---
sourceDocument: Brazil Release Notes
sourceDocumentLink: https://www.servicenow.com/docs/r/release-notes

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Release Notes

ft:clusterId :

    - rn

bundleId :

    - rn


---

# Threat Intelligence Security Center release notes

# Threat Intelligence Security Center release notes {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read  
The ServiceNow®
Threat Intelligence Security Center application is built natively on the ServiceNow AI Platform to operationalize threat intelligence from feed ingestion and enrichment to investigation, response, and sharing. TISC enables security teams to act efficiently on intelligence and defend against threats. See
the following sections for release notes by version.

## About Threat Intelligence Security Center {#secops-tisc-rn__secops-tisc-rn-about}

* Accelerate threat response with AI by summarizing cases, generating reports automatically, and extracting threats directly from imported documents.
* Reduce investigation time by centralizing threat intelligence from external feeds and internal sources into a single system of action.
* Resolve threats faster by investigating and responding to cases in the Threat Analyst Workbench, using investigation canvases, MITRE ATT\&CK mapping, and case management.
* Strengthen partner collaboration by sharing threat intelligence securely across trust boundaries with inbound and outbound sharing profiles, TAXII servers, and redaction controls.
* Keep your intelligence library accurate with less effort by automating expiration, tagging, deduplication, and archival of threat data.
{#secops-tisc-rn__ul_rmk_frt_fkc}

See [Threat Intelligence Security Center](https://www.servicenow.com/docs/access?context=tisc-landing-page&version=brazil&pubname=brazil-security-management&ft:locale=en-US) for more information.{#secops-tisc-rn__secops-tisc-rn-about-2}

## Activation and other requirements {#secops-tisc-rn__secops-tisc-rn-requirements-activation}

Activation information{#secops-tisc-rn__secops-tisc-rn-activation-info}

:   Install Threat Intelligence Security Center by requesting it from the [ServiceNow store](https://store.servicenow.com/sn_appstore_store.do#!/store/home). Visit the [ServiceNow store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/r/store-release-notes/sn-store-release-notes.html).

    Install ServiceNow Otto for Threat Intelligence Security Center (TISC) to use the AI features.
    {#secops-tisc-rn__secops-tisc-rn-requirements-info-1}
{#secops-tisc-rn__secops-tisc-rn-requirements-info-1}

Upgrade information{#secops-tisc-rn__secops-tisc-rn-upgrade-info}
:
    * Changes to the automated correlation rules affect which relationships are created after upgrade. Relationships created under the previous rule logic are preserved and aren't modified.
    * Creation of potential relationships stops once the potential relationship table reaches its configured volume threshold. Review the threshold configuration after upgrade if your instance ingests high-volume feeds.
    * The Relate Indicators with Objects Based on Common Observables correlation rule is removed. Relationships it created previously are preserved.

    {#secops-tisc-rn__secops-tisc-rn-requirements-upgrade-1}
{#secops-tisc-rn__secops-tisc-rn-requirements-upgrade-1}

Additional requirements{#secops-tisc-rn__secops-tisc-rn-add-reqs}
:
    * The CrowdStrike vulnerability intelligence feed requires a CrowdStrike subscription that includes vulnerability intelligence, such as Falcon Adversary Intelligence or Falcon Adversary Intelligence Premium.
    * Sighting search with CrowdStrike NextGen SIEM requires the CrowdStrike API base URL, a client ID, and a client secret. Which log repositories you can search depends on the Falcon subscriptions enabled on your account.
    * The Extract information from documents skill must be enabled for the AI-powered intelligence import.

    {#secops-tisc-rn__secops-tisc-rn-requirements-additional-1}
{#secops-tisc-rn__secops-tisc-rn-requirements-additional-1}{#secops-tisc-rn__secops-tisc-rn-activation-details}

## Brazil Early Availability {#ariaid-title2}

Extract threat intelligence from unstructured documents using AI, sightings with CrowdStrike NextGen SIEM, and link TISC entities directly to security incidents in the SIR workspace.

### What's new {#secops-tisc-rn-2026-09__secops-tisc-2026-09-new}

[Import data using AI](https://www.servicenow.com/docs/access?context=import-data-using-ai&version=brazil&pubname=brazil-security-management&ft:locale=en-US){#secops-tisc-rn-2026-09__secops-tisc-2026-09-new-feature-1}
:   Import threat advisories as PDF or image files and let AI extract structured IOCs, threat actors, malware, and campaigns in seconds. Review extracted entities in a dedicated pane, grouped by type with AI extraction
    confidence score and reasoning, before they enter the library. Every AI-assisted import is captured in an audit record for full traceability.

[Configure CrowdStrike NextGen SIEM sighting search](https://www.servicenow.com/docs/access?context=tisc-crowdstrike-ngsiem-integration&version=brazil&pubname=brazil-security-management&ft:locale=en-US){#secops-tisc-rn-2026-09__secops-tisc-2026-09-new-feature-2}
:   Search CrowdStrike Falcon NextGen SIEM for observable sightings directly from the Threat Intelligence Library, case artifacts, or an automated workflow, with results captured as sighting records on the
    observable.

