{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":45488,"path":"security-management/threat-intelligence-security-center/threat-intelligence-feeds.md","title":"Threat Intelligence Feeds","bundle":null,"doc_type":null,"release":"australia","body":"\n# Threat Intelligence Feeds\n\nConfigure threat intelligence data sources to automatically import security indicators into your ServiceNow instance. Use feeds to keep threat data current and enhance security monitoring capabilities.\n\nUse Threat Intelligence Feeds to add, edit, or remove threat intelligence feed data sources. Access data source feeds from the Threat Intel Catalog under the Integrations section.\n\nThe catalog for threat intelligence feeds displays available feed data sources as tiles. You can filter, search, and navigate to source configuration details to perform various actions.\n\n## All Feeds\n\nYou can enable and use feeds displayed as cards in the base system.\n\nTo view feeds, navigate to **Workspaces** &gt; **Threat Intelligence Security Center** &gt; **Integrations** &gt; **Threat Intel Feeds** &gt; **All Feeds**.\n\n\\[Omitted image \"tisc-all-feeds.png\"\\] Alt text: Threat Intelligence Feeds\n\n## Actions on the All Feeds view\n\nYou can perform the following actions in the All Feeds section.\n\n<table id=\"table_ols_yx1_nzb\"><thead><tr><th>\n\nAction\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nAll\n\n</td><td>\n\nFilter feeds by current state using this drop-down menu. Available filter states:-   **All**: Displays all the feeds on the page. This is the default option.\n-   **Enabled**: Displays all the feeds that are in an enabled state.\n-   **Disabled**: Displays all the feeds that are in a inactive state.\n-   **Draft**: Displays all the feeds that are in a draft state.\n\n</td></tr><tr><td>\n\n\\[Omitted image \"enrich-card-view.png\"\\] Alt text: Card view\n\n</td><td>\n\nView all feeds as cards.\n\n</td></tr><tr><td>\n\n\\[Omitted image \"enrich-list-view.png\"\\] Alt text: List view\n\n</td><td>\n\nView all feeds as a list.\n\n</td></tr><tr><td>\n\n\\[Omitted image \"enrich-refresh-icon.png\"\\] Alt text: Refresh\n\n</td><td>\n\nRefresh the page.\n\n</td></tr><tr><td>\n\n\\[Omitted image \"enrich-sort-icon.png\"\\] Alt text: Sort\n\n</td><td>\n\nSort integrations by:-   **Last Modified \\(recent\\)**\n-   **Last Modified \\(oldest\\)**\n-   **Name \\(A-Z\\)**\n-   **Name \\(Z-A\\)**\n\n</td></tr><tr><td>\n\nAll items\n\n</td><td>\n\nFilter threat intelligence feed tiles by source type or feed type.**Source Type**:\n\n-   Open Source\n-   Other Source\n-   Premium Source\n\n**Feed Type**:\n\n-   CSV\n-   Custom Feed\n-   JSON\n-   MISP\n-   RSS\n-   STIX HTTPs\n-   Text\n\n</td></tr><tr><td>\n\nSearch in catalog\n\n</td><td>\n\nSearch for feeds by name and description within the catalog.\n\n</td></tr></tbody>\n</table>## Threat Intelligence feed types\n\nYou can configure and enable the following threat intelligence feed types:\n\n<table id=\"table_y2y_rnd_pyb\"><thead><tr><th>\n\nType\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nTAXII Feeds\n\n</td><td>\n\nFeeds in STIX/TAXII Collections format.\n\n</td></tr><tr><td>\n\nSTIX HTTPS\n\n</td><td>\n\nThreat intelligence feeds in STIX format accessible through REST APIs on HTTPS protocol.\n\n</td></tr><tr><td>\n\nMISP\n\n</td><td>\n\nFeeds in MISP Format Feeds.\n\n</td></tr><tr><td>\n\nText\n\n</td><td>\n\nFeeds hosted as text files.**Note:** Only URLs, domains, file names, hashes, and IP addresses are extracted.\n\n</td></tr><tr><td>\n\nCSV\n\n</td><td>\n\nFeeds hosted as CSV files.**Note:** Only URLs, domains, file names, hashes, and IP addresses are extracted.\n\n</td></tr><tr><td>\n\nJSON\n\n</td><td>\n\nFeeds hosted as JSON files.**Note:** Only URLs, domains, file names, hashes, and IP addresses are extracted.\n\n</td></tr><tr><td>\n\nRSS\n\n</td><td>\n\nFeeds in RSS format. The application will store the data as RSS Feed Records.\n\n</td></tr><tr><td>\n\nCustom\n\n</td><td>\n\nFeeds configured with custom parsers.**Note:** Only URLs, domains, file names, hashes, and IP addresses are extracted.\n\n</td></tr></tbody>\n</table>For configuration steps, refer to the respective topic for your feed type.\n\n## Editing an enabled feed\n\nWhen you enable a feed, its configuration fields are set to read-only. This behavior prevents changes to a configuration that's actively ingesting data. To change the configuration, disable the feed, make your changes, and then enable it again.\n\nThe same behavior applies to TAXII collections and to enrichment integrations.\n\n-   **[Configure a new threat intelligence feed](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-new-data-source.md)**  \nConfigure a new threat intelligence feed.\n-   **[Configure Custom Field Mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-field-mapping.md)**  \nField Mapping allows you to configure how each field in a data feed such as Text, CSV or JSON is interpreted and assigned to the corresponding observable.\n-   **[View Threat Intel Feeds](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/base-system-threat-intel-feeds.md)**  \nView threat intelligence feeds that automatically imports security data into your TISC ServiceNow instance. This enables real-time threat detection and response capabilities.\n-   **[About STIX TAXII](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/threat-intelligence-security-center-feeds.md)**  \nStructured Threat Information Expression \\(STIX\\) is a language and serialization format used to exchange cyberthreat intelligence \\(CTI\\). Trusted Automated Exchange of Intelligence Information \\(TAXII\\) is a protocol used to exchange cyberthreat intelligence \\(CTI\\) over HTTPS.\n-   **[Duplicate threat intelligence feeds](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-duplicate-feeds.md)**  \nDuplicate a threat feed to create an exact copy with all associated observables, indicators, and actors when you want to modify settings without affecting the original feed.\n\n**Parent Topic:**[Integrate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/integrating-threat-intelligence-security-center.md)\n\n**Related topics**  \n\n\n[Threat Intelligence Security Center Catalog]()\n\n[TISC Integrations]()\n\n"}}