--- sourceDocument: zurich Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/delta-xanadu-zurich Release : - zurich ft:locale : - en-US ft:publication_title : - zurich Combined Product Files ft:clusterId : - delta3zx bundleId : - delta3zx --- # Combined Threat Intelligence Security Center release notes for upgrades from Xanadu to Zurich # Combined Threat Intelligence Security Center release notes for upgrades from Xanadu to Zurich {#ariaid-title1} Release version: Zurich Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 9 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined Threat Intelligence Security Center Release Notes for Upgrades from Xanadu to Zurich The release notes consolidate all updates, new features, changes, removals, and activation information for the Threat Intelligence Security Center (TISC) from the Xanadu release through to Zurich. This comprehensive guide assists ServiceNow customers in preparing for upgrades, understanding enhancements, and applying new capabilities effectively. Show full answer Show less Key upgrade advice includes reviewing pre- and post-upgrade tasks specific to the Zurich release. The release notes clarify that there were no removals or deprecations during these upgrade cycles. ## New Features * **Xanadu to Yokohama:** * Integration with Palo Alto Networks to manage External Dynamic Lists (EDLs) directly from TISC. * CrowdStrike Falcon EDR integration for continuous monitoring and real-time alerting. * Support for MITRE ATT\&CK technique associations at observable, indicator, and entity levels, with roll-up capabilities at the case level. * Introduction of Investigation Canvas for interactive, in-depth case analysis with enhanced relationship graph visualizations. * Bulk taxonomy value uploads and expanded TISC API 2.0 for creating observables programmatically. * New expiration rules for data sources and record types, webhook-triggered notifications, and automation flows to streamline analyst actions. * Ability to add security incidents and observables directly to TISC cases within the Security Incident Response Workspace. * **Yokohama to Zurich:** * External sharing of threat intelligence using STIX 2.1 and MISP formats, supporting secure, automated dissemination across agencies, integrations, and TAXII-based TISC instances. * New report template configuration for generating reports outside case management. * Custom MISP API feed integration to import events, attributes, and objects into the Threat Intelligence Library. * Enhanced Investigation Canvas with timeline event configuration and visualization, including custom event types and improved node interactions. * Optional attributes configurable in the Splunk KV Store during TISC add-on setup. * Confidence mapping for CrowdStrike threat feeds, allowing malicious confidence levels to align with TISC observable confidence values. * Improved threat intel feed imports with source value mapping to observable fields. ## Changes * **Xanadu to Yokohama:** * Library repository enhancements allowing aliases to be added directly from form views. * Terminology updates: "Course of Actions" renamed to "Courses of Action" and "Inbound Filtering Rules" renamed to "Inbound Data Exclusion Rules." * **Yokohama to Zurich:** * Added "Add From Internal Intelligence" feature to incorporate internal system data into Investigation Canvas. * Observable deletion warnings to prevent accidental data loss. * Field mapping interface updated from list view to code editor for better raw data structure preservation. * Investigation Canvas enhancements including a clear canvas button, customizable MITRE technique priority levels and tagging, and expanded node management. * New system property for default Traffic Light Protocol (TLP) level configuration. * "Coral" theme introduced as the new default UI theme with a dark mode option for improved accessibility and user experience. * Import Intelligence enhancements to support direct importing of allow-listed observables. ## Activation Information TISC installation and activation continue to be managed via the ServiceNow Store. Activation of any core Security Operations plugins (Security Incident Response, Vulnerability Response, Threat Intelligence, or Configuration Compliance) will enable the Security Support Common plugin automatically. Customers are advised to consult the ServiceNow Store for the latest app availability and version history. ## Accessibility and User Experience * The new Coral UI theme includes a dark mode for