--- title: TISC API description: The TISC API provides endpoints to add and retrieve threat intelligence data in the Threat Intelligence Security Center \(TISC\) application.Adds observable source records to the Threat Intelligence Security Center \(TISC\) application.Retrieves observables data, including relationships between observables and other threat intelligence data such as Structured Threat Information Expression \(STIX\) objects. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/api-reference/rest-apis/tisc-api.html release: australia product: REST APIs classification: rest-apis topic_type: concept last_updated: "2026-03-12" reading_time_minutes: 24 breadcrumb: [REST API reference, API reference, API implementation and reference] --- # TISC API The TISC API provides endpoints to add and retrieve threat intelligence data in the Threat Intelligence Security Center \(TISC\) application. Data retrieved by this API can be used by other security tools such as Security Information Event Management \(SIEM\) systems. SIEM systems can integrate with TISC using this API to retrieve observables related to threats in TISC and automatically detect and monitor these threats within an organization’s network. This API enables bidirectional sharing of observables from security tools. SIEM systems observe anomalous activity in the environment and can provide a list of observables associated with the anomalous activity to TISC. This API can also be used to enrich SIEM alerts with threat intelligence context. For example, if a SIEM alert is generated based on unusually high traffic from an IP address, TISC can provide additional information such as whether the IP address or domain involved is linked to known malicious activities. This enrichment data enables security analysts to triage the alerts and use the contextual information for efficient remediation. This API requires the Threat Intelligence Security Center application, which is available on the ServiceNow Store. For additional information about TISC, see [Threat Intelligence Security Center](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/tisc-landing-page.md). This API runs in the `sn_sec_tisc` namespace. The current version of this API is `v1`. For information about API authentication, see the REST API security section in [REST APIs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md). **Parent Topic:**[REST API reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-apis/api-rest.md) ## TISC API - POST /sn\_sec\_tisc/threat\_intel\_data/add\_observables Adds observable source records to the Threat Intelligence Security Center \(TISC\) application. The [observable source records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/tisc-observables-source-records.md) are created in the Observable Source \[sn\_sec\_tisc\_observable\_source\] table and are processed through de-duplication and aggregation in the [TISC data flow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/tisc-data-processing-functional-flow.md). **Note:** Observable source records can't be directly updated using this endpoint. Only new records can be created. Therefore, even if only a few fields require an update, all fields must still be included in the request. To access this endpoint, the caller must have the sn\_sec\_tisc.api\_obs\_write\_access role, which by default is included in the Threat Intelligence administrator role \(sn\_sec\_tisc.admin\). ### URL format Versioned URL: `/api/sn_sec_tisc/{api_version}/threat_intel_data/add_observables` Default URL: `/api/sn_sec_tisc/threat_intel_data/add_observables` **Note:** Available versions are specified in the [REST API Explorer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/use-REST-API-Explorer.md). For scripted REST APIs there is additional version information on the [Scripted REST Service form](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_CustomWebServices.md). ### Supported request parameters
Name Description
api\_version Optional. Version of the endpoint to access. For example, `v1` or `v2`. Only specify this value to use an endpoint version other than the latest. Data type: String
|Name|Description| |----|-----------| |None| |
Name Description
observables Required. List of observable objects to add to TISC. For each observable object, an observable source record is created if all validations are passed, with the source as defined by the **source** parameter in the request body.Data type: Array of Objects ``` "observables": [ { "attributes": {Object}, "": "String" } ] ```
observables.attributes Field-value pairs containing attribute data about the observable. Attributes are specific to an observable type, such as the AS number for an IP address or the socket type for a network. All attributes for all observable types are supported. For a complete list of valid attributes, see the Observable attributes section below. Data type: Object ``` "attributes": { "": "" } ```
observables.<field> Name-value pairs containing general data about the observable. The fields that can be provided in this parameter are common to all observable types.The **type** and **value** fields are required for all observables. **Note:** Follow these guidelines for providing values: - All dates must be in ISO format in the UTC timezone. - Some fields require values from a specified table or have a list of possible values. If invalid values are provided for these fields, the observable source record is still created but the invalid values are skipped. Valid fields: - **additional\_context** Additional context about the observable. - **attack\_phases** List of attack phase names as a comma separated value. For a complete list of valid attack phases, see the **Kill Chain Phase Name** field in the Kill Chain Phase \[sn\_sec\_tisc\_kill\_chain\_phase\] table. For example: ``` "attack_phases": "Lockheed Martin: Reconnaissance,Lockheed Martin: Installation" ``` - **author** Author for the observable. - **confidence** The confidence that the source system has in the correctness of the observable data. Must be a number from 0–100. - **description** Description of the observable. - **expiration\_time** Expiration date of the observable record. - **external\_source\_id** External ID of the observable from the source system. - **first\_observed** Date the data was first seen. - **first\_seen** Date this observable was first seen performing malicious activities. - **last\_observed** Date the data was last