{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":558,"path":"api-reference/rest-apis/tisc-intel-ex-api.md","title":"TISC Intel Exchange API","bundle":null,"doc_type":null,"release":"australia","body":"\n# TISC Intel Exchange API\n\nEnables external systems to share threat intelligence data with the Threat Intelligence Security Center \\(TISC\\) application.\n\nThis API requires the Threat Intelligence Security Center application, which is available on the ServiceNow Store.\n\nFor additional information about TISC, see [Threat Intelligence Security Center](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/tisc-landing-page.md).\n\nThis API runs in the `sn_sec_tisc` namespace. The calling user must have the sn\\_sec\\_tisc.api\\_post\\_intel role.\n\nThe current version of this API is `v1`.\n\n**Parent Topic:**[REST API reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-apis/api-rest.md)\n\n## TISC Intel Exchange - POST /sn\\_sec\\_tisc/tisc\\_intel\\_sharing\\_api/post\\_intel\n\nShares threat intelligence data from an external source with the Threat Intelligence Security Center \\(TISC\\) application.\n\nThis endpoint creates an inbound intelligence record, as well as records for indicators, objects, and observables.\n\nIndicator records are created in the Indicator Source \\[sn\\_sec\\_tisc\\_indicator\\_source\\] table.\n\nObject records are created in the following tables that extend Object Source \\[sn\\_sec\\_tisc\\_object\\_source\\].\n\n- Attack Pattern Source \\[sn\\_sec\\_tisc\\_attack\\_pattern\\_source\\]\n- Campaign Source \\[sn\\_sec\\_tisc\\_campaign\\_source\\]\n- Course of Action Source \\[sn\\_sec\\_tisc\\_course\\_of\\_action\\_source\\]\n- Data Component \\[sn\\_sec\\_tisc\\_data\\_component\\]\n- Data Source \\[sn\\_sec\\_tisc\\_data\\_source\\]\n- Identity Source \\[sn\\_sec\\_tisc\\_identity\\_source\\]\n- Infrastructure Source \\[sn\\_sec\\_tisc\\_infrastructure\\_source\\]\n- Intrusion Set Source \\[sn\\_sec\\_tisc\\_intrusion\\_set\\_source\\]\n- Location Source \\[sn\\_sec\\_tisc\\_location\\_source\\]\n- Malware Analysis Source \\[sn\\_sec\\_tisc\\_malware\\_analysis\\_source\\]\n- Malware Source \\[sn\\_sec\\_tisc\\_malware\\_source\\]\n- Marking Definition Source \\[sn\\_sec\\_tisc\\_marking\\_definition\\_source\\]\n- Object Sighting Source \\[sn\\_sec\\_tisc\\_object\\_sighting\\_source\\]\n- Observed Data Source \\[sn\\_sec\\_tisc\\_observed\\_data\\_source\\]\n- Threat Actor Source \\[sn\\_sec\\_tisc\\_threat\\_actor\\_source\\]\n- Threat Event Source \\[sn\\_sec\\_tisc\\_threat\\_event\\_source\\]\n- Threat Grouping Source \\[sn\\_sec\\_tisc\\_threat\\_grouping\\_source\\]\n- Threat Note Source \\[sn\\_sec\\_tisc\\_threat\\_note\\_source\\]\n- Threat Opinion Source \\[sn\\_sec\\_tisc\\_threat\\_opinion\\_source\\]\n- Threat Report Source \\[sn\\_sec\\_tisc\\_threat\\_report\\_source\\]\n- Tool Source \\[sn\\_sec\\_tisc\\_tool\\_source\\]\n- Vulnerability Source \\[sn\\_sec\\_tisc\\_vulnerability\\_source\\]\n\nObservable records are created in the following tables that extend Observable Source \\[sn\\_sec\\_tisc\\_observable\\_source\\].