{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":43636,"path":"security-management/c_GetStartedWithThreatIntel.md","title":"Set up Threat Intelligence","bundle":null,"doc_type":null,"release":"australia","body":"\n# Set up Threat Intelligence\n\nBefore you run Threat Intelligence in your instance, you must download it from the ServiceNow Store. You can also set up properties and define a threat source.\n\n## Install Threat Intelligence\n\nBefore you run Threat Intelligence in your instance, you must download it from the ServiceNow Store.\n\n### Before you begin\n\nComplete the following setup checklist prior to installation. These setup tasks are required for a smooth installation and configuration.\n\n\n
\n\nSetup tasks\n\n\n\nDescription\n\n
\n\nVerify that you have the required ServiceNow roles for your instance.\n\n\n\nThe following roles are required for installation, configuration, and verification of expected results:- If not already assigned, the System Administrator \\[admin\\] installs the application and assigns the Threat Admin \\[sn\\_ti.admin\\] role.\n- The Threat Admin \\[sn\\_ti.admin\\] oversees configuration and verifies expected results.\n\n
Role required: admin\n\n### Procedure\n\n1. Follow the instructions for [downloading an application from the ServiceNow Store](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/download-app-first-time.md).\n\n\n### What to do next\n\n[Set Threat Intelligence properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/c_GetStartedWithThreatIntel.md).\n\n### Components installed with Threat Intelligence\n\nSeveral types of components are installed with activation of the Threat Intelligence plugin, including tables and user roles.\n\n**Note:** The Application Files table lists the components that are installed with this application. For instructions on how to access this table, see [Find components installed with an application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-administration/find-components.md).\n\nDemo data is available for this feature.\n\n#### Roles installed\n\n\n
\n\nRole title \\[name\\]\n\n\n\nDescription\n\n\n\nContains roles\n\n
\n\nThreat Administrator\\[sn\\_ti.admin\\]\n\n\n\nHas full control over all threat properties, SLAs, and notifications.\n\n\n\nsn\\_ti.write\n\n
\n\nThreat Reader\\[sn\\_ti.read\\]\n\n\n\nHas read access to threat information.\n\n\n\nsn.sec\\_cmn.int\\_read\n\n
\n\nThreat Writer\\[sn\\_ti.write\\]\n\n\n\nHas write access to threat information.Cannot delete attack modes, indicators nor observables. Only a Threat Administrator can delete them.\n\n\n\n- sn\\_sec\\_cmn.int\\_write\n- sn\\_ti.read\n\n
\n\nMITRE Analyst\n\n \\[sn\\_ti.mitre\\_analyst\\]\n\n\n\nThis role enables read access to the MITRE-ATT&CK modules in Threat Intelligence and to the SIR module.\n\n\n\n- sn\\_ti.read\n- sn\\_si.read\n\n
#### Tables installed\n\n\n
\n\nTable\n\n\n\nDescription\n\n
\n\nAttack mechanism\\[sn\\_ti\\_attack\\_mechanism\\]\n\n\n\nOrganizes attack patterns hierarchically based on mechanisms that are frequently employed when exploiting a vulnerability. The categories that are members of this view represent the different techniques used to attack a system.\n\n
\n\n \n\n\n\n \n\n
\n\nAttack mode/method\\[sn\\_ti\\_attack\\_mode\\]\n\n\n\nAttack modes and methods are representations of the behavior of cyber adversaries. They characterize what an adversary does and how they do it in increasing levels of detail.\n\n
\n\nDiscovery method\\[sn\\_ti\\_discovery\\_method\\]\n\n\n\nAn expression of how an incident was discovered.\n\n
\n\nFeed\\[sn\\_ti\\_feed\\]\n\n\n\nUsed for configuring the Threat Feed \\(RSS\\) in the Threat Overview.\n\n
\n\nIndicator Attack mode/method\\[sn\\_ti\\_m2m\\_indicator\\_attack\\_mode\\]\n\n\n\nUsed to map attack modes/methods to indicators.\n\n
\n\nIndicator of Compromise\\[sn\\_ti\\_indicator\\]\n\n\n\nUsed to convey specific observable patterns combined with contextual information intended to represent artifacts and/or behaviors of interest within a cyber security context.\n\n
\n\nIndicator of Compromise Metadata\\[sn\\_ti\\_indicator\\_metadata\\]\n\n\n\nUsed to populate TAXII records.\n\n
\n\nIndicator Source\\[sn\\_ti\\_m2m\\_indicator\\_source\\]\n\n\n\nUsed to collect all the sources reporting the specific indicator.\n\n