seen. - **last\_seen** Date this observable was last seen performing malicious activities. - **notes** Any additional notes for the observable. Can be formatted as HTML. - **reputation** Reputation of the observable. Possible values: - clear - malicious - suspicious - unknown - **source\_reported\_score** Maliciousness score of the observable reported by the source system. Must be a number from 0–100. - **tags** List of tags as a comma-separated value. For a complete list of valid tags, see the **Name** field in the Tag \[sn\_sec\_tisc\_tag\] table. If the provided tag doesn’t exist, the tag is automatically created and associated with the observable. - **taxonomies** List of taxonomies as a comma-separated value. For a complete list of valid taxonomies, see the **Taxonomy Value** field in the Taxonomy Value \[sn\_sec\_tisc\_taxonomy\_value\] table. - **threat\_level** Threat level of the observable. Possible values: - low - medium - high - **threat\_severity** Threat severity of the observable. Possible values: - low - medium - high - critical - **tlp** Data sensitivity level for the observable using the traffic light protocol \(TLP\). Possible values: - CLEAR - GREEN - AMBER - AMBER+STRICT - RED Table: In the Label field in the TLP Label \[sn\_sec\_tisc\_tlp\_label\] table. - **type** Required. Type of observable. For a complete list of valid observable types, see the **Value** field in the Observable Type \[sn\_sec\_tisc\_observable\_type\] table, or the Observable attributes section below. - **usage\_categories** List of usage categories as a comma-separated value. For a complete list of valid usage categories, see the **Usage Category** field in the Usage Category \[sn\_sec\_tisc\_usage\_category\] table. - **value** Required. Value associated with the observable, such as an IP address or URL. Data type: String Table: Observable Source \[sn\_sec\_tisc\_observable\_source\]
source Required. Source that originally detected the observables, such as a SIEM system.The source is used for all observables listed in the API request. Data type: String Stored in: Sources provided in the request body are added to the API Integration \[sn\_sec\_tisc\_api\_integration\] table.
### Headers The following request and response headers apply to this HTTP action only, or apply to this action in a distinct way. For a list of general headers used in the REST API, see [Supported REST API headers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md). |Header|Description| |------|-----------| |Accept|Data format of the response body. Only supports **application/json**.| |Content-Type|Data format of the request body. Only supports **application/json**.| |Header|Description| |------|-----------| |None| | ### Status codes The following status codes apply to this HTTP action. For a list of possible status codes used in the REST API, see [REST API HTTP response codes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md).
Status code Description
200 Successful. The request was successfully processed.
400 Bad request. The request parameters are invalid or the request body JSON has a syntactical error.To view details about the error, see the **error** parameter in the response body.
401 Unauthorized. The user authentication is invalid. Check the user name and password or OAuth token.
403 Forbidden. The calling user is missing a required role. The sn\_sec\_tisc.api\_obs\_write\_access role is required to access this endpoint.
429 Too many requests. The number of API requests exceeds the rate limit for the API. By default, the limit is 100 requests per hour.
500 Internal server error. Check application logs in the Log \[syslog\] table for more information about the error.
### Response body parameters \(JSON\)
Name Description
error Error information. This parameter is only returned if the request failed.Data type: Object ``` "error": { "message": "String", "detail": "String" } ```
error.message Error message containing the reason the request failed.Data type: String
error.detail Additional details about why the request failed.Data type: String
error\_records Details about the observables included in the request that couldn't be added to TISC.Data type: Array of Objects ``` "error_records": [ { "error_message": "String", "type": "String", "value": "String" } ] ```
error\_records.error\_message Error message that explains why a record couldn't be created for the observable.Data type: String
error\_records.type Type of observable.For a complete list of valid observable types, see the **Value** field in the Observable Type \[sn\_sec\_tisc\_observable\_type\] table, or the Observable attributes section below. Data type: String
error\_records.value Value associated with the observable, such as an IP address or URL.Data type: String
metadata Metadata about the number of records created by the API request. ``` "metadata": { "error_records": Number, "success_records": Number, "total_records": Number } ``` Data type: Object
metadata.error\_records Number of observables included in the request that couldn't be added to TISC.Data type: Number
metadata.success\_records Number of observable records that were successfully created in TISC.Data type: Number
metadata.total\_records Total number of observables included in the request.Data type: Number
status Status of the API request.Possible values: - `error`: No observables successfully added to TISC. - `failure`: The request failed due to a bad request or system error. See the **error** parameter in the response body for more information about the error. - `partial_success`: Some observables successfully added to TISC. - `success`: All observables successfully added to TISC. Data type: String
success\_records Details about the observable records that were successfully created.Data type: Array of Objects ``` "success_records": [ { "sys_id": "String", "type": "String", "value": "String" } ] ```
success\_records.sys\_id Sys\_id of the observable record.Data type: String
success\_records.type Type of observable. For a complete list of valid observable types, see the **Value** field in the Observable Type \[sn\_sec\_tisc\_observable\_type\] table, or the Observable attributes section below. Data type: String
success\_records.value Value associated with the observable, such as an IP address or URL.Data type: String
### Observable attributes The following table lists valid attributes for each observable type. **Note:** All dates must be in ISO format in the UTC timezone.
