---
sourceDocument: Zurich Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/security-management

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Threat Intelligence

# Threat Intelligence {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The ServiceNow®
Threat Intelligence application enables you to find indicators of compromise (IoC) and enrich security incidents with threat intelligence data.

## Get started {#threat-intel-landing-page__cf-app-landing-get-started}

|-|-|-|
| [Explore Learn Threat Intelligence concepts and its key features.](https://www.servicenow.com/docs/j11MTFkdFsQh_pdQlXXNbg "The Threat Intelligence application allows you to access and provide a point of reference for your company's Structured Threat Information Expression (STIX) data. Included in Threat Intelligence is the Security Case Management application, which provides a means for analyzing threats to your organization posed by targeted campaigns or state actors.") | [Configure Set up, learn the components installed, and user roles required to meet your business needs.](https://www.servicenow.com/docs/BGoH33JMmkM_wUofhDRqLw#install-threat-lp5 "Before you run Threat Intelligence in your instance, you must download it from the ServiceNow Store.") | [Administer Set Threat Intelligence properties.](https://www.servicenow.com/docs/BGoH33JMmkM_wUofhDRqLw#t_SetThreatRespProperties "Threat Intelligence properties allow you to control how different aspects of the system function, including the setting of API keys.") |
| [Integrate Extend Threat Intelligence capabilities by integrating with ServiceNow and third-party applications.](https://www.servicenow.com/docs/nllrdAKiuLghBlMjQrclSg "The Threat Intelligence base system includes integrations to third-party malware-detection software packages. This section provides instructions for activating the plugins and configuring both ServiceNow and third-party integrations. Also included are some basic guidelines for developing your own integrations, as well as details on specific integrations included in the base system.") | [Use Manage Indicators of Compromise (IoC) and various artifacts.](https://www.servicenow.com/docs/_8aW4icuiEUBS1YZUYOHjw "Indicators of Compromise (IoC) are artifacts observed on a network or operating system that are likely to indicate an intrusion. Typical IoCs are virus signatures and IP addresses, MD5 hashes of malware files or URLs, or domain names. IoC applies for STIX 1.1 and 2.x.") | [MITRE ATT\&CK Framework Manage MITRE-ATT\&CK framework quickly identify threats and coordinate cyberattack responses.](https://www.servicenow.com/docs/H~6Ot_IAS4dqO~Q7A2b9tA "Attack modes and methods, sometimes referred to as Tactics, Techniques, and Procedures (TTPs), are representations of how cyber adversaries behave. They characterize what these adversaries do and how they do it, in increasing levels of detail. Attack modes and methods apply for STIX 1.1.") |
|   | [Security Case Management Manage Security Case Management by gathering information on suspicious activities.](https://www.servicenow.com/docs/9B_fLVSqzwjwchcLanXywg "Security Case Management provides a means for security analysts who are engaged in threat hunting to gather information on suspicious activity in their environment. Case-related records, such as security incidents, observables, CIs, and affected users can be added to cases to accommodate broad and specific analysis.") |   |
[ ]

{#threat-intel-landing-page__table_wjt_yml_xbc}

## Learning resources {#threat-intel-landing-page__section_jxx_dtl_xbc}

* [Developer training](https://developer.servicenow.com/app.do#!/training/landing)
* [Developer documentation](https://developer.servicenow.com/app.do#!/documentation)
* [Find components installed with an application](https://www.servicenow.com/docs/access?context=find-components&version=zurich&pubname=zurich-platform-administration&ft:locale=en-US)
{#threat-intel-landing-page__ul_ods_gtl_xbc}

## Troubleshoot and get help {#threat-intel-landing-page__cf-app-landing-get-help}

* [Ask questions and explore other resources for Threat Intelligence in the ServiceNow Community](https://www.servicenow.com/community/)
* [Search the Known Error Portal for known error articles](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0597477)
* [Contact Customer Service and Support](https://support.servicenow.com/now)
* [Security Operations Resource Library](https://www.servicenow.com/community/secops-articles/security-operations-resource-library/ta-p/3120885)
* [Security Operations community](https://www.servicenow.com/community/secops/ct-p/security-operations)
{#threat-intel-landing-page__ul_bkt_yml_xbc}