---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# AI extraction reference

# AI extraction supported entities and fields {#ariaid-title1}

Release version: Australia  
Updated August 14, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Threat entity types that AI extraction identifies in an uploaded document, and the AI-generated fields that it adds to the extracted records.

## Supported threat entities {#tisc-ai-extraction-fields__section_ai_supported_entities}

{#tisc-ai-extraction-fields__table_ai_supported_entities__entry__2}

| Record type | Supported types |
|-|-|
| Observables | IPv4, IPv6, domain, URL, MD5, SHA1, SHA256, email address, IPv4 CIDR, IPv6 CIDR, AS number, and MAC address. |
| Objects | CVE, threat actor, malware, and campaign. |
[Table 1. Threat entities supported by AI extraction]

{#tisc-ai-extraction-fields__table_ai_supported_entities}

## AI-generated fields {#tisc-ai-extraction-fields__section_ai_generated_fields}

{#tisc-ai-extraction-fields__table_ai_generated_fields__entry__2}{#tisc-ai-extraction-fields__table_ai_generated_fields__entry__3}{#tisc-ai-extraction-fields__table_ai_generated_fields__entry__5}

| Field | Description |
| Analysis Score | AI-assessed confidence from 0 through 100, based on contextual signals and enrichment. The score indicates how confidently the entity was identified and classified. |
| Analysis Reasoning | AI-generated explanation of the score assessment, stored as a set of attributes. See the following table. |
|-|-|
[Table 2. Fields populated by AI extraction]

{#tisc-ai-extraction-fields__table_ai_generated_fields}  
{#tisc-ai-extraction-fields__table_analysis_reasoning_attributes__entry__2}{#tisc-ai-extraction-fields__table_analysis_reasoning_attributes__entry__3}{#tisc-ai-extraction-fields__table_analysis_reasoning_attributes__entry__5}{#tisc-ai-extraction-fields__table_analysis_reasoning_attributes__entry__7}{#tisc-ai-extraction-fields__table_analysis_reasoning_attributes__entry__9}

| Attribute | Description |
| Score Reasoning | Justification for the assigned analysis score. |
| Source context | Words that surround the entity in the source document, so that you can locate the entity in its original context. |
| Attribution | Threat actor, campaign, or malware associated with the entity in the source document. Attribution is derived from the document content, not from the threat intelligence repository. |
| Usage | How the associated threat entity uses the extracted entity. For example, an IP address used as a command and control server. |
|-|-|
[Table 3. Analysis Reasoning attributes]

{#tisc-ai-extraction-fields__table_analysis_reasoning_attributes}  
Note:  
When you submit the import, the Analysis Score and Analysis Reasoning values are carried into the Additional context section of the source and aggregated records.

The Confidence value on the extracted records comes from the Confidence field that you set in the definitions section of the import. It isn't AI-generated.

To support extraction of a higher number of threat entities, use Content Understanding v6.2.0 or higher. For more information, see [Content Understanding](https://www.servicenow.com/docs/access?context=content-understanding-landing&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US).
**Related tasks**   

* [Import data using AI](https://www.servicenow.com/docs/aSy~Xdbr~KkNmqQgOiFqQg "Upload an unstructured document and let AI extract the threat observables and objects from its content. Review and correct the extracted entities before you submit the import.")