Combined Threat Intelligence Security Center release notes for upgrades from Yokohama to Zurich

zurich Combined Product Files

Release

zurich

ft:locale

en-US

ft:publication_title

zurich Combined Product Files

ft:clusterId

delta3zy

bundleId

delta3zy

Combined Threat Intelligence Security Center release notes for upgrades from Yokohama to Zurich

Release version: Zurich

Updated August 11, 2026

5 minutes to read

Summarize

Summarized using AI

Summary of Combined Threat Intelligence Security Center Release Notes for Upgrades from Yokohama to Zurich

This release note consolidates all key updates, new features, changes, and important upgrade tasks for the Threat Intelligence Security Center (TISC) as customers move from the Yokohama release to the Zurich release. It serves as a comprehensive guide for ServiceNow customers planning to upgrade, ensuring they understand what enhancements and changes to expect and how to prepare for a smooth transition.

Show full answer Show less

New Features

Microsoft Defender for EDR Integration (Yokohama): Enables CTI analysts to automatically push malicious or suspicious IPs, domains, file hashes, and URLs to Microsoft Defender for continuous monitoring and real-time alerting.
Create Security Incidents from TISC Cases (Yokohama): Allows creation of security incidents directly from TISC cases, associating observables to incidents for streamlined incident management.
Duplicate Threat Intelligence Feeds (Yokohama): Simplifies feed management by allowing duplication of existing threat intelligence feeds.
External Sharing (Zurich): Introduces secure, automated sharing of threat intelligence using STIX 2.1 and MISP formats. Supports sharing with external agencies (e.g., CISA, ISAC), integrations like SIEMs and EDRs, TAXII-based TISC instances, and inbound intelligence from external entities.
Report Templates (Zurich): Enables report generation outside case management using base templates in the Threat Intelligence Library.
Custom MISP API Feed (Zurich): Allows importing events, attributes, and objects from MISP servers into the Threat Intelligence Library.
Custom Event Types & Timeline in Investigation Canvas (Zurich): Provides ability to define, visualize, and manage timeline events associated with nodes directly within the Investigation Canvas for enhanced investigation workflows.
Splunk Add-on Configuration (Zurich): Supports including optional attributes stored in the Splunk KV Store during configuration.
Custom CrowdStrike Feed Mapping (Zurich): Maps CrowdStrike indicator malicious confidence levels to TISC confidence values, improving threat intelligence accuracy.
Threat Intel Feed Viewing (Zurich): Enables mapping of specific source values to required observable fields during import, enhancing feed data integration.

Key Changes

Renaming (Yokohama): “Course of Actions” renamed to “Courses of Action,” and “Inbound Filtering Rules” renamed to “Inbound Data Exclusion Rules” for clarity.
Investigation Canvas Enhancements (Zurich): Added internal intelligence data aggregation, support for customized nodes, relationships, legends, node grouping/ungrouping, and improved MITRE ATT&CK model navigation with filtering options.
Import Intelligence (Zurich): Enhanced to allow direct import of allow list observables, improving threat intelligence accuracy and management.

Removed and Deprecated Features

There are no feature removals or deprecations reported between Yokohama and Zurich releases, ensuring continuity in functionality.

Activation and Installation

Threat Intelligence Security Center can be installed by requesting it from the ServiceNow Store for both Yokohama and Zurich releases. Customers should refer to the ServiceNow Store for available apps and submission details.

Additional Notes

No new browser requirements, accessibility updates, or localization changes were introduced for the Zurich release.
Highlighted improvements include enhanced export options (STIX 2.1 JSON, CSV, Excel), improved feed configuration, and enhanced integration capabilities with Microsoft Defender and CrowdStrike feeds.

Practical Benefits for ServiceNow Customers

Upgrading from Yokohama to Zurich equips your Threat Intelligence Security Center with advanced sharing capabilities, improved investigative workflows, and richer integrations with external security tools. These enhancements enable more effective threat detection, faster response through direct incident creation, and better collaboration with external agencies and internal teams. The upgrade also simplifies management of threat feeds and reporting, helping your security operations team operate more efficiently and with greater confidence.

Consolidated page of all release notes for Threat Intelligence Security Center from Yokohama to Zurich.

How to use this page

To help you prepare for your upgrade, we have combined the cross-family Threat Intelligence Security Center release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Yokohama to Zurich.

Tip:

If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release."

Important information for upgrading Threat Intelligence Security Center to Zurich

Before you upgrade to Zurich, review these pre- and post-upgrade tasks and complete the tasks as needed.


Release	Release notes
Yokohama	No updates for this release.
Zurich	No updates for this release.

New features

Between your current release family and Zurich, new features were introduced for Threat Intelligence Security Center.


