--- sourceDocument: zurich Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/delta-yokohama-zurich Release : - zurich ft:locale : - en-US ft:publication_title : - zurich Combined Product Files ft:clusterId : - delta3zy bundleId : - delta3zy --- # Combined Threat Intelligence Security Center release notes for upgrades from Yokohama to Zurich # Combined Threat Intelligence Security Center release notes for upgrades from Yokohama to Zurich {#ariaid-title1} Release version: Zurich Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 7 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined Threat Intelligence Security Center release notes for upgrades from Yokohama to Zurich This consolidated release note covers the key updates and changes for ServiceNow customers upgrading the Threat Intelligence Security Center (TISC) from the Yokohama release family to Zurich. It provides a comprehensive view of new features, modifications, removals, and activation details to help customers prepare for and smoothly execute the upgrade. Show full answer Show less ## New Features * **Yokohama Highlights:** * Microsoft Defender for EDR integration enables automatic pushing of malicious or suspicious indicators (IPs, domains, file hashes, URLs) for continuous monitoring and real-time alerts. * Ability to create security incidents directly from TISC cases, associating observable artifacts. * Functionality to duplicate threat intelligence feeds for easier feed management. * **Zurich Enhancements:** * External Sharing allows secure, automated dissemination of threat intelligence using STIX 2.1 and MISP formats, supporting sharing with external agencies, integrations, and TAXII-based TISC instances. * New reporting capabilities with configurable report templates outside case management. * Custom MISP API feed configuration for importing events, attributes, and objects directly into the Threat Intelligence Library. * Timeline event customization and visualization via the Investigation Canvas for improved investigation workflows. * Enhanced Splunk integration with additional configuration options for storing attributes in the Splunk KV Store. * Premium Threat Feed configuration for CrowdStrike with confidence level mapping to TISC observables. * Improved threat intelligence feed mapping to align source values with required observable fields. ## Changes * **Terminology updates:** * "Course of Actions" renamed to "Courses of Action." * "Inbound Filtering Rules" renamed to "Inbound Data Exclusion Rules." * **Zurich usability and feature improvements:** * New option to add data from internal intelligence systems into Investigation Canvas for enhanced threat analysis. * Deletion warnings for observable records to prevent accidental data loss. * Field mapping now uses a code editor preserving raw data format, improving customization and accuracy. * "Clear canvas" button added to permanently remove all nodes from investigation canvas efficiently. * Priority levels and tagging introduced for managing MITRE ATT\&CK techniques more effectively. * New system property to set default Traffic Light Protocol (TLP) level. * Import Intelligence improved to support direct addition of allow-listed observables. * Investigation Canvas enhanced with custom nodes, relationships, legends, and node grouping/ungrouping features. * Improved MITRE ATT\&CK navigation and filtering within Investigation Canvas. * Default Coral theme introduced for web, portal, and mobile experiences with optional dark mode to improve usability and reduce eye strain. ## Removals and Deprecations No features or functionality were removed or deprecated between Yokohama and Zurich releases. ## Activation and Installation TISC remains available through the ServiceNow Store for both Yokohama and Zurich. Customers should request installation from the ServiceNow Store and can refer to version history for cumulative release notes. The Security Support Common plugin activates automatically when any core Security Operations plugins are enabled. ## Additional Notes * No new browser requirements or localization changes have been introduced. * The Zurich release includes accessibility improvements such as the addition of a dark theme option to alleviate eye strain. ## Key Outcomes for ServiceNow Customers * Enhanced integration capabilities enable more seamless sharing, importing, and exporting of threat intelligence data across platforms and agencies. * Improved investigation tools and user interface updates streamline threat analysis and incident response workflows. * More flexible and secure data sharing options support collaboration with external entities, improving overall situational awareness. * Upgraded customization and configuration options allow tailoring of feeds, reports, and investigations to meet organizational needs. * Consistent theming and accessibility improvements enhance user experience across devices and environments. Consolidated page of all release notes for Threat Intelligence Security Center from Yokohama to Zurich. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family Threat Intelligence Security Center release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Yokohama to Zurich. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading Threat Intelligence Security Center to Zurich Before you upgrade to Zurich, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-threatintelligencesecuritycenter-summary__entry__2} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## New features Between your current release family and Zurich, new features were introduced for Threat Intelligence Security Center. {#dfrn3-threatintelligencesecuritycenter-summary__entry__8} | Release | Release notes | |-|-| | Yokohama | [Microsoft Defender for EDR integration](https://www.servicenow.com/docs/access?context=tisc-ms-defender-integration&family=yokohama&ft:locale=en-US) : Integration with the Microsoft Defender for EDR allows Cyber Threat Intelligence (CTI) analysts to automatically push malicious or suspicious IP addresses, domains, file hashes, and URLs to Microsoft Defender for continuous monitoring and real-time alerting. [Create a security incident from a TISC case](https://www.servicenow.com/docs/access?context=tisc-create-si-case&family=yokohama&ft:locale=en-US) : Create security incidents and associate observables to the security incidents from a TISC case. [Duplicate threat intelligence feeds](https://www.servicenow.com/docs/access?context=tisc-duplicate-feeds&family=yokohama&ft:locale=en-US) : Duplicate threat intelligence feeds to create an exact copy of the existing feed. | | Zurich | [Configuring Threat Intelligence External Sharing](https://www.servicenow.com/docs/access?context=tisc-intel-sharing&family=zurich&ft:locale=en-US) : Take advantage of external sharing for secure, automated, and on-demand dissemination of threat intelligence using STIX 2.1 and MISP formats. Supports sharing across external agencies (CISA, ISAC), integrations (SIEMs, EDRs), TAXII-based TISC instances, and inbound intelligence from external entities. [Configure report templates](https://www.servicenow.com/docs/access?context=tisc-report-templates&family=zurich&ft:locale=en-US) : Generate reports outside case management using base templates through a new reporting section in the Threat Intelligence Library. [Configure custom MISP API feed](https://www.servicenow.com/docs/access?context=tisc-premium-misp&family=zurich&ft:locale=en-US) : Import events, attributes, and objects from the MISP server into the Threat Intelligence Library. [Configure Custom Event Types for Timeline](https://www.servicenow.com/docs/access?context=tisc-config-timeline&family=zurich&ft:locale=en-US) and [Using Timeline in Investigation Canvas](https://www.servicenow.com/docs/access?context=tisc-timeline-events&family=zurich&ft:locale=en-US) : Define, visualize, and manage timeline events associated with nodes through the Investigation Canvas. [Configure TISC add-on in Splunk](https://www.servicenow.com/docs/access?context=tisc-configure-splunk&family=zurich&ft:locale=en-US) : Include optional attributes during configuration that can be stored in the Splunk KV Store. [Configure Premium Threat Feed for CrowdStrike](https://www.servicenow.com/docs/access?context=premium-threat-feed-for-crowdstrike&family=zurich&ft:locale=en-US) : Map CrowdStrike Indicator Malicious confidence to TISC confidence. [View Threat Intel Feeds](https://www.servicenow.com/docs/access?context=base-system-threat-intel-feeds&family=zurich&ft:locale=en-US) : Map specific source values to required observable fields during import process. | [ ] ## Changes Between your current release family and Zurich, some changes were made to existing Threat Intelligence Security Center features. {#dfrn3-threatintelligencesecuritycenter-summary__entry__14} | Release | Release notes | |-|-| | Yokohama | [Courses of Action](https://www.servicenow.com/docs/access?context=course-of-action&family=yokohama&ft:locale=en-US) : Renamed Course of Actions to Courses of Action. [Create Inbound Data Exclusion Rules](https://www.servicenow.com/docs/access?context=define-filtering-rules&family=yokohama&ft:locale=en-US) : Renamed Inbound Filtering Rules to Inbound Data Exclusion Rules. | | Zurich | [\[Placeholder link text to key bundle-security.tisc-canvas-internal-intel\]](https://www.servicenow.com/docs/access?context=tisc-canvas-internal-intel&family=zurich&ft:locale=en-US) : Introduced Add From Internal Intelligence option to include the data from the internal systems. [Define an Observable](https://www.servicenow.com/docs/access?context=define-an-observable&family=zurich&ft:locale=en-US) : Introduced a notice when deleting an observable record to help prevent accidental removal of its associated source records. [Configure Custom Field Mapping](https://www.servicenow.com/docs/access?context=tisc-field-mapping&family=zurich&ft:locale=en-US) : The list view has been replaced with a code editor in the Sample data (Input) section of the field mapping, preserving the original structure and formatting of raw data. [Creating an investigation canvas](https://www.servicenow.com/docs/access?context=tisc-create-canvas&family=zurich&ft:locale=en-US) Clear canvas button : A Clear canvas button to clear the canvas permanently removes all nodes from the investigation canvas. [Manage Techniques](https://www.servicenow.com/docs/access?context=tisc-manage-techniques&family=zurich&ft:locale=en-US) : Introduced Priority levels and TISC Tags to categorize and tag MITRE Techniques more effectively. [Components installed with Threat Intelligence Security Center](https://www.servicenow.com/docs/access?context=tisc-components-installed&family=zurich&ft:locale=en-US) : Introduced a new system property to configure the default Traffic Light Protocol (TLP) level. [Import data using structured file](https://www.servicenow.com/docs/access?context=import-data-using-structured-file&family=zurich&ft:locale=en-US) : Introduced an Add Observable(s) to Security Control List drop-down list to enable the importing of Allow listed observables directly through Import Intelligence. Coral theme : Coral is now the default theme for new portal, web, and mobile experiences with Next Experience or Core UI enabled. This theme provides a fresh look and feel, featuring brand-neutral illustrations to enhance your user experience. A dark theme option is available for web and mobile experiences. [\[Placeholder link text to key bundle-security.tisc-canvas-internal-intel\]](https://www.servicenow.com/docs/access?context=tisc-canvas-internal-intel&family=zurich&ft:locale=en-US) : Aggregate and analyze the data from internal systems through internal