat Hunting Playbook](https://www.servicenow.com/docs/access?context=tisc-threat-hunt-playbook&family=australia&ft:locale=en-US) : Threat hunting playbook is now available out of the box. Analysts can use Playbooks for case management as a guided, stage-based workflow for investigations. [Configure Premium Threat Feed for CrowdStrike](https://www.servicenow.com/docs/access?context=premium-threat-feed-for-crowdstrike&family=australia&ft:locale=en-US) : Enhanced CrowdStrike premium Threat feed by adding `Malware` to the record types to ingest. Threat Actor records now link to `Malware` through `uses` and `develops` relationships, and to `Location` through `originates-from` and `targets` relationships. Report and Indicator records are linked to `Malware` through `associated-with`. Threat Actor records ingested from CrowdStrike now represent `capabilities`, `target industries`, `target regions`, `target countries`, and `origins` as structured tags rather than free-text, additional context fields. Users can use these attributes as filters. [Have I Been Pwned integration](https://www.servicenow.com/docs/access?context=tisc-hibp-integration&family=australia&ft:locale=en-US) : Added support in TISC for Have I been pwned? (HIBP) observable enrichment, enabling analysts to identify whether observables have been exposed in known data breaches instances. [Configure Tagging Rules in TISC](https://www.servicenow.com/docs/access?context=tisc-tag-rules&family=australia&ft:locale=en-US) : Introduced automated tagging of RSS feed records using configurable tagging rules to apply tags and taxonomies. [Create a CWE record](https://www.servicenow.com/docs/access?context=tisc-create-cwe-record&family=australia&ft:locale=en-US) : Introduced CWEs as related entities with support for relationship linking. [Create Remediations](https://www.servicenow.com/docs/access?context=tisc-create-remediation-record&family=australia&ft:locale=en-US) : Introduced remediations as related entities with support for relationship linking and added support for managing remediations. [Create a Product](https://www.servicenow.com/docs/access?context=tisc-create-product&family=australia&ft:locale=en-US) : Introduced products as related entities with support for relationship linking. [Create a Vendor](https://www.servicenow.com/docs/access?context=tisc-add-vendor-to-vul&family=australia&ft:locale=en-US) : Associated vendors as related entities with support for relationship linking. [Automated creation of zero day vulnerability](https://www.servicenow.com/docs/access?context=tisc-zero-day-vuln-scenario&family=australia&ft:locale=en-US) : Automatically generate zero day vulnerability records from flagged RSS feeds with extracted and linked CPE, CWE, and CVE details for enhanced threat analysis. The catalog now includes the RSS feed for Google Project Zero, enabling real-time detection of emerging threats. [Create Vulnerability Assessment from a Vulnerability](https://www.servicenow.com/docs/access?context=tisc-vul-assess&family=australia&ft:locale=en-US) : Initiate vulnerability assessments directly from identified issues for faster risk evaluation. Sample workflows and flow actions are included to automate the assessment process. [Create Security Incident from a Vulnerability Record](https://www.servicenow.com/docs/access?context=tisc-create-security-incident&family=australia&ft:locale=en-US) : Create security incident records directly from detected vulnerabilities to expedite incident response and streamline threat management workflows. [Enable security incidents for vulnerabilities](https://www.servicenow.com/docs/access?context=tisc-view-security-context&family=australia&ft:locale=en-US) : View vulnerabilities and related intelligence in the TISC Context tab of Security Incident Response Workspace, allowing analysts to quickly access risk data during investigations without navigating to separate records. | [ ] ## Changes Between your current release family and Australia, some changes were made to existing Threat Intelligence Security Center features. {#dfrn3-threatintelligencesecuritycenter-summary__entry__14} | Release | Release notes | |-|-| | Zurich | [\[Placeholder link text to key bundle-security.tisc-canvas-internal-intel\]](https://www.servicenow.com/docs/access?context=tisc-canvas-internal-intel&family=zurich&ft:locale=en-US) : Introduced Add From Internal Intelligence option to include the data from the internal systems. [Define an Observable](https://www.servicenow.com/docs/access?context=define-an-observable&family=zurich&ft:locale=en-US) : Introduced a notice when deleting an observable record to help prevent accidental removal of its associated source records. [Configure Custom Field Mapping](https://www.servicenow.com/docs/access?context=tisc-field-mapping&family=zurich&ft:locale=en-US) : The list view has been replaced with a code editor in the Sample data (Input) section of the field mapping, preserving the original structure and formatting of raw data. [Creating an investigation canvas](https://www.servicenow.com/docs/access?context=tisc-create-canvas&family=zurich&ft:locale=en-US) Clear canvas button : A Clear canvas button to clear the canvas permanently removes all nodes from the investigation canvas. [Manage Techniques](https://www.servicenow.com/docs/access?context=tisc-manage-techniques&family=zurich&ft:locale=en-US) : Introduced Priority levels and TISC Tags to categorize and tag MITRE Techniques more effectively. [Components installed with Threat Intelligence Security Center](https://www.servicenow.com/docs/access?context=tisc-components-installed&family=zurich&ft:locale=en-US) : Introduced a new system property to