{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":45697,"path":"security-management/threat-intelligence-security-center/tisc-zero-vul.md","title":"Zero-day vulnerability tracking","bundle":null,"doc_type":null,"release":"australia","body":"\n# Zero-day vulnerability tracking\n\nLearn how to analyze RSS Feeds coming into the system.\n\n## Before you begin\n\nRole required:\n\n-   System Administrator \\(view, create or edit\\)\n-   sn\\_sec\\_tisc.admin \\(view\\)\n\n## About this task\n\nWhenever a new RSS Feed is created into the system, and it has a mention of ‘Zero Day’ in either title or description.\n\n## Procedure\n\n1.  Navigate to **All** > **Threat Intelligence Security Center** > **Administration**.\n\n2.  Select **Automated Flows**.\n\n3.  Select **Zero-day vulnerability tracking** link to view the respective rule details in the flow designer.\n\n4.  View the flow designer action for the following trigger:\n\n    ```\n    RSS Feed Created where (Title contains zero day, or Description contains zero day, or Title contains zero_day, or Description contains zero_day, or Title contains zero-day, or Description contains zero-day)\n    ```\n\n5.  **If the observable is an IPv4 or IPv6 address and it falls within an allowed CIDR range, then:**\n\n    1.  Create a case for TISC Team, along with a remediation task for VR Team.\n\n    2.  Notify the concerned TISC Teams and VR Teams.\n\n\n**Parent Topic:**[Working with automated flows](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-automated-flows.md)\n\n**Related topics**  \n\n\n[Automated IOC Enrichment]()\n\n[Automated sharing of high-risk IOC's with trusted partners]()\n\n[Automatically add threat intelligence to a TAXII collection]()\n\n[Create vulnerability assessment for zero day]()\n\n[Analyze, assess, and disseminate observables]()\n\n[Analyze and assess threat IoC’s]()\n\n[Vulnerability Management Support]()\n\n[Automatic Threat Actor priority tagging]()\n\n[Automated flows tables]()\n\n"}}