Sharing intelligence using TAXII Server

  • Release version: Australia
  • Updated March 12, 2026
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Sharing Intelligence Using TAXII Server

    Sharing intelligence using TAXII Server allows ServiceNow customers to transfer threat intelligence data between TISC instances effectively. This involves configuring both the source and target instances to enable structured and standardized data exchange through TAXII collections.

    Show full answer Show less

    Key Features

    • TAXII-Based Sharing: Facilitates the secure exchange of threat intelligence by enabling the source instance to expose data through TAXII collections.
    • Configuration Steps: Involves specific setup actions in both source and target TISC instances to ensure seamless data retrieval.
    • API User Creation: Requires creating a dedicated API user in the source instance for authentication when connecting the target instance.

    Key Outcomes

    By following the outlined configuration steps, customers can:

    • Effectively share threat intelligence across instances, enhancing their security posture.
    • Automate the addition of intelligence records through various methods, ensuring timely updates.
    • Configure the target instance to pull intelligence data on a specified schedule, allowing for real-time threat awareness.

    You can retrieve threat intelligence from a source TISC instance into a target TISC instance using TAXII collections. This process requires configuration in both the source and target instances.

    TAXII-Based Sharing

    TAXII-based sharing enables structured and standardized exchange of threat intelligence between TISC instances. In this model, the source instance exposes intelligence through TAXII collections, and the target instance retrieves that data using a configured TAXII feed.

    Configuring the source TISC instance

    Complete the following steps in the source TISC instance before configuring the target instance.

    1. Configure global sharing rules:

      Ensure the following are configured and published based on your requirements:

    2. Create TAXII collections: Set up the required TAXII collections in the source TISC instance. For instructions, see Create a TAXII collection.

    3. Create outbound intelligence sharing templates: Create and publish an outbound intelligence sharing template with the required configuration for TAXII sharing. For instructions, see Outbound intelligence sharing templates.
    4. Add records to the TAXII collection: You can add records using either of the following methods:
    5. Create a TAXII API user for the target TISC instance: Create a dedicated API user in the source TISC instance for authentication when the target instance connects to fetch intelligence data.

      Assign the role sn_sec_tisc.taxii_server_api_user.

    Configuring the target TISC instance

    After completing the source configuration, configure the target instance to pull intelligence from the source.

    1. Create a new TAXII feed: In the target TISC instance, create a new TAXII feed. For more information, see Configure a new TAXII feed.
    2. Configure the discovery service: Set Configuration Type to Discovery Service URL and enter the following URL:
      https://{instance_name}/api/sn_sec_tisc/taxii_server/taxii2
    3. Configure Authentication:
      • Select Basic as the authentication method.
      • Provide the username and password of the TAXII API user created in the source instance.
    4. Save the configuration:

      Validate the connection then click the Get TAXII Collections button to retrieve the enabled TAXII collections from the source instance.

    5. Enable and configure ingestion:
      1. Navigate to the collection you want to ingest.
      2. Enable the collection.
      3. Specify the Fetch From Time and the desired ingestion frequency.

      All records added to the collection in the source instance after the specified time are pulled into the target instance according to the configured schedule.