---
sourceDocument: Yokohama Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/security-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Threat Intel Library

# Threat Intel Library {#ariaid-title1}

* Release version: Yokohama
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

A threat library is defined as a group of organized objects and entities that serve the organizations with structured and unstructured security threat information.

The threat information is available in the form of feeds. The feeds provides you with valuable threat data from sources such as STIX, MISP, and so on, which lists threat intelligence entities.

Threat Intelligence Security Center library explains how to browse through the data, by performing basic and advanced searches, and filtering rules, invoke import assistant, manually add threat intelligence records, take necessary
actions such as adding to allow list, deny list, and watch list.

The detailed view provides the insights to the intelligence records and from list views you can perform quick actions on one or more records.
* **[Understanding the Data Model](https://www.servicenow.com/docs/JvbHihlTe8jVWT8lv~Tp1g)**   
  The data model and architecture of threat intelligence security center module is designed to support threat intelligence platform capabilities and different security views that provides detailed data for threat analysts.
* **[TISC Library Objects form view](https://www.servicenow.com/docs/jMSpvRfJXvu7R5ffjZRHdQ)**   
  The Threat Intelligence Security Center objects home page consists of the following features.
* **[TISC Library Repository](https://www.servicenow.com/docs/M~rXHs6WoWc7tQk8LH2~zg)**   
  IoC repository contains STIX objects, each of these objects contain a specific piece of information.
* **[Access Vulnerability Downstream actions](https://www.servicenow.com/docs/MxYDil~PTXIFReDSImpNDw)**   
  Access all downstream actions generated from a vulnerability record to track remediation progress and understand the scope of response activities.
* **[Deleting threat intelligence library records](https://www.servicenow.com/docs/HBqtJBWLy8oOSlUgUHG7bg)**   
  Delete threat intelligence library records such as observables, indicators, and objects.
* **[Export intelligence data](https://www.servicenow.com/docs/OGCTjOwblyYRPOrzHe5qmw)**   
  Use the export feature to manually export the intelligence data in various formats.
* **[Confirm Potential Relationships from Related Records](https://www.servicenow.com/docs/nZgK3GbruHkqWmEnwCPRww)**   
  Confirm the relationships between the two SDOs.
* **[Automated Correlation](https://www.servicenow.com/docs/cOH1qz6X6W80lobk0Jq~aQ)**   
  Automated correlation helps you to identify the relationships between observables, indicators, and objects.