\n\nIndicator Type\\[sn\\_ti\\_indicator\\_type\\]\n\n\n\nCharacterizes a cyberthreat indicator made up of a pattern identifying certain observable conditions as well as contextual information about the patterns meaning, how and when it is acted on, and so on.\n\n
\n\nAssociated Indicator Type\\[sn\\_ti\\_m2m\\_indicator\\_indicator\\_type\\]\n\n\n\nLinks indicators with their applicable types\n\n
\n\nIncident count \\[sn\\_ti\\_observable\\]\n\n\n\nNumber of security incidents associated with an observable.\n\n
\n\nIntended effect\\[sn\\_ti\\_intended\\_effect\\]\n\n\n\nUsed for expressing the intended effect of a threat actor.\n\n
\n\nIP Scan Result\\[sn\\_ti\\_ip\\_result\\]\n\n\n\nUsed to show the results of an IP lookup.\n\n
\n\nMalware Rate limit\\[sn\\_ti\\_rate\\_limit\\]\n\n\n\nDefines a rate limit to be used on a lookup source.\n\n
\n\nMalware Scan\\[sn\\_ti\\_scan\\]\n\n\n\nA lookup. Contains what to look up, with what look up source, and a summary of the lookup results.\n\n
\n\nMalware Scan Queue Entry\\[sn\\_ti\\_scan\\_q\\_entry\\]\n\n\n\nA lookup record queued for lookup or processing. Facilitates the requests within stated rate limits.\n\n
\n\nMalware Scan Result\\[sn\\_ti\\_scan\\_result\\]\n\n\n\nDisplays the result of a lookup.\n\n
\n\nMalware Scanner\\[sn\\_ti\\_scanner\\]\n\n\n\nDefines third-party lookup sources to use in performing lookups.\n\n
\n\nMalware Scanner Rate Limit\\[sn\\_ti\\_scanner\\_rate\\_limit\\]\n\n\n\nAssociates a lookup source with a rate limit.\n\n
\n\nMalware Type\\[sn\\_ti\\_malware\\_type\\]\n\n\n\nUsed for expressing the types of malware instances.\n\n
\n\nObservable\\[sn\\_ti\\_observable\\]\n\n\n\nObservables in STIX represent stateful properties or measurable events pertinent to the operation of computers and networks.\n\n
\n\nObservable Context Type\\[sn\\_ti\\_observable\\_context\\_type\\]\n\n\n\nStores the context \\(source, destination of an IP address, and so forth\\) for an observable.\n\n
\n\nObservable Indicator\\[sn\\_ti\\_m2m\\_observable\\_indicator\\]\n\n\n\nUsed to relate observables to indicators.\n\n
\n\nObservable Source\\[sn\\_ti\\_observable\\_source\\]\n\n\n\nUsed to relate observables to threat sources.\n\n
\n\nObservable Type\\[sn\\_ti\\_observable\\_type\\]\n\n\n\nLists the various types of observables, such as IP addresses.\n\n
\n\nObservable Type Category\\[sn\\_ti\\_observable\\_type\\_category\\]\n\n\n\nStores the first categorization of observables \\(for example, IP addresses and URLs\\). It is used for more accurately determining observable types.\n\n
\n\nRelated attack mode/method\\[sn\\_ti\\_m2m\\_attack\\_mode\\_attack\\_mode\\]\n\n\n\nUsed to relate attack modes to each other.\n\n
\n\nRelated Observables\\[sn\\_ti\\_m2m\\_observables\\]\n\n\n\nUsed to relate observables to each other.\n\n
\n\nScan type\\[sn\\_ti\\_scan\\_type\\]\n\n\n\nThe definition of a lookup type, with initial records for File, URL, and IP.\n\n
\n\nSecurity Case\\[sn\\_ti\\_case\\]\n\n\n\nStores security case records created using Case Management.\n\n
\n\nSecurity Case IoC\\[sn\\_ti\\_case\\_ioc\\]\n\n\n\nUsed to manage the relationship between observables and cases.\n\n
\n\nSecurity Case Related Task\\[sn\\_ti\\_m2m\\_case\\_task\\]\n\n\n\nUsed to manage the relationship between tasks \\(security incidents, change requests, and so forth\\) with security cases.\n\n
\n\nSecurity Case Relationship Exclusion\\[sn\\_ti\\_case\\_relationship\\_exclusion\\]\n\n\n\nProvides the definition of inclusion and exclusion of related records in security cases.\n\n
\n\nSighting\\[sn\\_ti\\_sighting\\]\n\n\n\nThe m2m link between the observable and the Sightings Search detail result used in the execution of a Sighting Search request.\n\n
\n\nSighting Configuration Items\\[sn\\_ti\\_m2m\\_sighting\\_ci\\]\n\n\n\nMaps configuration items to a Sightings Search.\n\n
\n\nSighting Search Detail\\[sn\\_ti\\_sighting\\_search\\_detail\\]\n\n\n\nDetails of a Sighting Search for example the number of internal external items found.\n\n
\n\nSighting Search Result\\[sn\\_ti\\_sighting\\_search\\]\n\n\n\nThe header for a Sightings Search execution.\n\n
\n\nSupported Observable Types\\[sn\\_ti\\_m2m\\_ind\\_type\\_obs\\_type\\]\n\n\n\nRelates indicator types to valid observable types.\n\n