Observable type Attributes Data type
artifact decryption\_key String
encryption\_algorithm String
md5\_hash String
mime\_type String
sha1\_hash String
sha256\_hash String
sha512\_hash String
url String
autonomous\_system\_number name String
rir String
directory directory\_creation\_time Date
directory\_last\_accessed\_time Date
directory\_last\_modified\_time Date
encoded\_path String
domain\_name is\_fqdn\(Fully qualified domain name\) Boolean
resolves\_to String
email\_address display\_name String
email\_message email\_body String
email\_recipients\_bcc String
email\_recipients\_cc String
email\_recipients\_to String
email\_sender String
email\_subject String
sent\_date Date
email\_subject None  
file encoded\_file\_name String
file\_created\_time Date
file\_last\_accessed\_time Date
file\_last\_modified\_time Date
file\_name String
magic\_number String
md5\_hash String
mime\_type String
sha1\_hash String
sha256\_hash String
sha512\_hash String
ip\_v4\_address as\_number String
mac\_address String
ip\_v4\_cidr as\_number String
mac\_address String
ip\_v6\_address as\_number String
mac\_address String
ip\_v6\_cidr as\_number String
mac\_address String
mac\_address None  
md5\_hash None  
mutex\_name None  
network destination\_bytes\_count Integer
destination\_packets\_count Integer
destination\_port  
end\_time Date
http\_message\_body\_length Integer
http\_request\_header String
http\_request\_method String
http\_request\_value String
http\_request\_version String
network\_source String
network\_destination String
icmp\_code\_byte String
icmp\_type\_byte String
is\_network\_active Boolean
is\_socket\_blocking Boolean
is\_socket\_listening Boolean
network\_protocols String
socket\_address\_family StringPossible values: - af\_unspec - af\_inet - af\_ipx - af\_appletalk - af\_netbios - af\_inet6 - af\_irda - af\_bth
socket\_descriptor Integer
socket\_handle Integer
socket\_options String
socket\_type StringPossible values: - service\_kernel\_driver - service\_file\_system\_driver - service\_win32\_own\_process - service\_win32\_share\_process
source\_bytes\_count Integer
source\_packets\_count Integer
source\_port String
start\_time Date
tcp\_destination\_flags String
tcp\_source\_flags String
other None  
process aslr\_enabled Boolean
command\_line String
cwd\(Current Working Directory\) String
dep\_enabled Boolean
environment\_variables String
is\_hidden Boolean
owner\_sid String
pid\(Process ID\) String
priority String
process\_created\_time Date
service\_descriptions String
service\_display\_name String
service\_group\_name String
service\_name String
service\_start\_type StringPossible values: - service\_auto\_start - service\_boot\_start - service\_demand\_start - service\_disabled - service\_system\_alert
service\_status StringPossible values: - service\_continue\_pending - service\_pause\_pending - service\_paused - service\_running - service\_start\_pending - service\_stop\_pending - service\_stopped
service\_type StringPossible values: - service\_kernel\_driver - service\_file\_system\_driver - service\_win32\_own\_process - service\_win32\_share\_process
startup\_info String
windows\_integrity\_level StringPossible values: - low - medium - high - system
window\_title String
sha1\_hash None  
sha256\_hash None  
sha512\_hash None  
software cpe\(Common Platform Enumeration\) String
supported\_languages String
swid\(Software Identification\) String
vendor String
version String
url None  
user\_account account\_created\_time Date
account\_expiry\_time Date
account\_type String
can\_escalate\_privileges Boolean
credentials\_last\_changed\_time Date
display\_name String
first\_login\_time Date
is\_account\_disabled Boolean
is\_privileged Boolean
is\_service\_account Boolean
last\_login\_time Date
account\_login String
user\_id String
windows\_registry\_key key\_modified\_time Date
registry\_value String
subkeys\_count Integer
x509\_certificate authority\_key\_identifier String
basic\_constraints String
certificate\_policies String
crl\_distribution\_points String
extended\_key\_usage String
inhibit\_any\_policy String
issuer String
issuer\_alternative\_name String
is\_self\_signed Boolean
key\_usage String
name\_constraints String
policy\_constraints String
