{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":45666,"path":"security-management/threat-intelligence-security-center/tisc-taxii-automated-flow.md","title":"Automatically add threat intelligence to a TAXII collection","bundle":null,"doc_type":null,"release":"australia","body":"\n# Automatically add threat intelligence to a TAXII collection\n\nLearn how to automatically add threat intelligence to a TAXII server collection.\n\n## Before you begin\n\nRole required:\n\n-   System Administrator \\(view, create or edit\\)\n-   sn\\_sec\\_tisc.admin \\(view\\)\n\n## Procedure\n\n1.  Navigate to **All** > **Threat Intelligence Security Center** > **Administration**.\n\n2.  Select **Automated Flows**.\n\n3.  Select **Automatically add threat intelligence to a TAXII collection** action link to view the respective rule details in the flow designer.\n\n4.  View the flow designer action for the following triggers:\n\n    ```\n    Observable Created or Updated where (Type is IP address (V4), or Type is IP address (V6), or Type is Domain Name; and TISC Tags contains Add to: Sample Collection, and Reputation is Malicious, and Threat Score greater than or is 60\n    ```\n\n5.  **Actions**\n\n    Adds the record provided in the inputs to TAXII server collections configured in the selected template\n\n    1.  **Add Record to TAXII Server Collection**\n\n    2.  **Add Records to TAXII Server Collection**\n\n6.  End the flow for adding threat intelligence to a TAXII collection.\n\n    \\[Omitted image \"tisc-taxii-collections-flow.png\"\\] Alt text: Automated TAXII server collection.\n\n\n**Parent Topic:**[Working with automated flows](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-automated-flows.md)\n\n**Related topics**  \n\n\n[Automated IOC Enrichment]()\n\n[Automated sharing of high-risk IOC's with trusted partners]()\n\n[Create vulnerability assessment for zero day]()\n\n[Analyze, assess, and disseminate observables]()\n\n[Analyze and assess threat IoC’s]()\n\n[Vulnerability Management Support]()\n\n[Zero-day vulnerability tracking]()\n\n[Automatic Threat Actor priority tagging]()\n\n[Automated flows tables]()\n\n"}}