\n\nSupported Scan Type\\[sn\\_ti\\_supported\\_scan\\_type\\]\n\n\n\nMaps the lookup type to a lookup source/vendor-specific implementation. Indicates that a specific lookup source supports the type.\n\n
\n\nTask Attack mode/method\\[sn\\_ti\\_m2m\\_task\\_attack\\_mode\\]\n\n\n\nRelates attack modes to tasks.\n\n
\n\nTask Indicator\\[sn\\_ti\\_m2m\\_task\\_indicator\\]\n\n\n\nRelates indicators to tasks.\n\n
\n\nTask Observable\\[sn\\_ti\\_m2m\\_task\\_observable\\]\n\n\n\nRelates observables to tasks.\n\n
\n\nTask Sighting\\[sn\\_ti\\_m2m\\_task\\_sighting\\]\n\n\n\nStores task records \\(security incidents and cases\\) related to a sighting record.\n\n
\n\nTAXII Collection\\[sn\\_ti\\_taxii\\_collection\\]\n\n\n\nDefines a cyber-risk intelligence feed that can be imported by a TAXII server.\n\n
\n\nTAXII Profile\\[sn\\_ti\\_taxii\\_profile\\]\n\n\n\nDefines a repository for sharing cyber-risk intelligence. Contains TAXII collections.\n\n
\n\nThreat Actor type\\[sn\\_ti\\_threat\\_actor\\_type\\]\n\n\n\nProvides characterizations of malicious actors \\(or adversaries\\) representing a cyber attack threat, including presumed intent and historically observed behavior.\n\n
\n\nThreat Intelligence Source\\[sn\\_ti\\_source\\]\n\n\n\nDefines a source for importing threat data.\n\n
\n\nAssociated Attack Motivation \\[sn\\_ti\\_stix2\\_m2m\\_object\\_attack\\_motivation\\]\n\n\n\nCollects all attack motivations associated with a STIX Object.\n\n
\n\nAssociated Infrastructure Type \\[sn\\_ti\\_stix2\\_m2m\\_infra\\_type\\]\n\n\n\nLinks infrastructure with their types.\n\n
\n\nAssociated Kill Chain Phase\\[sn\\_ti\\_stix2\\_m2m\\_indicator\\_kill\\_chain\\_phase\\]\n\n\n\nLinks kill chain phases to indicators.\n\n
\n\nAssociated Kill Chain Phase\\[sn\\_ti\\_stix2\\_m2m\\_object\\_kill\\_chain\\_phase\\]\n\n\n\nLinks kill chain phases to STIX objects.\n\n
\n\nAssociated Malware Capability\\[sn\\_ti\\_stix2\\_m2m\\_malware\\_capability\\]\n\n\n\nLinks malware with their capabilities.\n\n
\n\nAssociated Malware Type\\[sn\\_ti\\_stix2\\_m2m\\_malware\\_malware\\_type\\]\n\n\n\nLinks malware with their types.\n\n
\n\nAssociated Observable\\[sn\\_ti\\_stix2\\_m2m\\_malware\\_observable\\]\n\n\n\nCollects all observables associated with a malware.\n\n
\n\nAssociated Observable\\[sn\\_ti\\_stix2\\_m2m\\_observed\\_data\\_observable\\]\n\n\n\nCollects all observables associated with an observed data.\n\n
\n\nAssociated Report Type\\[sn\\_ti\\_stix2\\_m2m\\_report\\_report\\_type\\]\n\n\n\nLinks threat reports with their types.\n\n
\n\nAssociated Threat Actor Role\\[sn\\_ti\\_stix2\\_m2m\\_threat\\_actor\\_threat\\_actor\\_role\\]\n\n\n\nLinks threat actors with their roles.\n\n
\n\nAssociated Threat Actor Type\\[sn\\_ti\\_stix2\\_m2m\\_threat\\_actor\\_threat\\_actor\\_type\\]\n\n\n\nLinks threat actors with their types.\n\n
\n\nAssociated Tool Type\\[sn\\_ti\\_stix2\\_m2m\\_tool\\_tool\\_type\\]\n\n\n\nLinks tools with their types.\n\n
\n\nAttack Motivation\\[sn\\_ti\\_stix2\\_attack\\_motivation\\]\n\n\n\nAttack Motivation shapes the intensity and the persistence of an attack. Threat Actors and Intrusion Sets usually act in a manner that reflects their underlying emotion or situation, and this informs defenders of the manner of attack.\n\n
\n\nAttack Pattern\\[sn\\_ti\\_stix2\\_attack\\_pattern\\]\n\n\n\nA TTP type that describes methods that adversaries use to attempt to compromise targets.\n\n
\n\nCampaign\\[sn\\_ti\\_stix2\\_campaign\\]\n\n\n\nA grouping of adversarial behaviors that describe a set of malicious activities or attacks \\(sometimes named as waves\\) that occur over a period against a specific set of targets.\n\n
\n\nCourse of Action\\[sn\\_ti\\_stix2\\_course\\_of\\_action\\]\n\n\n\nA recommendation from a producer of intelligence to a consumer on the actions that they might take in response to intelligence.\n\n
\n\nExternal Reference\\[sn\\_ti\\_stix2\\_external\\_reference\\]\n\n\n\nPointers to information represented outside of STIX.\n\n
\n\nIdentity Sighting\\[sn\\_ti\\_stix2\\_m2m\\_sighting\\_identity\\]\n\n\n\nCollects all Identities associated with a Sighting.\n\n
\n\nIdentity\\[sn\\_ti\\_stix2\\_identity\\]\n\n\n\nActual individuals, organizations, or groups \\(example ACME, Inc.\\) as well as classes of individuals, organizations, systems, or groups \\(example the finance sector\\).\n\n