policy\_mappings String
private\_key\_usage\_valid\_from Date
private\_key\_usage\_valid\_until Date
signature\_algorithm String
subject String
subject\_alternative\_name String
subject\_directory\_attributes String
subject\_key\_identifier String
subject\_public\_key\_algorithm String
subject\_public\_key\_exponent Integer
subject\_public\_key\_modulus String
valid\_from Date
valid\_until Date
version String
### cURL request This example request contains three observables to create records for in TISC. ``` curl 'http://instance.servicenow.com/api/sn_sec_tisc/v1/threat_intel_data/add_observables' \ --request POST \ --header 'Content-Type: application/json' \ --header 'Authorization: Basic YWRtaW46YWRtaW4=' \ --data '{ "source": "Sentinel", "observables": [ { "value": "1.2.1.45", "type": "ip_v4_address", "reputation": "malicious", "confidence": "90", "tags": "critical,important", "taxonomies": "MITRE: T121", "attack_phases": "Lockheed Martin: Reconnaissance", "usage_categories": "Infected Bot", "first_seen": "2023-10-14T18:01:34.000Z", "attributes": { "as_number": "14280" } }, { "value": "https://example.com", "type": "url", "tags": "important", "confidence": "50", "reputation": "malicious" }, { "value": "1.1.1.1", "type": "ip_add", "confidence": "50", "reputation": "malicious" } ] }' ``` Two of the three observables were successfully added to TISC. One record wasn't created because the observable type is invalid. ``` { "status": "partial_success", "metadata": { "total_records": 3, "success_records": 2, "error_records": 1 }, "success_records": [ { "value": "1.2.1.45", "type": "ip_v4_address", "sys_id": "e519392643e642102164e0ea78b8f29d" }, { "value": "https://example.com", "type": "url", "sys_id": "ad1979ae43ea42102164e0ea78b8f241" } ], "error_records": [ { "value": "1.1.1.1", "type": "ip_va", "error_message": "The 'type' field value is invalid" } ] } ``` ## TISC API - POST /sn\_sec\_tisc/threat\_intel\_data/observables Retrieves observables data, including relationships between observables and other threat intelligence data such as Structured Threat Information Expression \(STIX\) objects. Observables returned in the response are sorted by **sys\_id** in ascending order. For more information about observables and STIX objects, see [IoC Repository](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/ioc-repository.md). To access this endpoint, the caller must have the sn\_sec\_tisc.api\_obs\_read\_access role, which by default is included in the Threat Intelligence administrator role \(sn\_sec\_tisc.admin\). ### URL format Versioned URL: `/api/sn_sec_tisc/{api_version}/threat_intel_data/observables` Default URL: `/api/sn_sec_tisc/threat_intel_data/observables` **Note:** Available versions are specified in the [REST API Explorer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/use-REST-API-Explorer.md). For scripted REST APIs there is additional version information on the [Scripted REST Service form](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_CustomWebServices.md). ### Supported request parameters
Name Description
api\_version Optional. Version of the endpoint to access. For example, `v1` or `v2`. Only specify this value to use an endpoint version other than the latest. Data type: String
|Name|Description| |----|-----------| |None| |
Name Description
included\_fields Fields to return for observables, observable references, and STIX objects in the response. Different fields can be returned for observables, references, and each type of STIX object.ServiceNow system fields, except for sys\_created\_on, sys\_updated\_on, and sys\_id, aren't returned in the response. Data type: Object ``` "included_fields": { "observable": {Object}, "reference": {Object}, "": {Object} } ```
included\_fields.observable Fields to return for observables. Data type: Object ``` "observable": { "attributes": {Object}, "common_fields": {Object} } ``` Default: Returns the fields syd\_id, type, and value for all observable types.
included\_fields.observable.attributes Fields to return for specified observable types. Data type: Object ``` "attributes": { "": {Object} } ``` Default: No fields specific to an observable type are returned. Only the fields syd\_id, type, and value are returned.
