jsn / ServiceNow, simplified.
AustraliaREFERENCE GUIDE

Combined Threat Intelligence Security Center release notes for upgrades from Xanadu to Australia

ServiceNow documentation·16 min readView source ↗
On this page

Combined Threat Intelligence Security Center release notes for upgrades from Xanadu to Australia

Consolidated page of all release notes for Threat Intelligence Security Center from Xanadu to Australia.

How to use this page

To help you prepare for your upgrade, we have combined the cross-family Threat Intelligence Security Center release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Xanadu to Australia.

Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says “No updates for this release.”

Important information for upgrading Threat Intelligence Security Center to Australia

Before you upgrade to Australia, review these pre- and post-upgrade tasks and complete the tasks as needed.

<table class=“custom-rows”><thead><tr><th class=“filter”>

Release

</th><th>

Release notes

</th></tr></thead><tbody><tr><td>

Xanadu

</td><td>

No updates for this release.

</td></tr><tr><td>

Yokohama

</td><td>

No updates for this release.

</td></tr><tr><td>

Zurich

</td><td>

No updates for this release.

</td></tr><tr><td>

Australia

</td><td>

No updates for this release.

</td></tr></tbody> </table>## New features

Between your current release family and Australia, new features were introduced for Threat Intelligence Security Center.

<table class=“custom-rows”><thead><tr><th class=“filter”>

Release

</th><th>

Release notes

</th></tr></thead><tbody><tr><td>

Xanadu

</td><td>

All observables, indicators, and entities now supports MITRE technique associations.

MITRE techniques can now be rolled up from artifacts at a case level both manually and automatically.

Integration with Palo Alto is now available to manage External Dynamic Lists (EDLs) directly from TISC.

Integration with CrowdStrike Falcon EDR is now available for continuous monitoring and real-time alerting based on TISC intelligence.

Introduced a new Investigation Canvas for deeper and interactive case analysis.

Enhanced the user experience on relationship visualizations.

Supports bulk taxonomy values upload.

Creating observables in TISC is now available through the implementation of TISC API 2.0.

Define expiration policies at a more granular level by creating expiration rules for data source and record type combinations.

Initiate trigger-based notifications by using Webhooks.

Automate analyst actions through sample automation flows.

Add security incident and observables directly to a TISC case in the Security Incident Response Workspace.

Capture automatically extracted MITRE techniques to the intelligence records such as observables, indicators, and all STIX entities.

</td></tr><tr><td>

Yokohama

</td><td>

Integration with the Microsoft Defender for EDR allows Cyber Threat Intelligence (CTI) analysts to automatically push malicious or suspicious IP addresses, domains, file hashes, and URLs to Microsoft Defender for continuous monitoring and real-time alerting.

Create security incidents and associate observables to the security incidents from a TISC case.

Duplicate threat intelligence feeds to create an exact copy of the existing feed.

</td></tr><tr><td>

Zurich

</td><td>

Take advantage of external sharing for secure, automated, and on-demand dissemination of threat intelligence using STIX 2.1 and MISP formats. Supports sharing across external agencies (CISA, ISAC), integrations (SIEMs, EDRs), TAXII-based TISC instances, and inbound intelligence from external entities.

Generate reports outside case management using base templates through a new reporting section in the Threat Intelligence Library.

Import events, attributes, and objects from the MISP server into the Threat Intelligence Library.

Define, visualize, and manage timeline events associated with nodes through the Investigation Canvas.

Include optional attributes during configuration that can be stored in the Splunk KV Store.

Map CrowdStrike Indicator Malicious confidence to TISC confidence.

Map specific source values to required observable fields during import process.

</td></tr><tr><td>

Australia

</td><td>

The ServiceNow AI Platform now brings you a new AI experience with three licensing tiers available:

-   Foundation: AI basics to deliver insights
-   Advanced: AI to boost productivity across relevant use cases
-   Prime: Act autonomously with all AI assets, and create your own

Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents.

Introduced the TISC Report Authoring skill to generate analyst‑grade threat intelligence reports from threat cases. Supports configurable styling and analyst-defined instructions for content and focus.

The TISC Case Summarization skill brings generative AI capabilities directly into threat intelligence workflows. Analysts can generate concise AI-powered summaries of threat cases, including case overview, findings, key actions taken, and recommended next steps.

Enable automatic tagging of threat actors based on their origin locations.

TISC Add-on for Splunk Enterprise adds historical data ingestion and flexible expiration handling.

The relationship graphs show immediate relationships to the home node for quick rendering of the graph. Filters enable analysts to narrow down to specific nodes and relationships.

Enhanced MITRE™ extraction rule schema to add a combined Techniques and tactics regex extraction type.

