---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Import data using AI

# Import data using AI {#ariaid-title1}

Release version: Australia  
Updated August 14, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read  
Upload an unstructured document and let AI extract the threat observables and objects from its content. Review and correct the extracted entities before you submit the import.

## Before you begin

Important:  
Some generative AI skills, AI agents, and agentic workflows are turned on by default. For more information, see [AI agents, skills, and agentic workflows on by default](https://www.servicenow.com/docs/access?context=now-assist-skills-on-by-default&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US).  
AI extraction is available only when the following prerequisites are met:

* Threat Intelligence Security Center-Advanced must be installed.
* ServiceNow Otto for Threat Intelligence Security Center (TISC) must be installed.
* The Extract information from documents skill must be enabled. For more information, see [Extract information from documents](https://www.servicenow.com/docs/access?context=now-assist-extract-information-from-documents&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US).
{#import-data-using-ai__ul_import_ai_prereq}

Role required: sn_sec_tisc.analyst

## About this task

Threat advisories, vendor reports, and screenshots may carry indicators of compromise inside prose rather than in a structured file. AI extraction reads the content of an uploaded document, identifies the threat entities it
contains, and presents them for your review. You can import them without transcribing each value.

## Procedure

1. Navigate to WorkspacesThreat Intelligence Security Center.  
   Threat Intel Library page is displayed.
2. Select Import Intelligence.  
   Alternatively, navigate to Imports and exportsNew import or Case RecordImport Intelligence.
3. Select the Import using AI card.  
   The supported file types are PDF, DOCX, JPEG, and PNG.
4. In Choose extraction type, select the type of extraction to run.  
   {#import-data-using-ai__table_extraction_types__entry__2}

   | Extraction type | Description |
   |-|-|
   | Extract entities only | Returns the type and the value of each threat entity found in the document. |
   | Extract entities with rationale | Returns the type and the value of each threat entity, and adds the AI-generated Analysis Score and Analysis Reasoning values. For the attributes captured in the reasoning, see [AI extraction supported entities and fields](https://www.servicenow.com/docs/1MsgjbARHGYNjJka5FE2vg "Threat entity types that AI extraction identifies in an uploaded document, and the AI-generated fields that it adds to the extracted records."). |
   [Table 1. Extraction types]

   {#import-data-using-ai__table_extraction_types}
5. Select Upload file and select the file to import.  
   Note:  
   Upload one file at a time, up to 5 MB. If you attach a file in an unsupported format, or attach more than one file, an error is displayed when you select
   Done. To replace the attached file, remove it and then attach the file you want.
6. Under Set definitions, fill in the fields.  
   {#import-data-using-ai__table_import_ai_definitions__entry__2}

   | Field | Description |
   |-|-|
   | TLP | Select the TLP indicator from the drop-down list to be applied for the imported records. |
   | Confidence (0-100) | Define the confidence value. This value is applied to every imported record. It's separate from the AI-generated Analysis Score. |
   | Expiry Period (days) | Enter the expiry period of the associated observables. The expiration date of each imported record is calculated from the current date and this value. Note: This is a mandatory field. |
   | Add Observable(s) to security Control List | Select this option to add observables to the appropriate security control list. The available options in the drop-down list are Allow list, Deny list, and None. The default option is None. |
   | Add Tags | Add tags to annotate records ingested from this source. Start typing the tag name in the Search bar to choose the available tags in the system or enter new tag name and select Add to assign it. |
   | Select a Taxonomy | Select the taxonomy for the imported data. For more information, see [Creating Taxonomies](https://www.servicenow.com/docs/C~XXOsCA3_f~taPumaY1vg "Create taxonomies for the data source records."). |
   [Table 2. Set definitions and Taxonomy fields]

   {#import-data-using-ai__table_import_ai_definitions}
7. Select Next.  
   Use the import record link if you want to track the import separately.  
   The extracted entities are displayed on the review screen.
8. Review the extracted entities before submission.  
   Important:  
   Review the AI-generated results for accuracy. AI identifies and classifies the entities from the content of your document, and the classification can be
   incorrect.
   * The content tree groups the extracted entities as Observables and Objects, with a count for each group.
   * Select a group in the content tree to display its records in the list.
   * The columns marked with the AI icon hold AI-extracted values. For the field descriptions, see [AI extraction supported entities and fields](https://www.servicenow.com/docs/1MsgjbARHGYNjJka5FE2vg "Threat entity types that AI extraction identifies in an uploaded document, and the AI-generated fields that it adds to the extracted records.").
   {#import-data-using-ai__ul_review_screen}
9. To correct the classification of an entity, select the records, select Update Type, and then select the type to apply.  
   The records move to the group for the type you selected, and the counts in the content tree are updated.
10. To exclude entities from the import, select the records and select Delete.
11. Select Submit.  
    Note:  
    * The imported records are processed into source records and then into aggregated records. The Analysis Score and Analysis Reasoning values are carried into the Additional context section of the source and aggregated records.
    * Depending on the approval rules configured for your instance, the import record can be routed to an approver before processing.
    {#import-data-using-ai__ul_k1l_sk1_hkc}
12. Select View Status to view the status of the record, or select Done.  
    The record displays the processed status once the submission is successful.
13. **Optional:** Select Go Back to return to the previous page, or select Cancel to abort the import.
{#import-data-using-ai__steps_import_ai}
* **[AI extraction supported entities and fields](https://www.servicenow.com/docs/1MsgjbARHGYNjJka5FE2vg)**   
  Threat entity types that AI extraction identifies in an uploaded document, and the AI-generated fields that it adds to the extracted records.

**Related concepts**   

* [Import Intelligence in TISC](https://www.servicenow.com/docs/Oixbgz~VHbFrz6TzcIP8HQ "Use this feature to manually import threat intelligence data into the repository, enabling analysts to ingest the relevant information from external sources as needed.")  
**Related tasks**   

* [Import data using structured file](https://www.servicenow.com/docs/_uT_PLyeaZJPtjdBkY0w9A "Upload the structured data in the supported file formats such as CSV, XLSX or XLS.")
* [Import data using standard format](https://www.servicenow.com/docs/ufoUvik4~_VjdBuCbgs6tQ "Upload the standard data in the supported file formats such as STIX 2.x JSON, MISP JSON.")
* [Import data using raw text](https://www.servicenow.com/docs/61erVXh0by7bdJMJJvD2_w "Import the observables data by copying and pasting raw text or entering the free text.")
* [Import data using unstructured file format](https://www.servicenow.com/docs/HC7FR0PESNQe_uFWUZVOag "Upload the data in an unstructured format supported using the file formats such as TXT, CSV, JSON, XLS, XLSX.")  
**Related reference**   

* [AI extraction supported entities and fields](https://www.servicenow.com/docs/1MsgjbARHGYNjJka5FE2vg "Threat entity types that AI extraction identifies in an uploaded document, and the AI-generated fields that it adds to the extracted records.")

*[\>]: and then