---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# View Internal Intelligence Records

# View Internal Intelligence Records {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
View the internal intelligence records collected from CMDB, Security Incident Response (SIR), Vulnerability Response (VR) these records.

## Before you begin

Internal Intelligence section provides the context from other applications on the platform such as SIR, VR and CMDB to provide broader perspective of the threat to the analysts.

Role required: sn_sec_tisc.analyst  
Note:  
The Internal Intelligence tab is available for observables, vulnerabilities, threat actors, malware, campaigns, intrusion sets, and threat reports.

## Procedure

1. Navigate to WorkspacesThreat Intelligence Security CenterThreat Intel LibraryObservablesAll Observables.
2. Select any observable record.
3. Go to Internal Intelligence tab.  
   The Internal intelligence section contains three subsections, Security Incident Response, Business Context, Vulnerability Response.  
   Note:  
   You must have the respective applications installed on your instance for these sections to be listed within Internal Intelligence tab.
   1. Security Incident Response: Displays all the incidents that are linked with the observables.  
      Note:  
      You can also link and unlink the records by searching the records within the source systems. For more information, see [Link Threat Intel Related Records](https://www.servicenow.com/docs/ycUrjOK5tJBy4OW5DKJH3g "Link the records that are related to the corresponding threat intelligence objects.").

      Select any record to navigate and view the details in the source system. For example, Associated Observables in Security Incident Response to fetch the
      associated observable records.
   2. Business Context: Displays the affected users and any other configuration items. As part of the current release, following is the intelligence data that you can fetch from the source (Business Context) records:
      * Configuration Items
      * Affected Services
      * Affected Assets
      {#view-internal-intelligence-records__ul_zfj_nsv_pzb}
   3. Vulnerability Response: Displays the vulnerabilities intelligence data.
   {#view-internal-intelligence-records__ol_any_ljb_pzb}
4. **Optional:** To link a security incident to the entity, select the incident, and select Link.  
   Select one or more security incidents and confirm your selection. The security incidents appear in the Security Incidents subsection.
5. **Optional:** To unlink a security incident, select one or more security incidents and select Unlink.  
   After you confirm, the security incidents are removed from the subsection.

## Result

The changes made in the TISC context or TISC internal intelligence tabs reflect bidirectionally in the TISC and SIR workspaces.

*[\>]: and then