\n\nIndicator External Reference\\[sn\\_ti\\_stix2\\_indicator\\_external\\_reference\\]\n\n\n\nRepresents external references associated with indicators.\n\n
\n\nIndicator Sighting\\[sn\\_ti\\_stix2\\_indicator\\_sighting\\]\n\n\n\nRepresents sightings of indicators.\n\n
\n\nInfrastructure Type\\[sn\\_ti\\_stix2\\_infrastructure\\_type\\]\n\n\n\nRepresents the various infrastructure types.\n\n
\n\nInfrastructure\\[sn\\_ti\\_stix2\\_infrastructure\\]\n\n\n\nA TTP type that describes any systems, software services, and any associated physical or virtual resources, intended to support some purpose \\(example C2 servers used as part of an attack, device, or server that are part of defense, database servers targeted by an attack, and the like\\).\n\n
\n\nInstalled software\\[sn\\_ti\\_stix2\\_m2m\\_malware\\_analysis\\_sw\\]\n\n\n\nCollects all software \\(SCO software types\\) associated with a malware analysis.\n\n
\n\nIntrusion Set\\[sn\\_ti\\_stix2\\_intrusion\\_set\\]\n\n\n\nA grouped set of adversarial behaviors and resources with common properties that is believed to be orchestrated by a single organization.\n\n
\n\nKill Chain Phase\\[sn\\_ti\\_stix2\\_kill\\_chain\\_phase\\]\n\n\n\nRepresents kill chain phases associated with a kill chain.\n\n
\n\nKill Chain\\[sn\\_ti\\_stix2\\_kill\\_chain\\]\n\n\n\nRepresents various kill chains.\n\n
\n\nLocation\\[sn\\_ti\\_stix2\\_location\\]\n\n\n\nRepresents a geographic location provided through STIX.\n\n
\n\nMalware Analysis\\[sn\\_ti\\_stix2\\_malware\\_analysis\\]\n\n\n\nThe metadata and results of a particular static or dynamic analysis performed on a malware instance or family.\n\n
\n\nMalware Capability\\[sn\\_ti\\_stix2\\_malware\\_capability\\]\n\n\n\nRepresents common capabilities that a malware family or instance exhibits.\n\n
\n\nMalware Operating System\\[sn\\_ti\\_stix2\\_m2m\\_malware\\_operating\\_system\\]\n\n\n\nCollects all Operating Systems \\(SCO software types\\) associated with malware.\n\n
\n\nMalware\\[sn\\_ti\\_stix2\\_malware\\]\n\n\n\nA TTP type that represents malicious code.\n\n
\n\nMarking Definition\\[sn\\_ti\\_stix2\\_marking\\_definition\\]\n\n\n\nRepresents handling or sharing requirements for STIX Objects.\n\n
\n\nObject Sighting\\[sn\\_ti\\_stix2\\_object\\_sighting\\]\n\n\n\nRepresents sightings of STIX Objects.\n\n
\n\nObject-Indicator Relationship\\[sn\\_ti\\_stix2\\_m2m\\_object\\_indicator\\]\n\n\n\nCollects all relationships between STIX objects and STIX indicators.\n\n
\n\nObject-Object Relationship\\[sn\\_ti\\_stix2\\_m2m\\_object\\]\n\n\n\nCollects all relationships between STIX Objects and other STIX objects excluding the indicators.\n\n
\n\nObject-Observable Relationship\\[sn\\_ti\\_stix2\\_m2m\\_object\\_observable\\]\n\n\n\nCollects all relationships between STIX observables and STIX objects.\n\n
\n\nObserved Data Sighting\\[sn\\_ti\\_stix2\\_m2m\\_sighting\\_observed\\_data\\]\n\n\n\nCollects all the observed data objects associated to a sighting.\n\n
\n\nObserved Data\\[sn\\_ti\\_stix2\\_observed\\_data\\]\n\n\n\nConveys information about cyber security-related entities such as files, systems, and networks using the STIX Cyber-Observable Objects \\(SCOs\\).\n\n
\n\nReport Type\\[sn\\_ti\\_stix2\\_report\\_type\\]\n\n\n\nRepresents primary purpose or subject of Threat Reports.\n\n
\n\nReported Observable\\[sn\\_ti\\_stix2\\_m2m\\_malware\\_analysis\\_observable\\]\n\n\n\nCollects all observables associated to Malware Analysis.\n\n
\n\nSTIX V2 Object\\[sn\\_ti\\_stix2\\_object\\]\n\n\n\nCommon parent table for STIX Object.\n\n
\n\nSTIX V2 Sighting\\[sn\\_ti\\_stix2\\_sighting\\]\n\n\n\nCommon parent table for STIX sighting tables.\n\n
\n\nThreat Actor Role\\[sn\\_ti\\_stix2\\_threat\\_actor\\_role\\]\n\n\n\nRepresents roles that can be played by threat actors.\n\n
\n\nThreat Actor\\[sn\\_ti\\_stix2\\_threat\\_actor\\]\n\n\n\nThreat Actors are actual individuals, groups, or organizations believed to be operating with malicious intent.\n\n
\n\nThreat Grouping\\[sn\\_ti\\_stix2\\_threat\\_grouping\\]\n\n\n\nGroups all the STIX Objects that share some common context.\n\n
\n\nThreat Note\\[sn\\_ti\\_stix2\\_threat\\_note\\]\n\n\n\nProvides context and additional analysis not contained in the corresponding STIX Object.\n\n