included\_fields.observable.attributes.<observable\_type> Fields to return for an observable type.Data type: Object ``` "": { "include_all_fields": Boolean, "values": [Array] } ``` Replace `` with the name of the observable type, such as `artifact`. For a complete list of valid observable types, see the Value field in the Observable Type \[sn\_sec\_tisc\_observable\_type\] table.
included\_fields.observable.attributes.<observable\_type>.include\_all\_fields Flag that indicates whether to return all available fields for the observable type.Valid values: - true: Return all fields for the observable type. - false: Only return fields specified in the **values** parameter for the observable type. Data type: Boolean
included\_fields.observable.attributes.<observable\_type>.values List of fields to return for the observable type. Only use this parameter if the value of **include\_all\_fields** is false.Data type: Array of Strings ``` "values": [ "String" ] ``` The fields provided must be column\_names from the table for the observable type. The following tables are used for observable types. - Artifact \[sn\_sec\_tisc\_artifact\] - AS Number \[sn\_sec\_tisc\_as\_number\] - Directory \[sn\_sec\_tisc\_directory\] - Domain Name \[sn\_sec\_tisc\_domain\_name\] - Email Address \[sn\_sec\_tisc\_email\_address\] - Email Message \[sn\_sec\_tisc\_email\_message\] - Email Subject \[sn\_sec\_tisc\_email\_subject\] - File \[sn\_sec\_tisc\_file\] - IPv4 Address \[sn\_sec\_tisc\_ipv4\_address\] - IPv4 CIDR \[sn\_sec\_tisc\_ipv4\_cidr\] - IPv6 Address \[sn\_sec\_tisc\_ipv6\_address\] - IPv6 CIDR \[sn\_sec\_tisc\_ipv6\_cidr\] - MAC Address \[sn\_sec\_tisc\_mac\_address\] - MD5 Hash \[sn\_sec\_tisc\_md5\_hash\] - Mutex Name \[sn\_sec\_tisc\_mutex\_name\] - Network \[sn\_sec\_tisc\_network\] - Other Observable \[sn\_sec\_tisc\_other\_observable\] - Process \[sn\_sec\_tisc\_process\] - SHA1 Hash \[sn\_sec\_tisc\_sha1\_hash\] - SHA256 Hash \[sn\_sec\_tisc\_sha256\_hash\] - SHA512 Hash \[sn\_sec\_tisc\_sha512\_hash\] - Software \[sn\_sec\_tisc\_software\] - URL \[sn\_sec\_tisc\_url\] - User Account \[sn\_sec\_tisc\_user\_account\] - Windows Registry Key \[sn\_sec\_tisc\_windows\_registry\_key\] - X.509 Certificate \[sn\_sec\_tisc\_x\_509\_certificate\]
included\_fields.observable.common\_fields Fields to return for all observable types.The fields must be from the Observable \[sn\_sec\_tisc\_observable\] table because they must be common to all observable types. Data type: Object ``` "common_fields": { "include_all_fields": Boolean, "values": [Array] } ``` Default: Returns the fields syd\_id, type, and value for all observable types.
included\_fields.observable.common\_fields.include\_all\_fields Flag that indicates whether to return all fields from the Observable \[sn\_sec\_tisc\_observable\] table for all observable types.Valid values: - true: Return all fields from the Observable \[sn\_sec\_tisc\_observable\] table. - false: Only return fields specified in the **common\_fields.values** parameter. Data type: Boolean
included\_fields.observable.common\_fields.values List of fields to return for all observable types. Only use this parameter if the value of **common\_fields.include\_all\_fields** is false.Data type: Array of Strings ``` "values": [ "String" ] ``` The fields provided must be column names from the Observable \[sn\_sec\_tisc\_observable\] table.
included\_fields.reference Fields to return for observable references. Observable references are external references used to describe pointers to information represented outside of STIX.Data type: Object ``` "reference": { "include_all_fields": Boolean, "values": [Array] } ``` Default: Returns the fields reference\_source, sys\_id, and url.
included\_fields.reference.include\_all\_fields Flag that indicates whether to return all available fields for observable references.Valid values: - true: Return all fields for observable references. - false: Only return fields specified in the **reference.values** parameter. Data type: Boolean
included\_fields.reference.values List of fields to return for observable references. Only use this parameter if the value of **reference.include\_all\_fields** is false.Data type: Array of Strings ``` "values": [ "String" ] ``` The fields provided must be column names from the Observable Reference \[sn\_sec\_tisc\_observable\_reference\] table.