Release	Release notes
Yokohama	Microsoft Defender for EDR Integration Integration with the Microsoft Defender for EDR allows Cyber Threat Intelligence (CTI) analysts to automatically push malicious or suspicious IP addresses, domains, file hashes, and URLs to Microsoft Defender for continuous monitoring and real-time alerting. Create a security incident from a TISC case Create security incidents and associate observables to the security incidents from a TISC case. Duplicate threat intelligence feeds Duplicate threat intelligence feeds to create an exact copy of the existing feed.
Zurich	Configure Threat Intelligence External Sharing Take advantage of external sharing for secure, automated, and on-demand dissemination of threat intelligence using STIX 2.1 and MISP formats. Supports sharing across external agencies (CISA, ISAC), integrations (SIEMs, EDRs), TAXII-based TISC instances, and inbound intelligence from external entities. About Report Templates in TISC Generate reports outside case management using base templates through a new reporting section in the Threat Intelligence Library. Configure custom MISP API feed Import events, attributes, and objects from the MISP server into the Threat Intelligence Library. Configure Custom Event Types for Timeline and Using Timeline in Investigation Canvas Define, visualize, and manage timeline events associated with nodes through the Investigation Canvas. Configuring TISC add-on in Splunk Include optional attributes during configuration that can be stored in the Splunk KV Store. Configure custom CrowdStrike feed Map CrowdStrike Indicator Malicious confidence to TISC confidence. View Threat Intel Feeds Map specific source values to required observable fields during import process.

Changes

Between your current release family and Zurich, some changes were made to existing Threat Intelligence Security Center features.


Release	Release notes
Yokohama	Courses of Action Renamed Course of Actions to Courses of Action. Create Inbound Data Exclusion Rules Renamed Inbound Filtering Rules to Inbound Data Exclusion Rules.
Zurich	Adding Internal Intelligence to Investigation Canvas Aggregate and analyze the data from internal systems through internal intelligence included in the Investigation Canvas module to help you identify potential threats more effectively. Import Intelligence in TISC Enhanced the Import Intelligence functionality to support direct import of allow list observables. Working with Investigation Canvas The Investigation Canvas feature has been extended to include customized nodes, node relationships, and node legends, as well as the grouping and ungrouping of nodes. Investigation canvas and MITRE ATT&CK Navigate and use the MITRE-ATT&CK model within the Investigation Canvas more effectively by taking advantage of enhanced filtering options.

Removed

Between your current release family and Zurich, some Threat Intelligence Security Center features or functionality were removed.


Release	Release notes
Yokohama	No updates for this release.
Zurich	No updates for this release.

Deprecations

Between your current release family and Zurich, some Threat Intelligence Security Center features or functionality were deprecated.


Release	Release notes
Yokohama	No updates for this release.
Zurich	No updates for this release.

Activation information

Review information on how to activate Threat Intelligence Security Center.


Release	Release notes
Yokohama	Install Threat Intelligence Security Center by requesting it from the ServiceNow Store. Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.
Zurich	Install Threat Intelligence Security Center by requesting it from the ServiceNow Store. Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.

Additional requirements

If any additional requirements were introduced or changed for Threat Intelligence Security Center we have noted them here.


Release	Release notes
Yokohama	No updates for this release.
Zurich	No updates for this release.

Browser requirements

If any specific browser requirements were introduced or changed for Threat Intelligence Security Center we have noted them here.


Release	Release notes
Yokohama	No updates for this release.
Zurich	No updates for this release.

Accessibility information

Review details on accessibility information for Threat Intelligence Security Center, such as specific requirements or compliance levels.


Release	Release notes
Yokohama	No updates for this release.
Zurich

Localization information

If there are specific localization considerations for Threat Intelligence Security Center we have noted them here.


Release	Release notes
Yokohama	No updates for this release.
Zurich	No updates for this release.

Highlight information

If there are specific highlight considerations for Threat Intelligence Security Center we have noted them here.


Release	Release notes
Yokohama	Integrate with Microsoft Defender to enable Cyber Threat Intelligence (CTI) analysts to automatically push malicious or suspicious IP addresses, domains, file hashes, and URLs from TISC to Microsoft Defender. Added creation of security incident directly from a TISC case with an option to associate observable artifacts to the security incident. Enhanced support to export observables, indicators, and cases from the list views in STIX 2.1 JSON, CSV, and Excel formats. Added settings to ingest indicators of interest based on associations to threat actors, threat reports, or malware families, including an option to include indicators deleted on CrowdStrike. Improved Threat Intelligence Feed configuration functionality to create a duplicate copy of the existing feed. See Threat Intelligence Security Center for more information.
Zurich	External sharing is now generally available, allowing secure and automated sharing of threat intelligence in STIX 2.1 and MISP formats. Redesigned the Investigation Canvas with activity timelines, added internal intelligence, improved node design and interactions, enhanced related records to retrieve all the associated records, and upgraded the MITRE card with filter capabilities for a smoother experience. Introduced the ability to import events directly from the MISP server. Implemented a unified mapping experience for the text based feeds such as TEXT, CSV, and JSON import formats. Implemented confidence mapping for the CrowdStrike (CS) Feed as part of additional settings. You can now map the malicious confidence levels of CrowdStrike indicators to the observable confidence values. See Threat Intelligence Security Center for more information.