\n\nThreat Opinion\\[sn\\_ti\\_stix2\\_threat\\_opinion\\]\n\n\n\nProvides assessment of accuracy of information in a STIX object produced by a different entity.\n\n
\n\nThreat Report\\[sn\\_ti\\_stix2\\_threat\\_report\\]\n\n\n\nReports are collections of threat intelligence focused on one or more topics, such as a description of a threat actor, malware, or attack technique, including context and related details. They are used to group-related threat intelligence together to publish as a comprehensive cyber threat story.\n\n
\n\nTool Type\\[sn\\_ti\\_stix2\\_tool\\_type\\]\n\n\n\nThe categories of tools that can be used to perform attacks.\n\n
\n\nTool\\[sn\\_ti\\_stix2\\_tool\\]\n\n\n\nTools are legitimate software that is used by threat actors to perform attacks.\n\n
\n\nVulnerability\\[sn\\_ti\\_stix2\\_vulnerability\\]\n\n\n\nRepresents weakness or defect in the requirements, designs, or implementations of the computational logic \\(example code\\) found in software and some hardware components \\(example firmware\\). They can be directly exploited to negatively impact the confidentiality, integrity, or availability of that system.\n\n
## Set Threat Intelligence properties\n\nThreat Intelligence properties allow you to control how different aspects of the system function, including the setting of API keys.\n\n### Before you begin\n\nRole required: sn\\_ti.admin\n\n### Procedure\n\n1. Navigate to **All** > **Threat Intelligence** > **Administration** > **Properties**.\n\n2. Set the following properties, as needed.\n\n\n
\n\nProperty\n\n\n\nDescription\n\n
\n\nThe domain name to retrieve additional information for IP addresses/URLssn\\_ti.ip\\_lookup.web\\_site\n\n\n\nThe domain name to use for retrieving additional information into your IoC database. This property is used by the `ThreatAdditionalInfo` script include to populate additional information on the Observables form.\n\n Default value: http://api.ipinfodb.com/v3/ip-country/\n\n **Note:** The pinfodb.com third-party API is available at no extra charge and used in many commercial software programs. If you replace it with a different domain name, you must also provide the API key in the next field.\n\n
\n\nThe API key to be used for the domain, if anysn\\_ti.ip\\_lookup.api\\_key\n\n\n\nThe API key to use for retrieving additional information into your IoC database. This property is used \\(along with the sn\\_ti.ip\\_lookup.web\\_site property\\) by the `ThreatAdditionalInfo` script include to populate additional information on the Observables form.\n\n
\n\nDo not run automated threat lookup on an observable when the observable is associated with an IoC or found to be malicious. sn\\_ti.scan\\_ioc\\_before\\_sending\n\n **Note:** You need to define the duration in the next property \\(sn\\_ti.scan\\_ioc\\_num\\_days\\).\n\n\n\nOption to stop running the automated threat lookup on an observable when the observable is found to be malicious or associated with an IoC for the configured duration \\(in days\\). If you still need to run the threat look up for the observable, you can do it manually.\n\n Default value: Yes\n\n
\n\nDuration \\(in days\\)sn\\_ti.scan\\_ioc\\_num\\_days\n\n\n\nOption to define the duration until which the automated threat lookup of the observable is skipped.\n\n Default value \\(in days\\): 30\n\n
\n\nDo not run automated threat lookup on an observable if already run. sn\\_ti.enable\\_threat\\_lookup\\_bypass\n\n **Note:** You need to define the duration in the next property \\(sn\\_ti.threat\\_lookup\\_bypass\\_times\\).\n\n\n\nIf there is a threat lookup result for an observable already available, then you have an option to skip the rerun of the automated threat lookup for the same observable until the configured duration has passed.\n\n Default value: No\n\n**Note:** If you're enabling this property, make sure that you are adding an appropriate value.\n\n
\n\nDuration \\(in minutes\\)sn\\_ti.threat\\_lookup\\_bypass\\_time\n\n\n\nOption to define the duration after which the automated threat lookup of the observable can be rerun.\n\n Default value \\(in minutes\\): 0\n\n
