---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# TISC integration with SIR Workspace

# TISC integration with SIR Workspace {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
TISC integration with SIR Workspace provides threat intelligence context for observables and threat entities in the security incident workspace.

Any new observables from Security Incident Response Workspace can be sent to TISC for further analysis by the CTI team using the UI actions provided on the screens.

Any enrichment results from integrations only available in Security Incident Response Workspace can also be pushed to TISC using the UI actions provided in the workspace.

You can associate TISC entities directly with a security incident, without first creating a TISC case. The supported entities are threat actor, malware, campaign, intrusion set, vulnerability, and threat report. A direct association keeps the entity context on the
incident and supports reporting on the threat actors and malware families observed in your environment.

You can create these associations from either application:

* From the TISC Context tab in Security Incident Response Workspace, link and unlink TISC records for each list.
* From the Internal Intelligence tab on a TISC record in the TISC Workspace, link and unlink security incidents.

{#tisc-integration-with-sir-workspace__ul_tisc_sir_link_directions}

The TISC Context tab lists every TISC observable linked to the security incident, whether or not a matching threat intelligence observable exists in Security Incident Response Workspace.

Each link action posts one consolidated work note in the security incident activity stream for traceability.