{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":45517,"path":"security-management/threat-intelligence-security-center/tisc-automated-share-taxii.md","title":"Automated Sharing of TAXII Collections","bundle":null,"doc_type":null,"release":"australia","body":"\n# Automated Sharing of TAXII Collections\n\nAutomated TAXII Collections automatically add intelligence records to TAXII Server Collections for seamless distribution to trusted external partners.\n\n## Before you begin\n\nRole required:\n\n- System Administrator \\(view, create or edit\\)\n- sn\\_sec\\_tisc.admin \\(view\\)\n\n## About this task\n\nThe automated flow action adds the record provided in the inputs to TAXII server collections configured in the selected template. For more information, see [Configuring Outbound Intel Sharing Templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-intel-sharing-templates.md).\n\nAdd record to TAXII Server Collection via automated process:\n\n## Procedure\n\n1. Navigate to **All** > **Threat Intelligence Security Center** > **Administration**.\n\n2. Select **Automated Flows**.\n\n3. Select **Automatically add threat intelligence to a TAXII collection** action link to view the respective rule details in the flow designer.\n\n4. View the flow designer action for the following triggers:\n\n ```\n Observable Created or Updated where (Type is IP address (V4), or Type is IP address (V6), or Type is Domain Name; and TISC Tags contains Add to: Sample Collection, and Reputation is Malicious, and Threat Score greater than or is 60) Actions Select multiple\n ```\n\n5. Go to **Actions**\n\n\n
\n\nAction\n\n\n\nDescription\n\n
\n\n**Sharing Template\\[Outbound Intel Sharing\\]**\n\n\n\nSelect the sharing template.Template with a usage mode of both **Automated addition to TAXII Collections** can be selected for Automated Sharing.\n\n For more information see, [Configuring Outbound Intel Sharing Templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-intel-sharing-templates.md).\n\n
\n\n**Observable Record \\[Observable\\]**\n\n\n\nSelect the type of observable record to add records to TAXII server collections.\n\n
\n\n**Indicator Record \\[Indicator\\]**\n\n\n\nSelect the type of indicators record to add records to TAXII server collections.\n\n
\n\n**Object Record \\[Object\\]**\n\n\n\nSelect the type of objects record to add records to TAXII server collections.\n\n
\n\n**Include Related Records**\n\n\n\nSelect this check box to add the related records of the selected observables, including indicators and objects to TAXII server collections.\n\n
6. Select **Done**.\n\n\n## What to do next\n\nActivate the flow.\n\n**Parent Topic:**[Exploring TAXII Outbound Server](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-taxii-outbound-server.md)\n\n**Related topics** \n\n\n[Create TAXII Collection]()\n\n[Viewing TAXII Collection Records]()\n\n[Create TAXII Collection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-create-taxii-collection.md)\n\n[Configuring Outbound Intel Sharing Controls](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-outbound-sharing.md)\n\n[Configuring Outbound Intel Sharing Templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-intel-sharing-templates.md)\n\n"}}