\n\nObservable finding override mode sn\\_ti.observable\\_finding\\_override\\_mode\n\n\n\nControls how user-set observable findings interact with system-calculated findings from threat lookups.- **Default** — System always recalculates findings from threat lookup results.\n- **Override** — User can override findings for a limited time. Configure the validity in the next property \\(sn\\_ti.observable\\_finding\\_override\\_expiry\\).\n- **Precedence** — Findings follow a defined priority order. Upgrades are applied immediately; downgrades are deferred until the per-observable-type expiry window elapses.\nDefault value: default\n\n
\n\nValidity \\(in minutes\\)sn\\_ti.observable\\_finding\\_override\\_expiry\n\n **Note:** Applicable only when the override mode is set to Override.\n\n\n\nOption to define the validity period of the observable finding. The system does not recalculate the finding during this period.Default value \\(in minutes\\): none\n\n
\n\nObservable finding precedence order sn\\_ti.observable\\_finding\\_precedence\\_order\n\n **Note:** Applicable only when the override mode is set to Precedence.\n\n\n\nComma-separated list of finding values in precedence order. The first value in the list has the highest priority. Use the finding identifiers as defined on the observable finding field.Default value: Malicious,Suspicious,Unknown,Clean\n\n
\n\nWhen an attack mode/method has not been received from any source for the specified number of days, mark it as inactivesn\\_ti.attack\\_mode\\_inactivate\\_days\n\n\n\nNumber of days from when an attack mode/method was last received for the record to be marked inactive.\n\n Default value: 360\n\n **Note:** The **Active** check box is not visible on the **Attack mode/method** form by default. However, you can add it. When attack modes/methods are inactive, they cannot be selected on other forms.\n\n
\n\nWhen an indicator has not been received from any source for the specified number of days, mark it as inactivesn\\_ti.indicator\\_inactivate\\_days\n\n\n\nNumber of days from when an indicator was last received for the record to be marked inactive.\n\n Default value: 180\n\n **Note:** The **Active** check box is not visible on the **Indicator** form by default. However, you can add it. When indicators are inactive, they cannot be selected on other forms.\n\n
\n\nThe maximum payload size \\(in MB\\) for a STIX attachment that can be parsed.sn\\_ti.stix.max\\_payload\\_size\n\n\n\nSpecifies the maximum payload size for the STIX attachment that you can parse.\n\n Default value: none\n\n Maximum allowed value: No limit.\n\n
\n\nMaximum time in seconds an outbound HTTP connection waits to fetch TAXII collection datasn\\_ti.taxii.http.max\\_timeout\n\n\n\nSpecifies the maximum amount of time an outbound HTTP connection waits before fetching the next packet of TAXII collection data.\n\n Default value: 300\n\n
\n\nMaximum number of objects retrieved in one REST call from a TAXII server \\(Applicable only for TAXII versions 2.0 and 2.1\\)sn\\_ti.taxii.max\\_page\\_size\n\n\n\nSpecifies the maximum number of objects retrieved in one REST call from the TAXII server for one page.\n\n Default value: 5000\n\n Maximum allowed value: 50000\n\n
\n\nMaximum number of retries for a failed TAXII 2.X REST callsn\\_ti.taxii2.retry\\_count\n\n\n\nSpecifies the maximum number of retries for a failed TAXII REST call.\n\n Default value: 3\n\n
3. Click **Save**.\n\n\n## Define a threat source\n\nYou can maintain a list of Threat Intelligence threat sources. Each source includes the ability to define how often a source is queried. You can also execute a threat source on demand to import the needed Structured Threat Information eXpression \\(STIX\\) data.\n\n### Before you begin\n\nRole required: sn\\_ti.admin\n\n### About this task\n\nThreat Intelligence employs two technologies for importing threat-related information: STIX and Trusted Automated Exchange of Indicator Information \\(TAXII\\).\n\nSTIX provides a standardized, structured language for representing an extensive set of cyberthreat information that includes indicators of compromise \\(IoC\\) activity \\(for example, IP addresses and file hashes\\), as well as contextual information regarding threats, such as attack modes/methods, that together more completely characterize the motivations, capabilities, and activities of a cyber adversary. As such, STIX data provides valuable information on how your organization can best to defend against cyberthreats.