included\_fields.<stix\_object> Object containing fields to return for a STIX object type.Data type: Object ``` "": { "include_all_fields": Boolean, "values": [Array] } ``` Replace `` with the name of the STIX object type, such as `attack_pattern`. Valid STIX object types: - attack\_pattern - campaign - course\_of\_action - data\_component - data\_source - grouping - identity - incident - indicator - infrastructure - intrusion\_set - location - malware - malware\_analysis - note - observed\_data - opinion - report - threat\_actor - tool - vulnerability Default: Returns the fields id, name, and sys\_id.
included\_fields.<stix\_object>.include\_all\_fields Flag that indicates whether to return all available fields for the STIX object type.Valid values: - true: Return all fields for the STIX object type. - false: Only return fields specified in the **values** parameter for the STIX object type. Data type: Boolean
included\_fields.<stix\_object>.values List of fields to return for the STIX object type. Only use this parameter if the value of **include\_all\_fields** is false.Data type: Array of Strings ``` "values": [ "String" ] ``` The fields provided must be column\_names from the table for the STIX object type. The following tables are used for STIX objects. - Attack Pattern \[sn\_sec\_tisc\_attack\_pattern\] - Campaign \[sn\_sec\_tisc\_campaign\] - Course of Action \[sn\_sec\_tisc\_course\_of\_action\] - Data Component \[sn\_sec\_tisc\_aggregated\_data\_component\] - Data Source \[sn\_sec\_tisc\_aggregated\_data\_source\] - Grouping \[sn\_sec\_tisc\_threat\_grouping\] - Identity \[sn\_sec\_tisc\_identity\] - Incident \[sn\_sec\_tisc\_threat\_event\] - Indicator \[sn\_sec\_tisc\_indicator\] - Infrastructure \[sn\_sec\_tisc\_infrastructure\] - Intrusion Set \[sn\_sec\_tisc\_intrusion\_set\] - Location \[sn\_sec\_tisc\_location\] - Malware \[sn\_sec\_tisc\_malware\] - Malware Analysis \[sn\_sec\_tisc\_malware\_analysis\] - Note \[sn\_sec\_tisc\_threat\_note\] - Observed Data \[sn\_sec\_tisc\_observed\_data\] - Opinion \[sn\_sec\_tisc\_threat\_opinion\] - Report \[sn\_sec\_tisc\_threat\_report\] - Threat Actor \[sn\_sec\_tisc\_threat\_actor\] - Tool \[sn\_sec\_tisc\_tool\] - Vulnerability \[sn\_sec\_tisc\_vulnerability\]
observable\_filters Filters to apply to the observables. Only observables that match the filter criteria are returned in the response.Data type: Object ``` "observable_filters": { "boolean_operator": "String", "filters": [Array] } ``` Default: Empty object \(no filters applied\)
observable\_filters.boolean\_operator Boolean operator to use for the filter conditions.Valid values: - AND: Return observables that meet all filter conditions. - OR: Return observables that meet at least one of the filter conditions. Data type: String
observable\_filters.filters Filters to apply to the observables. Each filter object can be simple or complex. - Simple filters contain a field name, operator, and value. - Complex filters contain a Boolean operator and an array of simple filters. The Boolean operator is applied to the array of simple filters. Data type: Array of Objects ``` "filters": [ //Simple filter { "field_name": "String", "operator": "String", "field_value": "String" }, //Complex filter { "boolean_operator": "String", "filters": [ { "field_name": "String", "operator": "String", "field_value": "String" } ] } ] ```
observable\_filters.filters.field\_name Name of the field to use to filter the observables. Valid values: - confidence - reputation - security\_type - status - sys\_created\_on - sys\_updated\_on - tags - taxonomies - threat\_score - type - value - watch\_list Data type: String
observable\_filters.filters.operator Operator to use for the filter.For more information about operators, see [Operators available for filters and queries](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-user-interface/r_OpAvailableFiltersQueries.md). The data type of the filter field determines the valid operators. The following operators are valid for each data type. - **Boolean** Applicable field: watch\_list - != - = - ISEMPTY - ISNOTEMPTY - **Choice** Applicable fields: reputation, security\_type, status - != - = - ENDSWITH - IN - LIKE - NOT IN - NOT LIKE - STARTSWITH - **Date-time** Applicable fields: sys\_created\_on, sys\_updated\_on - < - <= - > - >= - ISEMPTY - ISNOTEMPTY - NOTON - ON - **GlideList** Applicable fields: tags, taxonomies - IN - NOT IN **Note:** Must use a single valid, existing value for the filter condition, and empty observable field values aren't considered a match. - ISEMPTY - ISNOTEMPTY - LIKE **Note:** Must use a single value for the filter condition. - NOT LIKE **Note:** Must use a single value for the filter condition, and empty observable field values aren't considered a match. - **Number** Applicable fields: confidence, threat\_score - != - <= - = - >= - ISEMPTY - ISNOTEMPTY - **Reference** Applicable field: type - != - = - IN - ISEMPTY - ISNOTEMPTY - **String** Applicable field: value - != - <= - = - >= - ENDSWITH - IN - ISEMPTY - ISNOTEMPTY - LIKE - NOT LIKE - STARTSWITH Data type: String