\n\n- Artifact Source \\[sn\\_sec\\_tisc\\_artifact\\_source\\]\n- AS Number Source \\[sn\\_sec\\_tisc\\_as\\_number\\_source\\]\n- Directory Source \\[sn\\_sec\\_tisc\\_directory\\_source\\]\n- Domain Name Source \\[sn\\_sec\\_tisc\\_domain\\_name\\_source\\]\n- Email Address Source \\[sn\\_sec\\_tisc\\_email\\_address\\_source\\]\n- Email Message Source \\[sn\\_sec\\_tisc\\_email\\_message\\_source\\]\n- Email Subject Source \\[sn\\_sec\\_tisc\\_email\\_subject\\_source\\]\n- File Source \\[sn\\_sec\\_tisc\\_file\\_source\\]\n- IPv4 Address Source \\[sn\\_sec\\_tisc\\_ipv4\\_address\\_source\\]\n- IPv4 CIDR Source \\[sn\\_sec\\_tisc\\_ipv4\\_cidr\\_source\\]\n- IPv6 Address Source \\[sn\\_sec\\_tisc\\_ipv6\\_address\\_source\\]\n- IPv6 CIDR Source \\[sn\\_sec\\_tisc\\_ipv6\\_cidr\\_source\\]\n- MAC Address Source \\[sn\\_sec\\_tisc\\_mac\\_address\\_source\\]\n- MD5 Hash Source \\[sn\\_sec\\_tisc\\_md5\\_hash\\_source\\]\n- Mutex Name Source \\[sn\\_sec\\_tisc\\_mutex\\_name\\_source\\]\n- Network Source \\[sn\\_sec\\_tisc\\_network\\_source\\]\n- Other Observable Source \\[sn\\_sec\\_tisc\\_other\\_observable\\_source\\]\n- Process Source \\[sn\\_sec\\_tisc\\_process\\_source\\]\n- SHA1 Hash Source \\[sn\\_sec\\_tisc\\_sha1\\_hash\\_source\\]\n- SHA256 Hash Source \\[sn\\_sec\\_tisc\\_sha256\\_hash\\_source\\]\n- SHA512 Hash Source \\[sn\\_sec\\_tisc\\_sha512\\_hash\\_source\\]\n- Software Source \\[sn\\_sec\\_tisc\\_software\\_source\\]\n- URL Source \\[sn\\_sec\\_tisc\\_url\\_source\\]\n- User Account Source \\[sn\\_sec\\_tisc\\_user\\_account\\_source\\]\n- Windows Registry Key Source \\[sn\\_sec\\_tisc\\_windows\\_registry\\_key\\_source\\]\n- X.509 Certificate Source \\[sn\\_sec\\_tisc\\_x\\_509\\_certificate\\_source\\]\n\n### URL format\n\nVersioned URL: `/api/sn_sec_tisc/{api_version}/tisc_intel_sharing_api/post_intel`\n\nDefault URL: `/api/sn_sec_tisc/tisc_intel_sharing_api/post_intel`\n\n### Supported request parameters\n\n\n
\n\nName\n\n\n\nDescription\n\n
\n\napi\\_version\n\n\n\nOptional. Version of the endpoint to access. For example, `v1` or `v2`. Only specify this value to use an endpoint version other than the latest. Data type: String\n\n
|Name|Description|\n|----|-----------|\n|None| |\n\n|Name|Description|\n|----|-----------|\n|<Object>|[STIX 2.1](https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html) or MISP payload containing the threat intelligence data to share with TISC. When using MISP, it must be an array of [MISP event payloads](https://www.misp-project.org/openapi/#tag/Events/operation/getEvents).|\n\n### Headers\n\nThe following request and response headers apply to this HTTP action only, or apply to this action in a distinct way. For a list of general headers used in the REST API, see [Supported REST API headers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md).\n\n\n
\n\nHeader\n\n\n\nDescription\n\n
\n\nAccept\n\n\n\nData format of the response body. Only supports **application/json**.\n\n
\n\nProfile-GUID\n\n\n\nUnique identifier of the inbound intelligence profile configured in the receiving instance that data is being shared with.To obtain the unique identifier, navigate to the **Administration** tab of **Threat Intelligence Security Center**, then go to **Inbound Intelligence Profiles** and click the profile you want to use. On the profile page, select **Copy Profile ID** or **Email Profile Details**.\n\n
\n\nShared-Intel-Format\n\n\n\nFormat of the data being shared.Possible values:\n\n- STIX 2.1\n- MISP\n\n
|Header|Description|\n|------|-----------|\n|Content-Type|Data format of the response body. Only supports **application/json**.|\n\n### Status codes\n\nThe following status codes apply to this HTTP action. For a list of possible status codes used in the REST API, see [REST API HTTP response codes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md).\n\n\n
\n\nStatus code\n\n\n\nDescription\n\n
\n\n200\n\n\n\nSuccessful. The request was successfully processed.\n\n