web and mobile, enhancing readability and reducing eye strain. * Visual and interaction improvements in Investigation Canvas and relationship graphs facilitate more intuitive threat analysis. ## Practical Benefits for ServiceNow Customers * Enhanced integrations with leading security tools (Palo Alto Networks, CrowdStrike Falcon, Microsoft Defender) allow automated threat detection, alerting, and response workflows within TISC. * Improved threat intelligence sharing capabilities support collaboration with external agencies and seamless data exchange. * Advanced data visualization and timeline features in Investigation Canvas enable deeper, more interactive investigations. * Automation and API enhancements streamline analyst tasks, improving efficiency and reducing manual effort. * UI updates offer a more accessible and user-friendly experience tailored for diverse analyst preferences. Consolidated page of all release notes for Threat Intelligence Security Center from Xanadu to Zurich. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family Threat Intelligence Security Center release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Xanadu to Zurich. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading Threat Intelligence Security Center to Zurich Before you upgrade to Zurich, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-threatintelligencesecuritycenter-summary__entry__2} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## New features Between your current release family and Zurich, new features were introduced for Threat Intelligence Security Center. {#dfrn3-threatintelligencesecuritycenter-summary__entry__10} | Release | Release notes | |-|-| | Xanadu | [\[Placeholder link text to key bundle-security.view-associated-techniques\]](https://www.servicenow.com/docs/access?context=view-associated-techniques&family=xanadu&ft:locale=en-US) : All observables, indicators, and entities now supports MITRE technique associations. [Roll up of MITRE technique associations](https://www.servicenow.com/docs/access?context=tisc-mitre-roll-up&family=xanadu&ft:locale=en-US) : MITRE techniques can now be rolled up from artifacts at a case level both manually and automatically. [Palo Alto Networks integration](https://www.servicenow.com/docs/access?context=palo-alto-networks-integration&family=xanadu&ft:locale=en-US) : Integration with Palo Alto is now available to manage External Dynamic Lists (EDLs) directly from TISC. [CrowdStrike Falcon EDR integration](https://www.servicenow.com/docs/access?context=crowdstrike-edr-integration&family=xanadu&ft:locale=en-US) : Integration with CrowdStrike Falcon EDR is now available for continuous monitoring and real-time alerting based on TISC intelligence. [Working with Investigation Canvases](https://www.servicenow.com/docs/access?context=tisc-investigation-canvases&family=xanadu&ft:locale=en-US) : Introduced a new Investigation Canvas for deeper and interactive case analysis. [View details in Relationship Graph](https://www.servicenow.com/docs/access?context=objects-visualizer&family=xanadu&ft:locale=en-US) : Enhanced the user experience on relationship visualizations. [Bulk import Taxonomies](https://www.servicenow.com/docs/access?context=tisc-import-taxonomy&family=xanadu&ft:locale=en-US) : Supports bulk taxonomy values upload. [TISC API References](https://www.servicenow.com/docs/access?context=tisc-api-references&family=xanadu&ft:locale=en-US) : Creating observables in TISC is now available through the implementation of TISC API 2.0. [Defining Expiration Rules](https://www.servicenow.com/docs/access?context=tisc-expiration-rules&family=xanadu&ft:locale=en-US) : Define expiration policies at a more granular level by creating expiration rules for data source and record type combinations. [Working with Webhooks](https://www.servicenow.com/docs/access?context=tisc-webhooks&family=xanadu&ft:locale=en-US) : Initiate trigger-based notifications by using Webhooks. [Working with automated flows](https://www.servicenow.com/docs/access?context=tisc-automated-flows&family=xanadu&ft:locale=en-US) : Automate analyst actions through sample automation flows. [Add observables to TISC Case](https://www.servicenow.com/docs/access?context=observables-to-case&family=xanadu&ft:locale=en-US) : Add security incident and observables directly to a TISC case in the Security Incident Response Workspace. [MITRE ATT\&CK Technique Extraction Rules](https://www.servicenow.com/docs/access?context=mitre-extraction-rules&family=xanadu&ft:locale=en-US) : Capture