---
title: Export intelligence data
description: Use the export feature to manually export the intelligence data in various formats.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/tisc-export-observables.html
release: australia
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 2
keywords: [export,intelligence data,tisc,observables,marking definition,tlp2.0]
breadcrumb: [Threat Intel Library, Use, Threat Intelligence Security Center, Security Operations]
---

# Export intelligence data

Use the export feature to manually export the intelligence data in various formats.

## Before you begin

Role required: sn\_sec\_tisc.analyst

## About this task

Currently, the export functionality is limited to observables, indicators, and case management. The following procedure describes how you can export the observables data, and follow the same procedure to export the indicators data.

## Procedure

1.  Navigate to **Workspaces** > **Threat Intelligence Security Center** > **Threat Intel Library** > **Observables** > **All Observables**.

2.  Select any observable record.

3.  Select **Export**.

    **Note:** The **Export** button is enabled only when observables are selected for export. If no observables are selected, the button remains disabled.

4.  Select the desired file type for export.

    -   Currently, the supported export formats are Excel, CSV, and STIX 2.1 JSON. Suppose, if your export type is Excel then the number of records that can be exported at a time is limited to 10,000, regardless of the selected format type.
    -   If the selection exceeds 10,000 records, then an error message displays indicating that the maximum limit for the selected format type has been surpassed, and only the first 10,000 records will be exported.
    -   If the export format is CSV and the record limit is exceeded, an alert message is displayed indicating that the export is **in progress** state, along with a link to view the export status. You can click the link to view the status, and refresh the record. Once it moves to **processed** state you can download the attachment.

        **Note:** When you export records in STIX 2.1 format Traffic Light Protocol \(TLP\) definitions applied to the intelligence object are included in the export as TLP 2.0 marking definition objects. For more information, see [Define Marking Definition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/define-market-definition.md).

5.  Select **Export**.

    **Note:** You can also view export data from the **Imports/Exports** module.

    A confirmation message indicating that the export is successful and your download is complete displays.


**Parent Topic:**[Threat Intel Library](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/threat-intelligence-security-center-library.md)

**Related topics**  


[TISC Data Model]()

[TISC Library Objects form view]()

[TISC Library Repository]()

[Access Vulnerability Downstream actions]()

[Deleting threat intelligence library records]()

[Confirm Potential Relationships from Related Records]()

[Automated correlation]()