Threat Intelligence Security Center release notes
The ServiceNow® Threat Intelligence Security Center application empowers your organization to connect security and IT teams so you can respond faster and more efficiently to threats. Threat Intelligence Security Center was enhanced and updated in the Yokohama release.
About Threat Intelligence Security Center
- Integrate with Microsoft Defender to enable Cyber Threat Intelligence (CTI) analysts to automatically push malicious or suspicious IP addresses, domains, file hashes, and URLs from TISC to Microsoft Defender.
- Added creation of security incident directly from a TISC case with an option to associate observable artifacts to the security incident.
- Enhanced support to export observables, indicators, and cases from the list views in STIX 2.1 JSON, CSV, and Excel formats.
- Added settings to ingest indicators of interest based on associations to threat actors, threat reports, or malware families, including an option to include indicators deleted on CrowdStrike.
- Improved Threat Intelligence Feed configuration functionality to create a duplicate copy of the existing feed.
See Threat Intelligence Security Center for more information.
Activation and other requirements
- Activation information
Install Threat Intelligence Security Center by requesting it from the ServiceNow Store. Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.
- Security Operations common functionality
- The Security Support Common plugin is activated when any of the plugins for the main Security Operations applications (Security Incident Response, Vulnerability Response, Threat Intelligence, or Configuration Compliance) are activated.
Yokohama Early Availability
The ServiceNow® Threat Intelligence Security Center application empowers your organization to connect security and IT teams so you can respond faster and more efficiently to threats. Threat Intelligence Security Center was enhanced and updated in the Yokohama release.
What's new
- Microsoft Defender for EDR integration
- Integration with the Microsoft Defender for EDR allows Cyber Threat Intelligence (CTI) analysts to automatically push malicious or suspicious IP addresses, domains, file hashes, and URLs to Microsoft Defender for continuous monitoring and real-time alerting.
- Create a security incident from a TISC case
- Create security incidents and associate observables to the security incidents from a TISC case.
- Duplicate threat intelligence feeds
- Duplicate threat intelligence feeds to create an exact copy of the existing feed.
Yokohama
The ServiceNow® Threat Intelligence Security Center application empowers your organization to connect security and IT teams so you can respond faster and more efficiently to threats. Threat Intelligence Security Center was enhanced and updated in the Yokohama release.
What's changed
- Courses of Action
- Renamed Course of Actions to Courses of Action.
- Create Inbound Data Exclusion Rules
- Renamed Inbound Filtering Rules to Inbound Data Exclusion Rules.