Security Incident & Threat Intelligence Integrations
About 14% of the CIS-SIR exam — see all 7 domains.
Observables and Threat Intelligence
Observables (sn_ti_observable) are the data values associated with a security incident, such as IP addresses, domains, URLs, file hashes, and email addresses (indicators of compromise are a separate record type). Threat Intelligence (TI) manages observables, threat sources, and indicators of compromise (IoC) feeds. When observables are attached to a security incident, the system can automatically scan and enrich them.
Enrichment and the Enrich Observable capability
Observable enrichment gathers additional context about an observable from external sources (reputation, geolocation, sandbox detonation results, WHOIS, etc.). The Enrich Observable capability is the SecOps integration capability that runs enrichment workflows; results appear on the observable's enrichment results. Enrichment can run automatically on incident creation or be triggered manually. This is core integration content: know that enrichment is capability-driven and that results are written back to the observable record.
ServiceNow Store integrations vs. custom integrations
Integrations come in two broad flavors:
- Store integrations: pre-built integrations published on the ServiceNow Store (for example, VirusTotal, Shodan, Microsoft Defender, Palo Alto, Splunk, MISP, and many others). These map vendor functionality to SecOps integration capabilities.
- Custom integrations: built in-house using the integration framework, REST/IntegrationHub spokes, and Action Designer, then mapped to capabilities so playbooks can call them.
Integration capabilities (the abstraction)
The integration framework defines capabilities such as Enrich Observable, Block IP, Get Network Statistics, Sightings Search, Get Running Processes, and others. Each capability can have one or more configured implementations (vendor integrations), and an analyst running an action can select which implementations to use. Playbooks and flows invoke the capability, not the vendor directly. This is the single most important integration concept on the exam: capabilities decouple the response process from specific tooling.
Threat lookup and sightings
A threat lookup sends an observable to lookup sources (external reputation services) to determine whether it is malicious; threat sources, by contrast, pull threat data into the IoC tables. Sightings search queries SIEM/log sources to find where an observable has been seen across the environment, helping scope an incident. Both are capability-driven integrations.
MISP and threat sources
ServiceNow integrates with threat-intel platforms such as MISP for observable enrichment and IoC sharing. Threat sources feed indicators into TI, which can in turn create or enrich security incidents.
Sample questions from this domain
Three of the 42 in this domain, with the reasoning. The full set is in the question bank.
What is the primary purpose of integrating Threat Intelligence with Security Incident Response?
- A. To route security incidents to assignment groups based on the reputation of attached observables
- B. To pull vulnerability scan results into security incidents so remediation tasks can be raised
- C. To import SIEM events into Event Management so alerts are correlated before an incident exists
- D. To enrich security incidents with observables and indicator reputation data for faster investigation ✓
Why: Threat Intelligence enriches security incidents with observables and indicator reputation data, which speeds up investigation. Routing to assignment groups comes from assignment rules and groups, not from observable reputation. Vulnerability scan results and remediation belong to Vulnerability Response. Importing SIEM events and correlating alerts is the Event Management integration for Security Incident Response, a separate integration from Threat Intelligence.
In ServiceNow Threat Intelligence, what is an 'observable'?
- A. A piece of data such as an IP address, domain, URL, or file hash that can be observed and assessed for threat relevance ✓
- B. A STIX pattern that combines known-bad artifacts with context to state that an intrusion has likely taken place
- C. A record of a search for an indicator in SIEM or log data, with counts of the internal and external hits found
- D. An external service, such as a reputation provider, that is queried to decide whether a submitted value is malicious or clean
Why: An observable is a discrete piece of data (an IP address, domain, URL, file hash and so on) that can be observed and assessed for threat relevance. A pattern that combines artifacts with context to signal a likely intrusion describes an indicator of compromise, which Threat Intelligence keeps as a separate record type. A record of a SIEM or log search with internal and external hit counts is a Sightings Search result. An external service queried for a verdict is a lookup source.
Which open standard is commonly used to transport structured threat intelligence into ServiceNow Threat Intelligence?
- A. STIX/TAXII ✓
- B. Syslog/CEF
- C. MITRE ATT&CK
- D. CVSS/NVD
Why: STIX (the structured data format) and TAXII (the transport) are the open standards Threat Intelligence uses for structured threat data; it supports STIX 1.1, 2.0 and 2.1, and threat sources can pull TAXII collections natively. Syslog with CEF formatting carries log and event data to SIEM tools, not structured threat intelligence. MITRE ATT&CK is a knowledge base of adversary tactics and techniques that incidents can be mapped to, not a transport standard. CVSS and the NVD score and catalog vulnerabilities, which is Vulnerability Response territory.