---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Customize extraction use cases

# Customize the threat intelligence extraction use cases {#ariaid-title1}

Release version: Australia  
Updated August 14, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Edit the prompts in the threat intelligence extraction use cases to change how AI extracts threat entities from the documents that your analysts upload.

## Before you begin

Important:  
Some generative AI skills, AI agents, and agentic workflows are turned on by default. For more information, see [AI agents, skills, and agentic workflows on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US).

Role required: admin

## About this task

ServiceNow Otto for Threat Intelligence Security Center (TISC) provides the threat intelligence extraction use cases for the platform document extraction skill. Each use case corresponds to an extraction type that analysts select in Import
Intelligence. The use cases carry the prompt that instructs the model which entities to extract, in which output format, and with which fields.

## Procedure

1. Navigate to AdminAI Admin HubAI Skills.
2. Select PlatformOther.
3. Select Extract information from documents.  
   Use the search bar to search for the skill.
4. In the use cases, locate the threat intelligence extraction use case to customize.  
   The following use cases are shipped with ServiceNow Otto for Threat Intelligence Security Center (TISC):  
   {#cust-intel-extraction-tisc__table_intel_extraction_use_cases__entry__2}

   | Use case | Extraction type in Import Intelligence |
   |-|-|
   | Threat Intel Extraction - Simple | Extract entities only: Returns the type and the value of each extracted entity. |
   | Threat Intel Extraction with attributes | Extract entities with rationale: Returns the type and the value of each extracted entity, and adds the Analysis Score and Analysis Reasoning values. |
   [Table 1. Threat intelligence extraction use cases]

   {#cust-intel-extraction-tisc__table_intel_extraction_use_cases}  
   Important:  
   Import Intelligence uses only these two use cases. Document extraction use cases that you create aren't available to the AI extraction flow in Import
   Intelligence.
5. Open the use case and edit the prompt.  
   The prompt holds the instructions sent to the model, including which entities to extract, the output format, and the fields to return.  
   Note:  
   Changes to the prompt affect every import that runs the use case. Test the prompt against a representative document before you make it available to your
   analysts.
6. Select Save.
{#cust-intel-extraction-tisc__steps_cust_intel_extraction}
**Related tasks**   

* [Customize the ServiceNow Otto for Threat Intelligence Security Center (TISC) skills](https://www.servicenow.com/docs/wWduCJz06VlrREMlpKYnKQ "Customize the ServiceNow Otto for Threat Intelligence Security Center (TISC) skills to suit your requirements.")

*[\>]: and then