[Configure Premium Threat Feed for CrowdStrike](https://www.servicenow.com/docs/access?context=premium-threat-feed-for-crowdstrike&version=brazil&pubname=brazil-security-management&ft:locale=en-US){#secops-tisc-rn-2026-09__secops-tisc-2026-09-new-feature-3}
:   Ingest and correlate threat intelligence with integrated vulnerability intelligence feed from CrowdStrike.

[Add security incident to TISC case](https://www.servicenow.com/docs/access?context=add-incident-to-case&version=brazil&pubname=brazil-security-management&ft:locale=en-US){#secops-tisc-rn-2026-09__secops-tisc-2026-09-new-feature-4}
:   Link entities to security incidents directly from either the SIR workspace or the entity record without creating a TISC case first.

[Create a related record to link](https://www.servicenow.com/docs/access?context=tisc-create-new-related-record&version=brazil&pubname=brazil-security-management&ft:locale=en-US){#secops-tisc-rn-2026-09__secops-tisc-2026-09-new-feature-5}
:   Add related intelligence without leaving your investigation. Create and link new records from within your workflow.

[Observable extraction from indicator patterns](https://www.servicenow.com/docs/access?context=tisc-extract-observables-from-indicators&version=brazil&pubname=brazil-security-management&ft:locale=en-US){#secops-tisc-rn-2026-09__secops-tisc-2026-09-new-feature-6}
:   Observables are extracted from STIX indicator pattern values during ingestion, added to the library, and related to the parent indicator automatically.
{#secops-tisc-rn-2026-09__secops-tisc-2026-09-new-list}

### What's changed {#secops-tisc-rn-2026-09__secops-tisc-2026-09-changed}

[Automated correlation](https://www.servicenow.com/docs/access?context=automated-correlation-rules&version=brazil&pubname=brazil-security-management&ft:locale=en-US){#secops-tisc-rn-2026-09__secops-tisc-2026-09-changed-feature-1}
:   Confirmed relationship rules now apply reputation checks and direction-agnostic deduplication, producing accurate source-of-traffic and destination-of-traffic relationships. Potential correlation rules are more
    selective and correlation requires a reputation match plus multiple shared observables.

[TISC integration within SIR Workspace](https://www.servicenow.com/docs/access?context=tisc-sir-workspace&version=brazil&pubname=brazil-security-management&ft:locale=en-US){#secops-tisc-rn-2026-09__secops-tisc-2026-09-changed-feature-2}
:   Directly link or unlink TISC entities in TISC Context tab of SIR workspace. The changes made in TISC context or TISC internal intelligence tab reflect bidirectionally.

[CrowdStrike Falcon EDR integration](https://www.servicenow.com/docs/access?context=crowdstrike-edr-integration&version=brazil&pubname=brazil-security-management&ft:locale=en-US){#secops-tisc-rn-2026-09__secops-tisc-2026-09-changed-feature-3}
:   Indicators sent to CrowdStrike Falcon EDR now carry "TISC Intelligence" as the source. A configuration option applies the TISC expiration time, falling back to the observable type expiration when the option is disabled. The Prevent action is supported alongside Detect.

[Configure Premium Threat Feed for CrowdStrike](https://www.servicenow.com/docs/access?context=premium-threat-feed-for-crowdstrike&version=brazil&pubname=brazil-security-management&ft:locale=en-US){#secops-tisc-rn-2026-09__secops-tisc-2026-09-changed-feature-4}
:   Ingest Vulnerability intelligence from CrowdStrike. Feed configurations are set to read-only when they're enabled, preventing changes that would disrupt an ingestion already in progress.

[Review revoked MITRE tactic and technique associations](https://www.servicenow.com/docs/access?context=tisc-review-revoked-mitre-associations&version=brazil&pubname=brazil-security-management&ft:locale=en-US){#secops-tisc-rn-2026-09__secops-tisc-2026-09-changed-feature-5}
:   MITRE ingestion now provides a review queue for revoked technique-to-tactic associations that the newer MITRE ATT\&CK version no longer defines.
{#secops-tisc-rn-2026-09__secops-tisc-2026-09-changed-list}

### What's deprecated or removed {#secops-tisc-rn-2026-09__secops-tisc-2026-09-deprecated-removed}

Now LLM service deprecation{#secops-tisc-rn-2026-09__secops-tisc-2026-09-dep-feature-1}

:   Starting with the September 2026 release, Gemma 4 joins our growing portfolio of open-weight models available through Now LLM Service. The latest industry advancements are available alongside sovereignty-focused options. All models are hosted and governed by ServiceNow with the same infrastructure and data protections. Older models will remain available for existing published AI skills, agents, and agentic workflows, but will no longer be available for new development or configuration. For details, see the [KB3066214: ServiceNow Otto Model Upgrades](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3066214) article in the Now Support Knowledge Base.

{#secops-tisc-rn-2026-09__secops-tisc-2026-09-dep-list}

### Plugin information {#secops-tisc-rn-2026-09__secops-tisc-2026-09-plugin-info}

New plugins{#secops-tisc-rn-2026-09__secops-tisc-2026-09-new-plugins}

:   sn_sec_cs_sighting: Integrates Threat Intelligence Security Center with CrowdStrike Falcon NextGen SIEM for sighting search.{#secops-tisc-rn-2026-09__secops-tisc-2026-09-new-plugin-1}

{#secops-tisc-rn-2026-09__secops-tisc-2026-09-plugin-details}