observable\_filters.filters.field\_value Value of the field.For choice fields, the value must be the internal value, not the display value. For date-time fields, the value must be in ISO format in the UTC timezone. **Note:** This parameter isn’t required when using the ISEMPTY or ISNOTEMPTY operators. Data type: String
page\_size Limits the number of observables that are returned in the API response. Used for pagination.Data type: String Default: 100 Maximum value: 1000
page\_token Used to get observables data for the current page.To get the first page, this parameter can be omitted or the value for this parameter must be an empty string. To get the next page in the following request, use the **next\_page\_token** value from the response body as the value for this parameter. Data type: String Default: Empty string
relationships Relationship types to return for each observable in the response. The relationships can be with another observable, an observable reference, or a Structured Threat Information Expression \(STIX\) object. Valid values: - attack\_pattern - campaign - course\_of\_action - data\_component - data\_source - grouping - identity - incident - indicator - infrastructure - intrusion\_set - location - malware - malware\_analysis - note - observable - observed\_data - opinion - reference - report - threat\_actor - tool - vulnerability For example, passing the array `["observable", "threat_actor"]` returns all related observables and threat actors for each observable in the response. Data type: Array Default: Empty array \(no relationships returned\)
### Headers The following request and response headers apply to this HTTP action only, or apply to this action in a distinct way. For a list of general headers used in the REST API, see [Supported REST API headers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md). |Header|Description| |------|-----------| |Accept|Data format of the response body. Only supports **application/json**.| |Content-Type|Data format of the request body. Only supports **application/json**.| |Header|Description| |------|-----------| |None| | ### Status codes The following status codes apply to this HTTP action. For a list of possible status codes used in the REST API, see [REST API HTTP response codes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md).
Status code Description
200 Successful. The request was successfully processed.
400 Bad request. The request parameters are invalid or the request body JSON has a syntactical error.To view details about the error, see the **error** parameter in the response body.
401 Unauthorized. The user authentication is invalid. Check the user name and password or OAuth token.
403 Forbidden. The calling user is missing a required role. The sn\_sec\_tisc.api\_obs\_read\_access role is required to access this endpoint.
429 Too many requests. The number of API requests exceeds the rate limit for the API. By default, the limit is 500 requests per hour.
500 Internal server error. Check application logs in the Log \[syslog\] table for more information about the error.
### Response body parameters \(JSON\)
Name Description
error Error information. This parameter is only returned if the request failed.Data type: Object ``` "error": { "message": "String", "detail": "String" } ```
error.message Error message containing the reason the request failed.Data type: String
error.detail Additional details about why the request failed.Data type: String
is\_last\_page Flag that indicates whether this is the last page of observables data.Valid values: - true: This response contains the last page of data. - false: There are additional pages that can be returned. Data type: Boolean
next\_page\_token Use this value in the next API request to get the next page of observables data. Provide this value in the **page\_token** parameter in the request body.Data type: String
observables Observables objects. Data type: Array of Objects ``` "observables": [ { "attributes": {Object}, "relationships": {Object}, "sys_id": "String", "type": "String", "value": "String" } ] ``` Each observables object also includes the fields specified by the **included\_fields.observable.common\_fields** parameter in the request body.