configure the default Traffic Light Protocol (TLP) level. [Import data using structured file](https://www.servicenow.com/docs/access?context=import-data-using-structured-file&family=zurich&ft:locale=en-US) : Introduced an Add Observable(s) to Security Control List drop-down list to enable the importing of Allow listed observables directly through Import Intelligence. Coral theme : Coral is now the default theme for new portal, web, and mobile experiences with Next Experience or Core UI enabled. This theme provides a fresh look and feel, featuring brand-neutral illustrations to enhance your user experience. A dark theme option is available for web and mobile experiences. [\[Placeholder link text to key bundle-security.tisc-canvas-internal-intel\]](https://www.servicenow.com/docs/access?context=tisc-canvas-internal-intel&family=zurich&ft:locale=en-US) : Aggregate and analyze the data from internal systems through internal intelligence included in the Investigation Canvas module to help you identify potential threats more effectively. [Import Intelligence in TISC](https://www.servicenow.com/docs/access?context=importing-threat-intelligence&family=zurich&ft:locale=en-US) : Enhanced the Import Intelligence functionality to support direct import of allow list observables. [Working with Investigation Canvas](https://www.servicenow.com/docs/access?context=tisc-investigation-canvases&family=zurich&ft:locale=en-US) : The Investigation Canvas feature has been extended to include customized nodes, node relationships, and node legends, as well as the grouping and ungrouping of nodes. [Investigation canvas and MITRE ATT\&CK](https://www.servicenow.com/docs/access?context=investigation-and-mitre&family=zurich&ft:locale=en-US) : Navigate and use the MITRE-ATT\&CK model within the Investigation Canvas more effectively by taking advantage of enhanced filtering options. | | Australia | [Now Assist \> ServiceNow Otto® announcement](https://www.servicenow.com/docs/access?context=sn-ai-implementation-landing&family=australia&ft:locale=en-US) : ServiceNow Otto introduced AI on the platform. As that experience has evolved, there's a new name for the experience. ServiceNow Otto® is the conversational AI platform integrated into ServiceNow workflows. It provides agentic capabilities, supports multimodal interactions across web, mobile, and messaging channels, and enables autonomous orchestration for cross-system workflows. [TISC Library Repository](https://www.servicenow.com/docs/access?context=tisc-ioc&family=australia&ft:locale=en-US) : Enhanced Threat Intelligence Library list views by grouping observables, indicators, threat entities, RSS feed, and vulnerability artifacts into appropriate categories for improved navigation. [Create Vulnerability Assessment from a Vulnerability](https://www.servicenow.com/docs/access?context=tisc-vul-assess&family=australia&ft:locale=en-US) : Introduced a new button Create Vulnerability Assessment to conduct a vulnerability assessment for a specific vulnerability. [Create Security Incident from a Vulnerability Record](https://www.servicenow.com/docs/access?context=tisc-create-security-incident&family=australia&ft:locale=en-US) : Introduced a new button Create Security Incident to facilitate identifying vulnerabilities and enable faster incident response within the threat analysis. [Threat Intelligence Security Center Catalog](https://www.servicenow.com/docs/access?context=threat-intelligence-security-center-catalogue&family=australia&ft:locale=en-US) : Introduced a new catalog entry which includes the RSS feed for Google Project Zero, enabling real-time detection of emerging threats. [MITRE ATT\&CK Technique Extraction Rules](https://www.servicenow.com/docs/access?context=mitre-extraction-rules&family=australia&ft:locale=en-US) and [View extracted MITRE ATT\&CK Techniques](https://www.servicenow.com/docs/access?context=mitre-extraction-method&family=australia&ft:locale=en-US) : Enabled MITRE-ATT\&CK extraction rules for RSS feed to map and associate MITRE-ATT\&CK techniques. [View RSS Feeds](https://www.servicenow.com/docs/access?context=define-rss-feeds&family=australia&ft:locale=en-US) : Enhanced the RSS feed schema and parsers to support additional fields, including tags, taxonomies, status, and expiration time. [Export intelligence data](https://www.servicenow.com/docs/access?context=tisc-export-observables&family=australia&ft:locale=en-US), [Sharing of Outbound Intelligence Records from GUI](https://www.servicenow.com/docs/access?context=tisc-create-intel-records-lib&family=australia&ft:locale=en-US), and [Add to TAXII Collections from Library List View](https://www.servicenow.com/docs/access?context=tisc-obs-add-taxii-collects&family=australia&ft:locale=en-US) : Enhanced STIX 2.1 export to include Traffic Light Protocol (TLP) definitions applied to intelligence objects as TLP 2.0 marking definition objects. For more information, see [Marking Definition](https://www.servicenow.com/docs/access?context=marking-definition&family=australia&ft:locale=en-US). [System properties for TISC Reports](https://www.servicenow.com/docs/access?context=reports-system-properties&family=australia&ft:locale=en-US) : The system property `sn_sec_tisc.reporting.email_template_sn_sec_tisc_case` is no longer supported in TISC. It has been renamed to `sn_sec_tisc.default_report_email_template`, effective with the latest release. [Configure custom MISP API feed](https://www.servicenow.com/docs/access?context=tisc-premium-misp&family=australia&ft:locale=en-US) : Enhanced MISP API feed ingestion to handle events when the published timestamp is greater than the modified timestamp. [Define