\n\nTrusted Automated Exchange of Indicator Information \\(TAXII\\) is used to facilitate automated exchange of cyberthreat information. TAXII defines a set of services and message exchanges that enable sharing of actionable cyberthreat information across organization and product/service boundaries for the detection, prevention, and mitigation of cyberthreats. TAXII profiles can be set up as repositories for sharing STIX-formatted information. Each profile contains one or more TAXII collections or feeds.\n\n### Procedure\n\n1. Navigate to **All** > **Threat Intelligence** > **Sources** > **Threat Sources**.\n\n2. Click **New**.\n\n3. Fill in the fields on the form, as appropriate.\n\n |Field|Description|\n |-----|-----------|\n |Name|The name of the threat source.|\n |Application|The application that contains this record.|\n |Active|Select this check box to activate the threat source.|\n |Advanced|Select this check box to display the scripts in the **Integration factory script** and **Report processor** fields.|\n |Description|A description of this threat source.|\n\n4. Fill in the fields in the **Schedule** section, as appropriate.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nRun\n\n\n\nThe frequency you want the integration to run, Daily, Weekly, Periodically, and so on. As noted, subsequent fields are displayed based on the setting of this field.\n\n
\n\nDay\n\n\n\nThe day you want the integration to run.- If you selected **Weekly** in the **Run** field, this field displays the days of the week.\n- If you selected **Monthly** in the **Run** field, this field displays the days of the month.\n\n\n
\n\nTime\n\n\n\nThe time you want the integration to start.\n\n
\n\nRepeat Interval\n\n\n\nIf you selected **Periodically** in the **Run** field, this field displays the number of days, and hours before the integration runs again.\n\n
\n\nStarting\n\n\n\nIf you selected **Periodically** in the **Run** field, this field displays the dates, and time to be used as the starting point for periodic updates.\n\n
\n\nConditional\n\n\n\nSelect this field if you want to add conditional parameters.\n\n
\n\nCondition\n\n\n\nIf you selected the **Conditional** check box, enter the conditions here.\n\n
5. Fill in the fields in the **Threat Details** section, as appropriate.\n\n |Field|Description|\n |-----|-----------|\n |Indicator|The indicator to use when the data doesn’t explicitly provide one. For blocklists, if empty, a new indicator is created for each observable.|\n |Indicator type|The indicator type to use for indicators that are created and the data doesn’t explicitly provide an indicator type.|\n |Attack Mode/Method|The attack mode/method to use when the data doesn’t explicitly provide one.|\n |Observable Type|The observable type to use for observables that are created and the data doesn’t explicitly provide an observable type.\\[SI1\\]|\n |Weight|Enter a weight value for this source to be used in the confidence calculation.|\n\n **Note:** The usage of the **Indicator**, **Indicator Type**, **Attack Mode/Method**, and **Observable Type** fields are implementation-specific. The default processor, SimpleBlocklistProcessor, behaves as the tooltips describe. However, a TAXII threat source is fully data driven. Any custom threat source processor would be able to use its own strategy. These fields are basically items to expose to the integration/processor and the implementation decides how to use them.\n\n6. Fill in the fields in the **Source Details** section, as appropriate.\n\n |Field|Description|\n |-----|-----------|\n |Endpoint|Enter the web service endpoint URL where the threat source is accessed by Threat Intelligence. Click the lock icon to lock the URL.|\n |Use REST Message|If you need a REST message to access the threat source, select this check box. The **REST message** and **REST method** fields become required.|\n |REST message|Click the lookup icon, and select the REST message from the list or click **New** to [define a new REST message](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/api-reference/web-services/t_ConfiguringARESTMessage.md).|\n |REST method|Click the lookup icon, and select the REST method from the list or click **New** to define a new REST method.