intelligence included in the Investigation Canvas module to help you identify potential threats more effectively. [Import Intelligence in TISC](https://www.servicenow.com/docs/access?context=importing-threat-intelligence&family=zurich&ft:locale=en-US) : Enhanced the Import Intelligence functionality to support direct import of allow list observables. [Working with Investigation Canvas](https://www.servicenow.com/docs/access?context=tisc-investigation-canvases&family=zurich&ft:locale=en-US) : The Investigation Canvas feature has been extended to include customized nodes, node relationships, and node legends, as well as the grouping and ungrouping of nodes. [Investigation canvas and MITRE ATT\&CK](https://www.servicenow.com/docs/access?context=investigation-and-mitre&family=zurich&ft:locale=en-US) : Navigate and use the MITRE-ATT\&CK model within the Investigation Canvas more effectively by taking advantage of enhanced filtering options. | [ ] ## Removed Between your current release family and Zurich, some Threat Intelligence Security Center features or functionality were removed. {#dfrn3-threatintelligencesecuritycenter-summary__entry__20} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Deprecations Between your current release family and Zurich, some Threat Intelligence Security Center features or functionality were deprecated. {#dfrn3-threatintelligencesecuritycenter-summary__entry__26} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Activation information Review information on how to activate Threat Intelligence Security Center. {#dfrn3-threatintelligencesecuritycenter-summary__entry__32} | Release | Release notes | |-|-| | Yokohama | Activation information : Install Threat Intelligence Security Center by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=yokohama&ft:locale=en-US). [Security Operations common functionality](https://www.servicenow.com/docs/access?context=sec-ops-common-functionality&family=yokohama&ft:locale=en-US) : The Security Support Common plugin is activated when any of the plugins for the main Security Operations applications (Security Incident Response, Vulnerability Response, Threat Intelligence, or Configuration Compliance) are activated. Important: Threat Intelligence Security Center is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | | Zurich | Activation information : Install Threat Intelligence Security Center by requesting it from the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home). Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=zurich&ft:locale=en-US). Important: Threat Intelligence Security Center is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | [ ] ## Additional requirements If any additional requirements were introduced or changed for Threat Intelligence Security Center we have noted them here. {#dfrn3-threatintelligencesecuritycenter-summary__entry__38} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for Threat Intelligence Security Center we have noted them here. {#dfrn3-threatintelligencesecuritycenter-summary__entry__44} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for Threat Intelligence Security Center, such as specific requirements or compliance levels. {#dfrn3-threatintelligencesecuritycenter-summary__entry__50} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | Accessibility information : Dark theme : The new Coral theme includes a dark theme option for web and mobile experiences. This option is commonly used to alleviate eye strain and improve readability. | [ ] ## Localization information If there are specific localization considerations for Threat Intelligence Security Center we have noted them here. {#dfrn3-threatintelligencesecuritycenter-summary__entry__56} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for Threat Intelligence Security Center we have noted them here. {#dfrn3-threatintelligencesecuritycenter-summary__entry__62} | Release | Release notes | |-|-| | Yokohama | * Integrate with Microsoft Defender to enable Cyber Threat Intelligence (CTI) analysts to automatically push malicious or suspicious IP addresses, domains, file hashes, and URLs from TISC to Microsoft Defender. * Added creation of security incident directly from a TISC case with an option to associate observable artifacts to the security incident. * Enhanced support to export observables, indicators, and cases from the list views in STIX 2.1 JSON, CSV, and Excel formats. * Added settings to ingest indicators of interest based on associations to threat actors, threat reports, or malware families, including an option to include indicators deleted on CrowdStrike. * Improved Threat Intelligence Feed configuration functionality to create a duplicate copy of the existing feed. See [Threat Intelligence Security Center](https://www.servicenow.com/docs/access?context=tisc-landing-page&family=yokohama&ft:locale=en-US) for more information. | | Zurich | * External sharing is now generally available, allowing secure and automated sharing of threat intelligence in STIX 2.1 and MISP formats. * Redesigned the Investigation Canvas with activity timelines, added internal intelligence, improved node design and interactions, enhanced related records to retrieve all the associated records, and upgraded the MITRE card with filter capabilities for a smoother experience. * Introduced the ability to import events directly from the MISP server. * Implemented a unified mapping experience for the text based feeds such as TEXT, CSV, and JSON import formats. * Implemented confidence mapping for the CrowdStrike (CS) Feed as part of additional settings. You can now map the malicious confidence levels of CrowdStrike indicators to the observable confidence values. See [Threat Intelligence Security Center](https://www.servicenow.com/docs/access?context=tisc-landing-page&family=zurich&ft:locale=en-US) for more information. | [ ]