Threat hunting playbook is now available out of the box. Analysts can use Playbooks for case management as a guided, stage-based workflow for investigations.

Enhanced CrowdStrike premium Threat feed by adding Malware to the record types to ingest. Threat Actor records now link to Malware through uses and develops relationships, and to Location through originates-from and targets relationships. Report and Indicator records are linked to Malware through associated-with. Threat Actor records ingested from CrowdStrike now represent capabilities, target industries, target regions, target countries, and origins as structured tags rather than free-text, additional context fields. Users can use these attributes as filters.

Added support in TISC for Have I been pwned? (HIBP) observable enrichment, enabling analysts to identify whether observables have been exposed in known data breaches instances.

Introduced automated tagging of RSS feed records using configurable tagging rules to apply tags and taxonomies.

Introduced CWEs as related entities with support for relationship linking.

Introduced remediations as related entities with support for relationship linking and added support for managing remediations.

Introduced products as related entities with support for relationship linking.

Associated vendors as related entities with support for relationship linking.

Automatically generate zero day vulnerability records from flagged RSS feeds with extracted and linked CPE, CWE, and CVE details for enhanced threat analysis. The catalog now includes the RSS feed for Google Project Zero, enabling real-time detection of emerging threats.

Initiate vulnerability assessments directly from identified issues for faster risk evaluation. Sample workflows and flow actions are included to automate the assessment process.

Create security incident records directly from detected vulnerabilities to expedite incident response and streamline threat management workflows.

View vulnerabilities and related intelligence in the TISC Context tab of Security Incident Response Workspace, allowing analysts to quickly access risk data during investigations without navigating to separate records.

</td></tr></tbody> </table>## Changes

Between your current release family and Australia, some changes were made to existing Threat Intelligence Security Center features.

<table class=“custom-rows”><thead><tr><th class=“filter”>

Release

</th><th>

Release notes

</th></tr></thead><tbody><tr><td>

Xanadu

</td><td>

New aliases can now be added directly from the form views of the threat intelligence library.

</td></tr><tr><td>

Yokohama

</td><td>

Renamed Course of Actions to Courses of Action.

Renamed Inbound Filtering Rules to Inbound Data Exclusion Rules.

</td></tr><tr><td>

Zurich

</td><td>

Introduced Add From Internal Intelligence option to include the data from the internal systems.

Introduced a notice when deleting an observable record to help prevent accidental removal of its associated source records.

The list view has been replaced with a code editor in the Sample data (Input) section of the field mapping, preserving the original structure and formatting of raw data.

A Clear canvas button to clear the canvas permanently removes all nodes from the investigation canvas.

Introduced Priority levels and TISC Tags to categorize and tag MITRE Techniques more effectively.

Introduced a new system property to configure the default Traffic Light Protocol (TLP) level.

Introduced an Add Observable(s) to Security Control List drop-down list to enable the importing of Allow listed observables directly through Import Intelligence.

  • Coral theme

Coral is now the default theme for new portal, web, and mobile experiences with Next Experience or Core UI enabled. This theme provides a fresh look and feel, featuring brand-neutral illustrations to enhance your user experience. A dark theme option is available for web and mobile experiences.

Aggregate and analyze the data from internal systems through internal intelligence included in the Investigation Canvas module to help you identify potential threats more effectively.

Enhanced the Import Intelligence functionality to support direct import of allow list observables.

The Investigation Canvas feature has been extended to include customized nodes, node relationships, and node legends, as well as the grouping and ungrouping of nodes.

Navigate and use the MITRE-ATT&CK model within the Investigation Canvas more effectively by taking advantage of enhanced filtering options.

</td></tr><tr><td>

Australia

</td><td>

ServiceNow Otto introduced AI on the platform. As that experience has evolved, there’s a new name for the experience. ServiceNow Otto® is the conversational AI platform integrated into ServiceNow workflows. It provides agentic capabilities, supports multimodal interactions across web, mobile, and messaging channels, and enables autonomous orchestration for cross-system workflows.

Enhanced Threat Intelligence Library list views by grouping observables, indicators, threat entities, RSS feed, and vulnerability artifacts into appropriate categories for improved navigation.

Introduced a new button Create Vulnerability Assessment to conduct a vulnerability assessment for a specific vulnerability.

Introduced a new button Create Security Incident to facilitate identifying vulnerabilities and enable faster incident response within the threat analysis.

Introduced a new catalog entry which includes the RSS feed for Google Project Zero, enabling real-time detection of emerging threats.

Enabled MITRE-ATT&CK extraction rules for RSS feed to map and associate MITRE-ATT&CK techniques.

Enhanced the RSS feed schema and parsers to support additional fields, including tags, taxonomies, status, and expiration time.