Vulnerability](https://www.servicenow.com/docs/access?context=define-vulnerability&family=australia&ft:locale=en-US) and [Access the Vulnerability Entities](https://www.servicenow.com/docs/access?context=access-the-vulnerability-entities&family=australia&ft:locale=en-US) : Enhanced the vulnerability schema to support additional vulnerability intelligence fields related to CVSS scoring, exploit details, and remediation information. | [ ] ## Removed Between your current release family and Australia, some Threat Intelligence Security Center features or functionality were removed. {#dfrn3-threatintelligencesecuritycenter-summary__entry__20} | Release | Release notes | |-|-| | Zurich | No updates for this release. | | Australia | No updates for this release. | [ ] ## Deprecations Between your current release family and Australia, some Threat Intelligence Security Center features or functionality were deprecated. {#dfrn3-threatintelligencesecuritycenter-summary__entry__26} | Release | Release notes | |-|-| | Zurich | No updates for this release. | | Australia | No updates for this release. | [ ] ## Activation information Review information on how to activate Threat Intelligence Security Center. {#dfrn3-threatintelligencesecuritycenter-summary__entry__32} | Release | Release notes | |-|-| | Zurich | Activation information : Install Threat Intelligence Security Center by requesting it from the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home). Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=zurich&ft:locale=en-US). Important: Threat Intelligence Security Center is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | | Australia | Activation information : Install Threat Intelligence Security Center by requesting it from the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home). Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=australia&ft:locale=en-US). Important: Threat Intelligence Security Center is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | [ ] ## Additional requirements If any additional requirements were introduced or changed for Threat Intelligence Security Center we have noted them here. {#dfrn3-threatintelligencesecuritycenter-summary__entry__38} | Release | Release notes | |-|-| | Zurich | No updates for this release. | | Australia | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for Threat Intelligence Security Center we have noted them here. {#dfrn3-threatintelligencesecuritycenter-summary__entry__44} | Release | Release notes | |-|-| | Zurich | No updates for this release. | | Australia | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for Threat Intelligence Security Center, such as specific requirements or compliance levels. {#dfrn3-threatintelligencesecuritycenter-summary__entry__50} | Release | Release notes | |-|-| | Zurich | Accessibility information : Dark theme : The new Coral theme includes a dark theme option for web and mobile experiences. This option is commonly used to alleviate eye strain and improve readability. | | Australia | No updates for this release. | [ ] ## Localization information If there are specific localization considerations for Threat Intelligence Security Center we have noted them here. {#dfrn3-threatintelligencesecuritycenter-summary__entry__56} | Release | Release notes | |-|-| | Zurich | No updates for this release. | | Australia | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for Threat Intelligence Security Center we have noted them here. {#dfrn3-threatintelligencesecuritycenter-summary__entry__62} | Release | Release notes | |-|-| | Zurich | * External sharing is now generally available, allowing secure and automated sharing of threat intelligence in STIX 2.1 and MISP formats. * Redesigned the Investigation Canvas with activity timelines, added internal intelligence, improved node design and interactions, enhanced related records to retrieve all the associated records, and upgraded the MITRE card with filter capabilities for a smoother experience. * Introduced the ability to import events directly from the MISP server. * Implemented a unified mapping experience for the text based feeds such as TEXT, CSV, and JSON import formats. * Implemented confidence mapping for the CrowdStrike (CS) Feed as part of additional settings. You can now map the malicious confidence levels of CrowdStrike indicators to the observable confidence values. See [Threat Intelligence Security Center](https://www.servicenow.com/docs/access?context=tisc-landing-page&family=zurich&ft:locale=en-US) for more information. | | Australia | * ServiceNow Otto® is the new AI experience brand. This change is reflected in the name of ServiceNow products, including ServiceNow Otto for Threat Intelligence Security Center (TISC). Your product entitlements remain unchanged. Check your entitlements to determine your access to specific features. * Introduced AI-generated threat intelligence reports from case data with analyst-guided instructions. * Introduced AI-generated case summarization that analysts can use to generate concise case summaries. * Added playbooks support in Case Management, giving analysts a guided, stage-based workflow for investigations. * Added historical data ingestion and flexible expiration handling to TISC Add-on for Splunk Enterprise.  * Enhanced MITRE Extraction rule schema to add a combined Techniques and Tactics regex extraction type. * Enhanced Relationship Graph with filtering support and performance improvements. * Enhanced CrowdStrike feed to support ingestion of malwares. See [Threat Intelligence Security Center](https://www.servicenow.com/docs/access?context=tisc-landing-page&family=australia&ft:locale=en-US) for more information. | [ ]