automatically extracted MITRE techniques to the intelligence records such as observables, indicators, and all STIX entities. | | Yokohama | [Microsoft Defender for EDR integration](https://www.servicenow.com/docs/access?context=tisc-ms-defender-integration&family=yokohama&ft:locale=en-US) : Integration with the Microsoft Defender for EDR allows Cyber Threat Intelligence (CTI) analysts to automatically push malicious or suspicious IP addresses, domains, file hashes, and URLs to Microsoft Defender for continuous monitoring and real-time alerting. [Create a security incident from a TISC case](https://www.servicenow.com/docs/access?context=tisc-create-si-case&family=yokohama&ft:locale=en-US) : Create security incidents and associate observables to the security incidents from a TISC case. [Duplicate threat intelligence feeds](https://www.servicenow.com/docs/access?context=tisc-duplicate-feeds&family=yokohama&ft:locale=en-US) : Duplicate threat intelligence feeds to create an exact copy of the existing feed. | | Zurich | [Configuring Threat Intelligence External Sharing](https://www.servicenow.com/docs/access?context=tisc-intel-sharing&family=zurich&ft:locale=en-US) : Take advantage of external sharing for secure, automated, and on-demand dissemination of threat intelligence using STIX 2.1 and MISP formats. Supports sharing across external agencies (CISA, ISAC), integrations (SIEMs, EDRs), TAXII-based TISC instances, and inbound intelligence from external entities. [Configure report templates](https://www.servicenow.com/docs/access?context=tisc-report-templates&family=zurich&ft:locale=en-US) : Generate reports outside case management using base templates through a new reporting section in the Threat Intelligence Library. [Configure custom MISP API feed](https://www.servicenow.com/docs/access?context=tisc-premium-misp&family=zurich&ft:locale=en-US) : Import events, attributes, and objects from the MISP server into the Threat Intelligence Library. [Configure Custom Event Types for Timeline](https://www.servicenow.com/docs/access?context=tisc-config-timeline&family=zurich&ft:locale=en-US) and [Using Timeline in Investigation Canvas](https://www.servicenow.com/docs/access?context=tisc-timeline-events&family=zurich&ft:locale=en-US) : Define, visualize, and manage timeline events associated with nodes through the Investigation Canvas. [Configure TISC add-on in Splunk](https://www.servicenow.com/docs/access?context=tisc-configure-splunk&family=zurich&ft:locale=en-US) : Include optional attributes during configuration that can be stored in the Splunk KV Store. [Configure Premium Threat Feed for CrowdStrike](https://www.servicenow.com/docs/access?context=premium-threat-feed-for-crowdstrike&family=zurich&ft:locale=en-US) : Map CrowdStrike Indicator Malicious confidence to TISC confidence. [View Threat Intel Feeds](https://www.servicenow.com/docs/access?context=base-system-threat-intel-feeds&family=zurich&ft:locale=en-US) : Map specific source values to required observable fields during import process. | [ ] ## Changes Between your current release family and Zurich, some changes were made to existing Threat Intelligence Security Center features. {#dfrn3-threatintelligencesecuritycenter-summary__entry__18} | Release | Release notes | |-|-| | Xanadu | [TISC Library Repository](https://www.servicenow.com/docs/access?context=tisc-ioc&family=xanadu&ft:locale=en-US) : New aliases can now be added directly from the form views of the threat intelligence library. | | Yokohama | [Courses of Action](https://www.servicenow.com/docs/access?context=course-of-action&family=yokohama&ft:locale=en-US) : Renamed Course of Actions to Courses of Action. [Create Inbound Data Exclusion Rules](https://www.servicenow.com/docs/access?context=define-filtering-rules&family=yokohama&ft:locale=en-US) : Renamed Inbound Filtering Rules to Inbound Data Exclusion Rules. | | Zurich | [\[Placeholder link text to key bundle-security.tisc-canvas-internal-intel\]](https://www.servicenow.com/docs/access?context=tisc-canvas-internal-intel&family=zurich&ft:locale=en-US) : Introduced Add From Internal Intelligence option to include the data from the internal systems. [Define an Observable](https://www.servicenow.com/docs/access?context=define-an-observable&family=zurich&ft:locale=en-US) : Introduced a notice when deleting an observable record to help prevent accidental removal of its associated source records. [Configure Custom Field