Security Incident & Threat Intelligence Integrations
About 14% of the CIS-SIR exam — see all 7 domains.
Observables and Threat Intelligence
Observables (sn_ti_observable) are the indicators of compromise associated with a security incident — IP addresses, domains, URLs, file hashes, email addresses. Threat Intelligence (TI) manages observables, threat sources, and indicators of compromise (IoC) feeds. When observables are attached to a security incident, the system can automatically scan and enrich them.
Enrichment and the Enrich Observable capability
Observable enrichment gathers additional context about an observable from external sources (reputation, geolocation, sandbox detonation results, WHOIS, etc.). The Enrich Observable capability is the SecOps integration capability that runs enrichment workflows; results appear on the observable's enrichment results. Enrichment can run automatically on incident creation or be triggered manually. This is core integration content — know that enrichment is capability-driven and that results are written back to the observable record.
ServiceNow Store integrations vs. custom integrations
Integrations come in two broad flavors:
- Store integrations — pre-built integrations published on the ServiceNow Store (for example, VirusTotal, Shodan, Microsoft Defender, Palo Alto, Splunk, MISP, and many others). These map vendor functionality to SecOps integration capabilities.
- Custom integrations — built in-house using the integration framework, REST/IntegrationHub spokes, and Action Designer, then mapped to capabilities so playbooks can call them.
Integration capabilities (the abstraction)
The integration framework defines capabilities such as Enrich Observable, Block IP, Get Network Statistics, Sightings Search, Get Running Processes, and others. Each capability can have one configured implementation. Playbooks and flows invoke the capability, not the vendor directly. This is the single most important integration concept on the exam — capabilities decouple the response process from specific tooling.
Threat lookup and sightings
A threat lookup queries threat sources for what is known about an observable. Sightings search queries SIEM/log sources to find where an observable has been seen across the environment, helping scope an incident. Both are capability-driven integrations.
MISP and threat sources
ServiceNow integrates with threat-intel platforms such as MISP for observable enrichment and IoC sharing. Threat sources feed indicators into TI, which can in turn create or enrich security incidents.
Sample questions from this domain
Three of the 42 in this domain, with the reasoning. The full set is in the question bank.
What is the primary purpose of integrating Threat Intelligence with Security Incident Response?
- A. To generate financial reports
- B. To replace the CMDB
- C. To manage employee onboarding
- D. To enrich security incidents with observables and indicator reputation data for faster investigation ✓
Why: Threat Intelligence enriches security incidents with observables and indicator reputation, accelerating investigation. It does not replace the CMDB, handle onboarding, or generate financial reports.
In ServiceNow Threat Intelligence, what is an 'observable'?
- A. A piece of data such as an IP address, domain, URL, or file hash that can be observed and assessed for threat relevance ✓
- B. A user role
- C. A CMDB relationship type
- D. A scheduled job that runs nightly
Why: An observable is a discrete piece of data (IP, domain, URL, file hash, etc.) that can be assessed for threat relevance. It is not a scheduled job, a role, or a CMDB relationship type.
Which open standard is commonly used to transport structured threat intelligence into ServiceNow Threat Intelligence?
- A. STIX/TAXII ✓
- B. SOAP-only WSDL feeds
- C. LDAP
- D. SNMP traps
Why: STIX/TAXII is the open standard for structured threat intelligence exchange that ServiceNow supports. LDAP is for directory services, SNMP for device monitoring, and SOAP/WSDL is a generic web service protocol, not the threat intel standard.