---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Automatic Threat Actor priority tagging

# Automatic Threat Actor priority tagging {#ariaid-title1}

* Release version: Australia
* 
* Updated June 2, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Learn how to enable automatic tagging of Threat Actors based on their origin locations.

## Before you begin

Role required:

* admin
* sn_sec_tisc.admin
{#tisc-threat-actor-priority-tagging__ul_tap_002_bcc}

## About this task

When a relationship between a Threat Actor and a Location object is created or updated, and the relationship type is originates-from, a Priority: Critical tag is automatically
added to the Threat Actor.

## Procedure

1. Navigate to AllThreat Intelligence Security CenterAdministration.
2. Select Automated Flows.
3. Select the Automatic Threat Actor priority tagging link to view the respective rule details in the flow designer.
4. View the flow designer action for the following trigger:  

       Object-Object Relationship Created or Updated where (Source Object Type is threat-actor, and Target Object Type is location, and Target Object . Name [Location] is one of China, North Korea, and Relationship Type is originates-from, and Source Object . TISC Tags [Threat Actor] does not contain Priority: Critical)

5. If an Object-Object relationship is created or updated between a Threat Actor and a Location, and the relationship type is `originates-from`, add a <kbd class="ph userinput">Priority: Critical</kbd> tag to the Threat Actor.  
{#tisc-threat-actor-priority-tagging__steps_tap_004_bcc}
**Related concepts**   

* [Automated flows tables](https://servicenow-prod.fluidtopics.net/cxgH4KFSQ_gPPN9YVlsjYg "The following tables helps you to understand the relationship tables between entities and enrichment tables that are used in automated flows.")  
**Related tasks**   

* [Automated IOC Enrichment](https://servicenow-prod.fluidtopics.net/~YEsQr3MNrqzZLnLBMa8Xg "Learn how to automate enrichment of IOC’s using flows when they match a certain criterion.")
* [Automated sharing of high-risk IOC's with trusted partners](https://servicenow-prod.fluidtopics.net/M5XZUkj~h_Ndyj4pfQGfPQ "Learn how to automate sharing of high-risk IOC's with trusted partners.")
* [Automatically add threat intelligence to a TAXII collection](https://servicenow-prod.fluidtopics.net/d3U_nK39dPkB5YMhs8oohA "Learn how to automatically add threat intelligence to a TAXII server collection.")
* [Create vulnerability assessment for zero day](https://servicenow-prod.fluidtopics.net/~1Yn4fdXs2u73axme6JVTw "Create a vulnerability assessment to evaluate and document security risks from zero day vulnerabilities in your environment. Use this when you want to assess the potential impact of newly discovered vulnerabilities that lack available patches.")
* [Analyze, assess, and disseminate observables](https://servicenow-prod.fluidtopics.net/NAsC8DLc_I_3POC7Hrq9Dw "Learn how to analyze and disseminate observables which are related to threat.")
* [Analyze and assess threat IoC's](https://servicenow-prod.fluidtopics.net/KwPUd5iaZkDeWtRdFru7og "Learn how to analyze an IOC’s which are a threat and notifying the security incident team.")
* [Vulnerability Management Support](https://servicenow-prod.fluidtopics.net/X03Lk5SneLk45FRujqv22Q "Learn how a new vulnerability is created in TISC with a related vulnerability in VR.")
* [Zero-day vulnerability tracking](https://servicenow-prod.fluidtopics.net/_WikDYLeA3etPmaNErhdrA "Learn how to analyze RSS Feeds coming into the system.")

*[\>]: and then