Mapping](https://www.servicenow.com/docs/access?context=tisc-field-mapping&family=zurich&ft:locale=en-US) : The list view has been replaced with a code editor in the Sample data (Input) section of the field mapping, preserving the original structure and formatting of raw data. [Creating an investigation canvas](https://www.servicenow.com/docs/access?context=tisc-create-canvas&family=zurich&ft:locale=en-US) Clear canvas button : A Clear canvas button to clear the canvas permanently removes all nodes from the investigation canvas. [Manage Techniques](https://www.servicenow.com/docs/access?context=tisc-manage-techniques&family=zurich&ft:locale=en-US) : Introduced Priority levels and TISC Tags to categorize and tag MITRE Techniques more effectively. [Components installed with Threat Intelligence Security Center](https://www.servicenow.com/docs/access?context=tisc-components-installed&family=zurich&ft:locale=en-US) : Introduced a new system property to configure the default Traffic Light Protocol (TLP) level. [Import data using structured file](https://www.servicenow.com/docs/access?context=import-data-using-structured-file&family=zurich&ft:locale=en-US) : Introduced an Add Observable(s) to Security Control List drop-down list to enable the importing of Allow listed observables directly through Import Intelligence. Coral theme : Coral is now the default theme for new portal, web, and mobile experiences with Next Experience or Core UI enabled. This theme provides a fresh look and feel, featuring brand-neutral illustrations to enhance your user experience. A dark theme option is available for web and mobile experiences. [\[Placeholder link text to key bundle-security.tisc-canvas-internal-intel\]](https://www.servicenow.com/docs/access?context=tisc-canvas-internal-intel&family=zurich&ft:locale=en-US) : Aggregate and analyze the data from internal systems through internal intelligence included in the Investigation Canvas module to help you identify potential threats more effectively. [Import Intelligence in TISC](https://www.servicenow.com/docs/access?context=importing-threat-intelligence&family=zurich&ft:locale=en-US) : Enhanced the Import Intelligence functionality to support direct import of allow list observables. [Working with Investigation Canvas](https://www.servicenow.com/docs/access?context=tisc-investigation-canvases&family=zurich&ft:locale=en-US) : The Investigation Canvas feature has been extended to include customized nodes, node relationships, and node legends, as well as the grouping and ungrouping of nodes. [Investigation canvas and MITRE ATT\&CK](https://www.servicenow.com/docs/access?context=investigation-and-mitre&family=zurich&ft:locale=en-US) : Navigate and use the MITRE-ATT\&CK model within the Investigation Canvas more effectively by taking advantage of enhanced filtering options. | [ ] ## Removed Between your current release family and Zurich, some Threat Intelligence Security Center features or functionality were removed. {#dfrn3-threatintelligencesecuritycenter-summary__entry__26} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Deprecations Between your current release family and Zurich, some Threat Intelligence Security Center features or functionality were deprecated. {#dfrn3-threatintelligencesecuritycenter-summary__entry__34} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Activation information Review information on how to activate Threat Intelligence Security Center. {#dfrn3-threatintelligencesecuritycenter-summary__entry__42} | Release | Release notes | |-|-| | Xanadu | Install Threat Intelligence Security Center by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=xanadu&ft:locale=en-US). [Security Operations common functionality](https://www.servicenow.com/docs/access?context=sec-ops-common-functionality&family=xanadu&ft:locale=en-US) : When any of the plugins for the main Security Operations applications (Security Incident Response, Vulnerability Response, Threat Intelligence, or Configuration Compliance) are activated, the Security Support Common plugin is activated. | | Yokohama | Activation information : Install Threat Intelligence Security Center by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=yokohama&ft:locale=en-US). [Security Operations common functionality](https://www.servicenow.com/docs/access?context=sec-ops-common-functionality&family=yokohama&ft:locale=en-US) : The Security Support Common plugin is activated when any of the plugins for the main Security Operations applications (Security Incident Response, Vulnerability Response, Threat Intelligence, or Configuration Compliance) are activated. Important: Threat Intelligence Security Center is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | | Zurich | Activation information : Install Threat Intelligence Security Center by requesting it from the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home). Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=zurich&ft:locale=en-US). Important: Threat Intelligence Security Center is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | [ ] ## Additional requirements If any additional requirements were introduced or changed for Threat Intelligence Security Center we have noted them here. {#dfrn3-threatintelligencesecuritycenter-summary__entry__50} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for Threat Intelligence Security Center we have noted them here. {#dfrn3-threatintelligencesecuritycenter-summary__entry__58} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for Threat Intelligence Security Center, such as specific requirements or compliance levels. {#dfrn3-threatintelligencesecuritycenter-summary__entry__66} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | Accessibility information : Dark theme : The new Coral theme includes a dark theme option for web and mobile experiences. This option is commonly used to alleviate eye strain and improve readability. | [ ] ## Localization information If there are specific localization considerations for Threat Intelligence Security Center we have noted them here. {#dfrn3-threatintelligencesecuritycenter-summary__entry__74} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for Threat Intelligence Security Center we have noted them here. {#dfrn3-threatintelligencesecuritycenter-summary__entry__82} | Release | Release notes | |-|-| | Xanadu | * Visualize node connections between entities like observables, IOCs, and threat actors, and link cases or canvases to enrich analysis. * Enable continuous monitoring and real-time alerts based on intelligence from TISC with CrowdStrike Falcon EDR integration. * Block malicious IPs, URLs, and domains using External Dynamic List (EDL) capabilities with Threat Intelligence data and Palo Alto Networks integration. * Manage the analyst actions through automation flows. * Conduct research on threats to support the reactive and proactive needs of security teams. * Create and track threat investigations using Case Management. See [Threat Intelligence Security Center](https://www.servicenow.com/docs/access?context=tisc-landing-page&family=xanadu&ft:locale=en-US) for more information. | | Yokohama | * Integrate with Microsoft Defender to enable Cyber Threat Intelligence (CTI) analysts to automatically push malicious or suspicious IP addresses, domains, file hashes, and URLs from TISC to Microsoft Defender. * Added creation of security incident directly from a TISC case with an option to associate observable artifacts to the security incident. * Enhanced support to export observables, indicators, and cases from the list views in STIX 2.1 JSON, CSV, and Excel formats. * Added settings to ingest indicators of interest based on associations to threat actors, threat reports, or malware families, including an option to include indicators deleted on CrowdStrike. * Improved Threat Intelligence Feed configuration functionality to create a duplicate copy of the existing feed. See [Threat Intelligence Security Center](https://www.servicenow.com/docs/access?context=tisc-landing-page&family=yokohama&ft:locale=en-US) for more information. | | Zurich | * External sharing is now generally available, allowing secure and automated sharing of threat intelligence in STIX 2.1 and MISP formats. * Redesigned the Investigation Canvas with activity timelines, added internal intelligence, improved node design and interactions, enhanced related records to retrieve all the associated records, and upgraded the MITRE card with filter capabilities for a smoother experience. * Introduced the ability to import events directly from the MISP server. * Implemented a unified mapping experience for the text based feeds such as TEXT, CSV, and JSON import formats. * Implemented confidence mapping for the CrowdStrike (CS) Feed as part of additional settings. You can now map the malicious confidence levels of CrowdStrike indicators to the observable confidence values. See [Threat Intelligence Security Center](https://www.servicenow.com/docs/access?context=tisc-landing-page&family=zurich&ft:locale=en-US) for more information. | [ ]