Enhanced STIX 2.1 export to include Traffic Light Protocol (TLP) definitions applied to intelligence objects as TLP 2.0 marking definition objects. For more information, see Marking Definition.

The system property sn_sec_tisc.reporting.email_template_sn_sec_tisc_case is no longer supported in TISC. It has been renamed to sn_sec_tisc.default_report_email_template, effective with the latest release.

Enhanced MISP API feed ingestion to handle events when the published timestamp is greater than the modified timestamp.

Enhanced the vulnerability schema to support additional vulnerability intelligence fields related to CVSS scoring, exploit details, and remediation information.

</td></tr></tbody> </table>## Removed

Between your current release family and Australia, some Threat Intelligence Security Center features or functionality were removed.

<table class=“custom-rows”><thead><tr><th class=“filter”>

Release

</th><th>

Release notes

</th></tr></thead><tbody><tr><td>

Xanadu

</td><td>

No updates for this release.

</td></tr><tr><td>

Yokohama

</td><td>

No updates for this release.

</td></tr><tr><td>

Zurich

</td><td>

No updates for this release.

</td></tr><tr><td>

Australia

</td><td>

No updates for this release.

</td></tr></tbody> </table>## Deprecations

Between your current release family and Australia, some Threat Intelligence Security Center features or functionality were deprecated.

<table class=“custom-rows”><thead><tr><th class=“filter”>

Release

</th><th>

Release notes

</th></tr></thead><tbody><tr><td>

Xanadu

</td><td>

No updates for this release.

</td></tr><tr><td>

Yokohama

</td><td>

No updates for this release.

</td></tr><tr><td>

Zurich

</td><td>

No updates for this release.

</td></tr><tr><td>

Australia

</td><td>

No updates for this release.

</td></tr></tbody> </table>## Activation information

Review information on how to activate Threat Intelligence Security Center.

<table class=“custom-rows”><thead><tr><th class=“filter”>

Release

</th><th>

Release notes

</th></tr></thead><tbody><tr><td>

Xanadu

</td><td>

Install Threat Intelligence Security Center by requesting it from the ServiceNow Store. Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.

When any of the plugins for the main Security Operations applications (Security Incident Response, Vulnerability Response, Threat Intelligence, or Configuration Compliance) are activated, the Security Support Common plugin is activated.

</td></tr><tr><td>

Yokohama

</td><td>

  • Activation information

Install Threat Intelligence Security Center by requesting it from the ServiceNow Store. Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.

-   **[Security Operations common functionality](https://www.servicenow.com/docs/access?context=sec-ops-common-functionality&family=yokohama&ft:locale=en-US)**

The Security Support Common plugin is activated when any of the plugins for the main Security Operations applications (Security Incident Response, Vulnerability Response, Threat Intelligence, or Configuration Compliance) are activated.

Important: Threat Intelligence Security Center is available in the ServiceNow Store. For details, see the “Activation information” section of these release notes.

</td></tr><tr><td>

Zurich

</td><td>

  • Activation information

Install Threat Intelligence Security Center by requesting it from the ServiceNow Store. Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.

Important: Threat Intelligence Security Center is available in the ServiceNow Store. For details, see the “Activation information” section of these release notes.

</td></tr><tr><td>

Australia

</td><td>

  • Activation information

Install Threat Intelligence Security Center by requesting it from the ServiceNow Store. Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.

Important: Threat Intelligence Security Center is available in the ServiceNow Store. For details, see the “Activation information” section of these release notes.

</td></tr></tbody> </table>## Additional requirements

If any additional requirements were introduced or changed for Threat Intelligence Security Center we have noted them here.

<table class=“custom-rows”><thead><tr><th class=“filter”>

Release

</th><th>

Release notes

</th></tr></thead><tbody><tr><td>

Xanadu

</td><td>

No updates for this release.

</td></tr><tr><td>

Yokohama

</td><td>

No updates for this release.

</td></tr><tr><td>

Zurich

</td><td>

No updates for this release.

</td></tr><tr><td>

Australia

</td><td>

No updates for this release.

</td></tr></tbody> </table>## Browser requirements

If any specific browser requirements were introduced or changed for Threat Intelligence Security Center we have noted them here.

<table class=“custom-rows”><thead><tr><th class=“filter”>

Release

</th><th>

Release notes

</th></tr></thead><tbody><tr><td>

Xanadu

</td><td>

No updates for this release.

</td></tr><tr><td>

Yokohama

</td><td>

No updates for this release.

</td></tr><tr><td>

Zurich

</td><td>

No updates for this release.

</td></tr><tr><td>

Australia

</td><td>

No updates for this release.

</td></tr></tbody> </table>## Accessibility information

Review details on accessibility information for Threat Intelligence Security Center, such as specific requirements or compliance levels.