|\n |Integration script|The default integration script is **SimpleRESTSecurityDataIntegration**. It runs a simple REST call, saves the response as an attachment, and then returns the attachment to the processor. This script meets the needs of most organizations. But if you want, you can click the lookup icon, and select a different integration script or define a new one.|\n |Integration factory script|If the **Advanced** check box is selected, this field displays the actual script for constructing the integration script. You can edit the script as needed. This ability is useful for custom implementations. Integrations in the base system usually don’t need any custom constructor logic.|\n |Report processor|The default integration script is **SimpleBlocklistProcessor**. This script is a simple processor that accepts a simple blocklist \\(simple, meaning a single column document with observables such as URLs or IP addresses\\) and creates observables. It uses the various **Threat Details** fields to determine which fields to set when observables are created.|\n |Processor factory script|If the **Advanced** check box is selected, this field displays the actual script for constructing the processor. You can edit the script as needed. This script is generally useful for custom implementations. The integrations in the base system usually don’t need custom constructor logic.|\n\n7. Click **Submit**.\n\n **Note:** For more information on how to configure the threat source's pagination, see [KB1213825](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1213825) article.\n\n\n## Create a TAXII profile\n\nYou can maintain TAXII profiles for sharing STIX-formatted information. Each profile contains one or more TAXII collections or feeds.\n\n### Before you begin\n\nRole required: sn\\_ti.admin\n\n### Procedure\n\n1. Navigate to **All** > **Threat Intelligence** > **Sources** > **TAXII Profiles**.\n\n2. Click **New**.\n\n3. Complete the following fields as appropriate.\n\n |Field|Description|\n |-----|-----------|\n |**Name**|The name of the TAXII profile|\n |**Application**|The application that contains this record.|\n |**Use REST messages as template**|If you require a REST message to access the TAXII profile, select this check box.|\n |**TAXII Version**|Specify the TAXII version. The supported STIX versions are 1.1, 2.0, and 2.1.|\n |**Description**|A description of this TAXII profile.|\n\n4. Fill in the fields in the **Discovery Service Configuration** section, as appropriate.\n\n |Field|Description|\n |-----|-----------|\n |**Discovery Service endpoint**|Discovery Endpoint authorizes clients to obtain information about a TAXII Server and get a list of API Roots.|\n |**Use REST message**|Select this option if you require a REST message to access the TAXII profile. The **Discovery Service REST message** and **Discovery Service REST method** fields become required.|\n |**Discovery Service REST message**|Click the lookup icon, and select the REST message from the list or click **New** to define a new REST message.|\n |**Discovery Service REST method**|Click the lookup icon, and select the REST message from the list or click **New** to define a new REST method.|\n\n5. Fill in the fields in the **Collection Service Configuration** section, as appropriate.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\n**Collection Info Service endpoint**\n\n\n\nA TAXII Collection is an interface to a logical repository of CTI objects provided by a TAXII Server and is used by TAXII Clients to send information to the TAXII Server or request information from the TAXII Server. A TAXII Server can host multiple Collections per API Root, and Collections are used to exchange information in a request–response manner.\n\n
\n\n**Use REST message**\n\n\n\nSelect this option if you require a REST message to access the TAXII profile. The **Collection Info Service REST message** and **Collection Info Service REST method** fields become required.\n\n
\n\n**Collection Info Service REST message**\n\n\n\nClick the lookup icon, and select the REST message from the list or click **New** to define a new REST message.\n\n
\n\n**Collection Info Service REST method**\n\n\n\nClick the lookup icon, and select the REST message from the list or click **New** to define a new REST method.\n\n
6. Click **Submit**.\n\n\n"}}