---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Automated Sharing of TAXII Collections

# Automated Sharing of TAXII Collections {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Automated TAXII Collections automatically add intelligence records to TAXII Server Collections for seamless distribution to trusted external partners.

## Before you begin

Role required:

* System Administrator (view, create or edit)
* sn_sec_tisc.admin (view)
{#tisc-automated-share-taxii__ul_vbr_fxh_qfc}

## About this task

The automated flow action adds the record provided in the inputs to TAXII server collections configured in the selected template. For more information, see [Configuring Outbound Intel Sharing Templates](https://servicenow-prod.fluidtopics.net/160U6adHmYOxO_VAdpfWAA "Outbound Intel Sharing Templates enable you to define and control the data shared externally from the Threat Intelligence Security Center (TISC).").

Add record to TAXII Server Collection via automated process:

## Procedure

1. Navigate to AllThreat Intelligence Security CenterAdministration.
2. Select Automated Flows.
3. Select Automatically add threat intelligence to a TAXII collection action link to view the respective rule details in the flow designer.
4. View the flow designer action for the following triggers:  

        Observable Created or Updated where (Type is IP address (V4), or Type is IP address (V6), or Type is Domain Name; and TISC Tags contains Add to: Sample Collection, and Reputation is Malicious, and Threat Score greater than or is 60)  Actions Select multiple

5. Go to Actions

   | Action | Description |
   | Sharing Template\[Outbound Intel Sharing\] | Select the sharing template. Template with a usage mode of both Automated addition to TAXII Collections can be selected for Automated Sharing. For more information see, [Configuring Outbound Intel Sharing Templates](https://servicenow-prod.fluidtopics.net/160U6adHmYOxO_VAdpfWAA "Outbound Intel Sharing Templates enable you to define and control the data shared externally from the Threat Intelligence Security Center (TISC)."). |
   | Observable Record \[Observable\] | Select the type of observable record to add records to TAXII server collections. |
   | Indicator Record \[Indicator\] | Select the type of indicators record to add records to TAXII server collections. |
   | Object Record \[Object\] | Select the type of objects record to add records to TAXII server collections. |
   | Include Related Records | Select this check box to add the related records of the selected observables, including indicators and objects to TAXII server collections. |
   |-|-|

   {#tisc-automated-share-taxii__choicetable_ybr_fxh_qfc}
6. Select Done.
{#tisc-automated-share-taxii__steps_xbr_fxh_qfc}

## What to do next

Activate the flow.
**Related tasks**   

* [Create TAXII Collection](https://servicenow-prod.fluidtopics.net/DERN_dzso0Fuu581kAgDHw "Use this section to learn how to configure and define TAXII collections for sharing intelligence.")
* [Viewing TAXII Collection Records](https://servicenow-prod.fluidtopics.net/oQzlvHN5p1DSVRlLBpct~g "View the records that are added to the TAXII collections.")
* [Create TAXII Collection](https://servicenow-prod.fluidtopics.net/DERN_dzso0Fuu581kAgDHw "Use this section to learn how to configure and define TAXII collections for sharing intelligence.")
* [Configuring Outbound Intel Sharing Controls](https://servicenow-prod.fluidtopics.net/1hZHuAm0zEGADdPfUVXaIg "Use this section to configure outbound sharing controls, which determine the entities enabled for intelligence sharing from TISC to external systems.")
* [Configuring Outbound Intel Sharing Templates](https://servicenow-prod.fluidtopics.net/160U6adHmYOxO_VAdpfWAA "Outbound Intel Sharing Templates enable you to define and control the data shared externally from the Threat Intelligence Security Center (TISC).")

*[\>]: and then