Sharing intelligence using TAXII Server

  • Release version: Zurich
  • Updated February 24, 2026
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Sharing Intelligence Using TAXII Server

    This guide provides steps for ServiceNow customers to share threat intelligence between TISC instances using TAXII collections. The process involves configurations in both the source and target TISC instances to facilitate the retrieval of intelligence data securely and efficiently.

    Show full answer Show less

    Key Features

    • TAXII-Based Sharing: Enables structured exchange of threat intelligence between TISC instances.
    • Global Sharing Rules: Configure outbound intel data exclusion rules and sharing controls based on organizational needs.
    • TAXII Collections: Set up and manage TAXII collections for the effective sharing of threat data.
    • API User Management: Establish a dedicated TAXII API user in the source instance for secure authentication.

    Key Outcomes

    By following the outlined steps, customers will be able to:

    • Seamlessly retrieve threat intelligence from a source TISC instance to a target instance.
    • Automate the addition of records to TAXII collections for continuous intelligence sharing.
    • Configure ingestion settings to define when and how frequently data is pulled from the source instance.

    You can retrieve threat intelligence from a source TISC instance into a target TISC instance using TAXII collections. This process requires configuration in both the source and target instances.

    TAXII-Based Sharing

    TAXII-based sharing enables structured and standardized exchange of threat intelligence between TISC instances. In this model, the source instance exposes intelligence through TAXII collections, and the target instance retrieves that data using a configured TAXII feed.

    Configuring the source TISC instance

    Complete the following steps in the source TISC instance before configuring the target instance.

    1. Configure global sharing rules:

      Ensure the following are configured and published based on your requirements:

    2. Create TAXII collections: Set up the required TAXII collections in the source TISC instance. For instructions, see Create a TAXII collection.

    3. Create outbound intelligence sharing templates: Create and publish an outbound intelligence sharing template with the required configuration for TAXII sharing. For instructions, see Outbound intelligence sharing templates.
    4. Add records to the TAXII collection: You can add records using either of the following methods:
    5. Create a TAXII API user for the target TISC instance: Create a dedicated API user in the source TISC instance for authentication when the target instance connects to fetch intelligence data.

      Assign the role sn_sec_tisc.taxii_server_api_user.

    Configuring the target TISC instance

    After completing the source configuration, configure the target instance to pull intelligence from the source.

    1. Create a new TAXII feed: In the target TISC instance, create a new TAXII feed. For more information, see Configure a new TAXII feed.
    2. Configure the discovery service: Set Configuration Type to Discovery Service URL and enter the following URL:
      https://{instance_name}/api/sn_sec_tisc/taxii_server/taxii2
    3. Configure Authentication:
      • Select Basic as the authentication method.
      • Provide the username and password of the TAXII API user created in the source instance.
    4. Save the configuration:

      Validate the connection then click the Get TAXII Collections button to retrieve the enabled TAXII collections from the source instance.

    5. Enable and configure ingestion:
      1. Navigate to the collection you want to ingest.
      2. Enable the collection.
      3. Specify the Fetch From Time and the desired ingestion frequency.

      All records added to the collection in the source instance after the specified time are pulled into the target instance according to the configured schedule.