Threat Intelligence Feeds

  • Release version: Australia
  • Updated March 12, 2026
  • 2 minutes to read

    • Configure threat intelligence data sources to automatically import security indicators into your ServiceNow instance. Use feeds to keep threat data current and enhance security monitoring capabilities.

    Use Threat Intelligence Feeds to add, edit, or remove threat intelligence feed data sources. Access data source feeds from the Threat Intel Catalog under the Integrations section.

    The catalog for threat intelligence feeds displays available feed data sources as tiles. You can filter, search, and navigate to source configuration details to perform various actions.

    All Feeds

    You can enable and use feeds displayed as cards in the base system.

    To view feeds, navigate to Workspaces > Threat Intelligence Security Center > Integrations > Threat Intel Feeds > All Feeds.

    Threat Intelligence Feeds

    Actions on the All Feeds view

    You can perform the following actions in the All Feeds section.
    Table 1. Actions on All Integrations view
    Action Description
    All Filter feeds by current state using this drop-down menu. Available filter states:
    • All: Displays all the feeds on the page. This is the default option.
    • Enabled: Displays all the feeds that are in an enabled state.
    • Disabled: Displays all the feeds that are in a inactive state.
    • Draft: Displays all the feeds that are in a draft state.
    Card view View all feeds as cards.
    List view View all feeds as a list.
    Refresh Refresh the page.
    Sort Sort integrations by:
    • Last Modified (recent)
    • Last Modified (oldest)
    • Name (A-Z)
    • Name (Z-A)
    All items Filter threat intelligence feed tiles by source type or feed type.
    Source Type:
    • Open Source
    • Other Source
    • Premium Source
    Feed Type:
    • CSV
    • Custom Feed
    • JSON
    • MISP
    • RSS
    • STIX HTTPs
    • Text
    Search in catalog Search for feeds by name and description within the catalog.

    Threat Intelligence feed types

    You can configure and enable the following threat intelligence feed types:
    Table 2. Threat Intelligence Feeds
    Type Description
    TAXII Feeds Feeds in STIX/TAXII Collections format.
    STIX HTTPS Threat intelligence feeds in STIX format accessible through REST APIs on HTTPS protocol.
    MISP Feeds in MISP Format Feeds.
    Text Feeds hosted as text files.
    Note:
    Only URLs, domains, file names, hashes, and IP addresses are extracted.
    CSV Feeds hosted as CSV files.
    Note:
    Only URLs, domains, file names, hashes, and IP addresses are extracted.
    JSON Feeds hosted as JSON files.
    Note:
    Only URLs, domains, file names, hashes, and IP addresses are extracted.
    RSS Feeds in RSS format. The application will store the data as RSS Feed Records.
    Custom Feeds configured with custom parsers.
    Note:
    Only URLs, domains, file names, hashes, and IP addresses are extracted.

    For configuration steps, refer to the respective topic for your feed type.