<table class=“custom-rows”><thead><tr><th class=“filter”>

Release

</th><th>

Release notes

</th></tr></thead><tbody><tr><td>

Xanadu

</td><td>

No updates for this release.

</td></tr><tr><td>

Yokohama

</td><td>

No updates for this release.

</td></tr><tr><td>

Zurich

</td><td>

  • Accessibility information

    • Dark theme

The new Coral theme includes a dark theme option for web and mobile experiences. This option is commonly used to alleviate eye strain and improve readability.

</td></tr><tr><td>

Australia

</td><td>

No updates for this release.

</td></tr></tbody> </table>## Localization information

If there are specific localization considerations for Threat Intelligence Security Center we have noted them here.

<table class=“custom-rows”><thead><tr><th class=“filter”>

Release

</th><th>

Release notes

</th></tr></thead><tbody><tr><td>

Xanadu

</td><td>

No updates for this release.

</td></tr><tr><td>

Yokohama

</td><td>

No updates for this release.

</td></tr><tr><td>

Zurich

</td><td>

No updates for this release.

</td></tr><tr><td>

Australia

</td><td>

No updates for this release.

</td></tr></tbody> </table>## Highlight information

If there are specific highlight considerations for Threat Intelligence Security Center we have noted them here.

<table class=“custom-rows”><thead><tr><th class=“filter”>

Release

</th><th>

Release notes

</th></tr></thead><tbody><tr><td>

Xanadu

</td><td>

  • Visualize node connections between entities like observables, IOCs, and threat actors, and link cases or canvases to enrich analysis.

  • Enable continuous monitoring and real-time alerts based on intelligence from TISC with CrowdStrike Falcon EDR integration.

  • Block malicious IPs, URLs, and domains using External Dynamic List (EDL) capabilities with Threat Intelligence data and Palo Alto Networks integration.

  • Manage the analyst actions through automation flows.

  • Conduct research on threats to support the reactive and proactive needs of security teams.​

  • Create and track threat investigations using Case Management.​

See Threat Intelligence Security Center for more information.

</td></tr><tr><td>

Yokohama

</td><td>

  • Integrate with Microsoft Defender to enable Cyber Threat Intelligence (CTI) analysts to automatically push malicious or suspicious IP addresses, domains, file hashes, and URLs from TISC to Microsoft Defender.

  • Added creation of security incident directly from a TISC case with an option to associate observable artifacts to the security incident.

  • Enhanced support to export observables, indicators, and cases from the list views in STIX 2.1 JSON, CSV, and Excel formats.

  • Added settings to ingest indicators of interest based on associations to threat actors, threat reports, or malware families, including an option to include indicators deleted on CrowdStrike.

  • Improved Threat Intelligence Feed configuration functionality to create a duplicate copy of the existing feed.

See Threat Intelligence Security Center for more information.

</td></tr><tr><td>

Zurich

</td><td>

  • External sharing is now generally available, allowing secure and automated sharing of threat intelligence in STIX 2.1 and MISP formats.

  • Redesigned the Investigation Canvas with activity timelines, added internal intelligence, improved node design and interactions, enhanced related records to retrieve all the associated records, and upgraded the MITRE card with filter capabilities for a smoother experience.

  • Introduced the ability to import events directly from the MISP server.

  • Implemented a unified mapping experience for the text based feeds such as TEXT, CSV, and JSON import formats.

  • Implemented confidence mapping for the CrowdStrike (CS) Feed as part of additional settings. You can now map the malicious confidence levels of CrowdStrike indicators to the observable confidence values.

See Threat Intelligence Security Center for more information.

</td></tr><tr><td>

Australia

</td><td>

  • ServiceNow Otto® is the new AI experience brand. This change is reflected in the name of ServiceNow products, including ServiceNow Otto for Threat Intelligence Security Center (TISC). Your product entitlements remain unchanged. Check your entitlements to determine your access to specific features.

  • Introduced AI-generated threat intelligence reports from case data with analyst-guided instructions.

  • Introduced AI-generated case summarization that analysts can use to generate concise case summaries.

  • Added playbooks support in Case Management, giving analysts a guided, stage-based workflow for investigations.

  • Added historical data ingestion and flexible expiration handling to TISC Add-on for Splunk Enterprise.

  • Enhanced MITRE Extraction rule schema to add a combined Techniques and Tactics regex extraction type.

  • Enhanced Relationship Graph with filtering support and performance improvements.

  • Enhanced CrowdStrike feed to support ingestion of malwares.

See Threat Intelligence Security Center for more information.

</td></tr></tbody> </table>Parent Topic:Products combined by family

Keep exploring.

Find another answer, or bring this documentation into your own tools.

Search the library →Read via the REST API ↗