observables.attributes Name-value pairs for the fields specified by the **included\_fields.observable.attributes.<observable\_type>** parameter in the request body.Data type: Object ``` "attributes": { "": "" } ```
observables.relationships Relationships for the observable. The types of relationships returned are specified by the **relationships** parameter in the request body, and the fields returned for each relationship are specified by the **included\_fields** parameter in the request body.This example shows the basic structure of this parameter. However, the relationship types and fields returned vary based on the request body parameters. Data type: Object ``` "relationships": { "observable": [ { "sys_id": "String", "type": "String", "value": "String" } ], "indicator": [ { "id": "String", "name": "String", "sys_id": "String" } ], "attack_pattern": [ { "id": "String", "name": "String", "sys_id": "String" } ] } ```
observables.sys\_id Sys\_id of the observable.Data type: String Table: Observable \[sn\_sec\_tisc\_observable\]
observables.type Type of observable. For a complete list of valid observable types, see the **Value** field in the Observable Type \[sn\_sec\_tisc\_observable\_type\] table.Data type: String
observables.value Value associated with the observable, such as an IP address or URL.Data type: String
origin Origin application of the response, which is Threat Intelligence Security Center \(TISC\). The value of this parameter is `sn_sec_tisc`.This value can optionally be used by SIEMs consuming the API response to trace whether the intelligence from TISC resulted in the creation of security incidents. Data type: String
page\_size Maximum number of observables returned in the response. Used for pagination.Data type: String
status Status of the API request.Possible values: - failure - success If the request failed, see the **error** parameter in the response body for more information about the error. Data type: String
### cURL request This example returns the first page of observables data. The **observable\_filters** parameter specifies to return only observables that match the condition `status = active AND [threat_score >= 70 OR confidence >= 50]`. ``` curl 'http://instance.servicenow.com/api/sn_sec_tisc/v1/threat_intel_data/observables' \ --request POST \ --header 'Content-Type: application/json' \ --header 'Authorization: Basic YWRtaW46YWRtaW4=' \ --data '{ "page_size": "100", "page_token": "", "relationships": [ "observable", "threat_actor", "indicator", "reference", "attack_pattern" ], "included_fields": { "observable": { "common_fields": { "include_all_fields": false, "values": [ "value", "reputation", "confidence" ] }, "attributes": { "ip_v4_address": { "include_all_fields": false, "values": [ "as_number" ] }, "artifact": { "include_all_fields": false, "values": [ "mime_type", "encryption_algorithm" ] } } }, "threat_actor": { "include_all_fields": false, "values": [ "name", "aliases", "description", "threat_actor_roles" ] }, "attack_pattern": { "include_all_fields": true }, "indicator": { "include_all_fields": false, "values": [ "name", "pattern", "pattern_type", "indicator_types" ] }, "reference": { "include_all_fields": true, "values": [ "description" ] } }, "observable_filters": { "boolean_operator": "AND", "filters": [ { "field_name": "status", "operator": "=", "field_value": "active" }, { "boolean_operator": "OR", "filters": [ { "field_name": "threat_score", "operator": ">=", "field_value": "70" }, { "field_name": "confidence", "operator": ">=", "field_value": "50" } ] } ] } }' ``` Response body. ``` { "status": "success", "observables": [ { "sys_id": "792e3d1543a0421060eee0ea78b8f227", "type": "url", "value": "https://www.example.com", "confidence": "60", "reputation": "", "relationships": { "observable": [ { "sys_id": "ccadb19143a0421060eee0ea78b8f25a", "type": "ip_v4_address", "value": "1.1.1.1", "confidence": "20", "reputation": "malicious" } ], "indicator": [ { "id": "indicator--294d97754364c21060eee0ea78b8f2ae", "indicator_types": "", "name": "Poison Ivy", "pattern": "", "pattern_type": "sigma", "sys_id": "a54d97754364c21060eee0ea78b8f2ae", "type": "indicator" } ], "attack_pattern": [ { "name": "Phishing", "sys_id": "010d5bf14364c21060eee0ea78b8f2ac", "id": "attack-pattern--810d5bf14364c21060eee0ea78b8f2ac", "type": "attack-pattern" } ], "reference": [ { "description": "phishing", "reference_source": "CAPEC-98", "sys_created_on": "2024-02-25T03:34:45.000Z", "sys_id": "a42d97354364c21060eee0ea78b8f28c", "sys_updated_on": "2024-02-25T03:34:45.000Z", "url": " https://capec.mitre.org/data/98.html " } ] }, "attributes": { "encryption_algorithm": "mime-type-indicated", "mime_type": "application/zip" } }, { "sys_id": "ccadb19143a0421060eee0ea78b8f2242", "type": "ip_v4_address", "value": "1.2.2.1", "confidence": "70", "reputation": "", "relationships": {} }, { "sys_id": "7ccd359143a0421060eee0ea78b8f264", "type": "artifact", "value": "pom.xml", "confidence": "", "reputation": "", "relationships": {} } ], "page_size": "100", "next_page_token": "drejvfgbresg|7ccd359143a0421060eee0ea78b8f264", "is_last_page": true, "origin": "sn_sec_tisc" } ```