--- sourceDocument: Brazil Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/security-management Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Threat Intelligence Security Center Knowledge Base articles # Threat Intelligence Security Center Knowledge Base articles {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Threat Intelligence Security Center Knowledge Base Articles This collection of curated Knowledge Base (KB) articles provides ServiceNow customers with essential guidance and best practices for effectively managing the Threat Intelligence Security Center (TISC). These resources cover configuration, integration, migration, data management, and operational workflows to optimize threat intelligence capabilities within TISC. Show full answer Show less ## Key Articles and Their Practical Use * **Customer Setup Guide (KB3141964):** Step-by-step configuration instructions for administrators to properly set up TISC after installation. * **Consolidated KB Index (KB1778603):** Centralized reference point for all TISC-related knowledge articles, simplifying access to documentation. * **Comparison with SIR Threat Intelligence (KB1748938):** Clarifies architectural and functional differences between standalone TISC and the Threat Intelligence module within Security Incident Response, helping customers choose or integrate products appropriately. * **Integration Architecture (KB1778607):** Details the data flow and synchronization between SIR Threat Intelligence and TISC to assist with configuring and maintaining integrations. * **Data Migration Guide (KB1706151):** Provides a procedural approach for migrating threat intelligence data from legacy SIR-TI to TISC with validation checks to ensure data integrity. * **Data Management Logic (KB1587754, KB1587756, KB1587758):** Explains parent entity identification, deduplication, and aggregation rules that maintain data quality and reduce noise in threat intelligence records. * **Best Practices Guide (KB1648039):** Recommends strategies for deploying and maintaining TISC for optimal performance and operational efficiency. * **Security Control Lists (KB1909534):** Guides configuration and use of AllowList, DenyList, and WatchList within TISC, including known behaviors affecting search results. * **Intelligence Exchange and Data Sharing (KB2148681, KB2332774, KB2197697, KB2326271):** Covers use cases and configurations for exchanging threat intelligence between TISC instances and external platforms, including MISP format support and CrowdStrike feed normalization. * **Performance Optimization (KB2677048):** Provides techniques to enhance deduplication job efficiency, especially for duplicate records originating from the same source. ## Additional Resources For comprehensive configuration and administration details beyond these KB articles, customers should consult the official ServiceNow Security Operations product documentation and TISC release notes relevant to their version. This section provides a curated list of key Knowledge Base (KB) articles related to Threat Intelligence Security Center (TISC). These resources include best practices, configuration guidance, compatibility information, and operational workflows to help you effectively manage threat intelligence and security within TISC. The following knowledge base articles provide guidance on TISC concepts, configuration, integration, and best practices. The articles are maintained in the ServiceNow internal knowledge base and are referenced from the parent index article [KB1778603](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1778603). {#tisc-kb-articles__table_cmd_wpn_k3c__entry__3} | KB ID | Title | Description | |-|-|-| | [KB3141964](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3141964) | Threat Intelligence Security Center (TISC) Customer Setup Guide | Describes the configuration steps the administrators should perform after installing the TISC application. | | [KB1778603](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1778603) | Knowledge base links for Threat Intelligence Security Center | A consolidated index of all knowledge base articles related to TISC. Use this article as the starting point for locating TISC documentation resources. | | [KB1748938](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1748938) | Difference Between Threat Intelligence Security Center (TISC) and Threat Intelligence Module in SIR (SIR-TI) | Explains the key architectural and functional differences between the standalone TISC product and the Threat Intelligence module available within Security Incident Response (SIR-TI). | | [KB1778607](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1778607) | How SIR/TI and TISC Integration Works | Describes the integration architecture and data flow between the SIR Threat Intelligence module and the Threat Intelligence Security Center, including synchronization behavior and supported configurations. | | [KB1706151](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1706151) | Migration of Data from Existing Threat Intelligence to Threat Intelligence Security Center | Provides a step-by-step guide for migrating threat intelligence data from the legacy SIR-TI module to TISC, including pre-migration checks, data mapping, and validation steps. | | [KB1587754](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1587754) | Parent Identification Logic for Various Entities in TISC | Explains the logic TISC uses to identify and assign parent entities across different threat intelligence record types such as observables, indicators, and threat groups. | | [KB1587756](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1587756) | De-duplication Logic for Various Entities in TISC | Describes how TISC identifies and resolves duplicate records across threat intelligence entities to maintain data integrity and reduce noise in the threat intelligence repository. | | [KB1587758](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1587758) | Aggregation Logic for Various Entities in TISC | Details the rules and processes TISC uses to aggregate threat intelligence data ingested from multiple sources into unified, consolidated entity records. | | [KB1648039](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648039) | Best Practices Guide for TISC | Provides recommended practices for deploying, configuring, and maintaining the Threat Intelligence Security Center for optimal performance, data accuracy, and operational efficiency. | | [KB1909534](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1909534) | Security Control List (AllowList, DenyList, WatchList) for Threat Intelligence Security Center | Documents the configuration and usage of security control lists in TISC, including AllowList, DenyList, and WatchList. Also notes a known behavior: searches with a larger number of characters return more results compared to searches with fewer characters. | | [KB2148681](https://support.servicenow.com/kb?sys_kb_id=0d2295ee4721e2102c31b98a436d43ec&id=kb_article_view) | TISC Intelligence Exchange Use Case Guide | Covers common use cases for exchanging threat intelligence data between TISC instances and with external platforms, including configuration steps and representative scenarios. | | [KB2332774](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2332774) | TISC Outbound Intelligence in MISP Format | Explains how to configure TISC to share outbound threat intelligence in MISP-compatible format so that external consumers and partner instances can ingest the data. | | [KB2197697](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2197697) | TISC MISP Processing -- MISP to TISC Mapping | Provides field-level mapping details for ingesting and processing MISP threat intelligence data within TISC, including object type conversions and attribute handling. | | [KB2326271](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2326271) | TISC CrowdStrike Custom Feed -- Internal Field Mapping | Documents the internal field mapping applied when TISC processes CrowdStrike custom feed data, enabling consistent normalization of CrowdStrike indicators into the TISC data model. | | [KB2677048](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2677048) | Improving Observable/Indicator Deduplication Job Performance -- Duplicate Records from Same Source Cleanup | Describes techniques and configurations to improve the performance of the TISC deduplication job, with guidance on cleaning up duplicate observable and indicator records that originate from the same source. | [Table 1. TISC Knowledge Base Articles] {#tisc-kb-articles__table_cmd_wpn_k3c} ## Related Resources {#tisc-kb-articles__section_jd1_fnn_k3c} For additional information about TISC configuration and administration, see the ServiceNow product documentation for Security Operations and the TISC release notes for the current release.