\n\n400\n\n\n\nBad Request. Possible errors:\n\n- Missing `Shared-Intel-Format` in request header.\n- Missing `Profile-GUID` in request header.\n- `Shared-Intel-Format` header contains unsupported values.\n- `Profile-GUID` header refers to a profile that isn't enabled or doesn't exist.\n- Profile doesn't support intelligence sharing in the format specified by the `Shared-Intel-Format` header.\n- Authenticated user doesn't have permission to submit intelligence to the specified profile.\n\n
\n\n422\n\n\n\nUnprocessable Content. The request body doesn't follow the format specified by the `Shared-Intel-Format` request header.\n\n
\n\n500\n\n\n\nInternal server error. An unexpected error occurred while processing the request. The response contains additional information about the error.\n\n
### Response body parameters \\(JSON\\)\n\n\n
\n\nName\n\n\n\nDescription\n\n
\n\nerror\n\n\n\nError information. This parameter is only returned if the request failed.Data type: Object\n\n```\n\"error\": {\n \"message\": \"String\",\n \"detail\": \"String\"\n}\n```\n\n
\n\nerror.message\n\n\n\nError message containing the reason the request failed.Data type: String\n\n
\n\nerror.detail\n\n\n\nAdditional details about why the request failed.Data type: String\n\n
\n\nresult\n\n\n\nDetails about the records that were successfully created.```\n\"result\": {\n    \"createdEntitiesCount\": {Object}, \n \"receivedIntelligenceRecord\": \"String\" \n}\n```\n\nData type: Object\n\n
\n\nresult.createdEntitiesCount\n\n\n\nCount of each type of created entity.```\n\"createdEntitiesCount\": {\n \"indicators\": Number,\n \"objects\": Number,  \n \"observables\": Number  \n}\n```\n\nData type: Object\n\n
\n\nresult.createdEntitiesCount.indicators\n\n\n\nCount of created indicators.Data type: Number\n\n
\n\nresult.createdEntitiesCount.objects\n\n\n\nCount of created objects.Data type: Number\n\n
\n\nresult.createdEntitiesCount.observables\n\n\n\nCount of created observables.Data type: Number\n\n
\n\nresult.receivedIntelligenceRecord\n\n\n\nIdentification number of the created inbound intelligence record.Data type: String\n\nTable: Inbound Intelligence \\[sn\\_sec\\_tisc\\_inbound\\_intelligence\\]\n\nColumn: Number\n\n
### cURL request\n\nThis example creates records for an indicator, object \\(malware\\), and observable \\(domain name\\) based on data in STIX 2.1 format.\n\n```\n\ncurl \"https://instancename.service-now.com/api/sn_sec_tisc/v1/tisc_intel_sharing_api/post_intel\" \\\n --request POST \\\n --header 'Shared-Intel-Format: STIX 2.1' \\\n --header 'Profile-GUID: a87febc22b80b210ceeaf5486e91bfdb' \\\n --header 'Content-Type: application/json' \\\n --user 'username:password' \\\n --data '{\n \"type\": \"bundle\",\n \"objects\": [\n {\n \"id\": \"domain-name--4b5f73f2-1bf2-5250-8926-55f0604bcb0c\",\n \"type\": \"domain-name\",\n \"defanged\": false,\n \"value\": \"testdomain.com\",\n \"object_marking_refs\": [\n \"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\"\n ]\n },\n {\n \"id\": \"indicator--64c35f36-1b32-4250-8926-55f0604bcbaf\",\n \"type\": \"indicator\",\n \"spec_version\": \"2.1\",\n \"revoked\": false,\n \"confidence\": 74,\n \"object_marking_refs\": [\n \"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\"\n ],\n \"pattern\": \"[ domain-name:value = 'testdomain.com' ]\",\n \"name\": \"Test Indicator\",\n \"description\": \"References to this domain are indicative of the presence of the Test malware in the environment\",\n \"valid_from\": \"2011-02-11T00:00:00.000Z\",\n \"kill_chain_phases\": [\n {\n \"kill_chain_name\": \"lockheed-martin-cyber-kill-chain\",\n \"phase_name\": \"exploit\"\n }\n ]\n },\n {\n \"id\": \"malware--1ec31776-1b7a-4610-8f18-cb31604bcb36\",\n \"type\": \"malware\",\n \"spec_version\": \"2.1\",\n \"revoked\": false,\n \"confidence\": 60,\n \"object_marking_refs\": [\n \"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\"\n ],\n \"name\": \"Test Malware\",\n \"description\": \"Once infected with this malware, a host becomes part of the Test Botnet\",\n \"is_family\": false,\n \"last_seen\": \"2023-06-26T08:04:17.000Z\",\n \"aliases\": [\n \"Alias1\"\n ],\n \"kill_chain_phases\": [\n {\n \"kill_chain_name\": \"lockheed-martin-cyber-kill-chain\",\n \"phase_name\": \"control\"\n }\n ],\n \"capabilities\": [\n \"anti-vm\"\n ]\n }\n ]\n }'\n```\n\nResponse body.\n\n```\n{\n \"result\": {\n \"receivedIntelligenceRecord\": \"IBTI0001001\",\n \"createdEntitiesCount\": {\n \"observables\": 1.0,\n \"indicators\": 1.0,\n \"objects\": 1.0\n }\n }\n}\n```\n\n### cURL request\n\nThis example creates records for objects and observables based on data in MISP format.\n\n```\n\ncurl \"https://instancename.service-now.com/api/sn_sec_tisc/v1/tisc_intel_sharing_api/post_intel\" \\\n --request POST \\\n --header 'Shared-Intel-Format: MISP' \\\n --header 'Profile-GUID: a87febc22b80b210ceeaf5486e91bfdb' \\\n --header 'Content-Type: application/json' \\\n --user 'username:password' \\\n --data '[\n {\n \"Event\": {\n \"id\": \"134\",\n \"orgc_id\": \"3\",\n \"org_id\": \"1\",\n \"date\": \"2016-03-28\",\n \"threat_level_id\": \"3\",\n \"info\": \"OSINT - TREASUREHUNT: A CUSTOM POS MALWARE TOOL\",\n \"published\": true,\n \"uuid\": \"56f92df0-24f0-4c6e-a297-6f2402de0b81\",\n \"attribute_count\": \"54\",\n \"analysis\": \"2\",\n \"timestamp\": \"1459171202\",\n \"distribution\": \"3\",\n \"proposal_email_lock\": false,\n \"locked\": false,\n \"publish_timestamp\": \"1727129707\",\n \"sharing_group_id\": \"0\",\n \"disable_correlation\": false,\n \"extends_uuid\": \"\",\n \"protected\": null,\n \"event_creator_email\": \"user.name@email.com\",\n \"Org\": {\n \"id\": \"1\",\n \"name\": \"ORGNAME\",\n \"uuid\": \"ed6dd3f3-f4a9-4109-974c-4b8da8795b96\",\n \"local\": true\n },\n \"Orgc\": {\n \"id\": \"3\",\n \"name\": \"EXAMPLE\",\n \"uuid\": \"55f6ea5e-2c60-40e5-964f-47a8950d210f\",\n \"local\": false\n },\n \"Attribute\": [\n {\n \"id\": \"17426\",\n \"type\": \"link\",\n \"category\": \"External analysis\",\n \"to_ids\": false,\n \"uuid\": \"56f92e2a-1be0-4a3a-a3b6-3f2a02de0b81\",\n \"event_id\": \"134\",\n \"distribution\": \"5\",\n \"timestamp\": \"1459170858\",\n \"comment\": \"\",\n \"sharing_group_id\": \"0\",\n \"deleted\": false,\n \"disable_correlation\": false,\n \"object_id\": \"0\",\n \"object_relation\": null,\n \"value\": \"https://www.example.html\",\n \"Galaxy\": [],\n \"ShadowAttribute\": []\n },\n {\n \"id\": \"17429\",\n \"type\": \"md5\",\n \"category\": \"Payload delivery\",\n \"to_ids\": true,\n \"uuid\": \"56f92ea5-2d50-4fc9-92ef-6f2302de0b81\",\n \"event_id\": \"134\",\n \"distribution\": \"5\",\n \"timestamp\": \"1459170981\",\n \"comment\": \"TREASUREHUNT 0.1\",\n \"value\": \"cec2810556c63e9c225afb6a5ca58bc1\",\n \"Galaxy\": [],\n \"ShadowAttribute\": []\n },\n {\n \"id\": \"17430\",\n \"type\": \"md5\",\n \"category\": \"Payload delivery\",\n \"to_ids\": true,\n \"uuid\": \"56f92ea6-2890-41b3-8059-6f2302de0b81\",\n \"event_id\": \"134\",\n \"distribution\": \"5\",\n \"timestamp\": \"1459170982\",\n \"comment\": \"TREASUREHUNT 0.1\",\n \"value\": \"cb75de605c171e36c8a593e337275d8f\",\n \"Galaxy\": [],\n \"ShadowAttribute\": []\n },\n {\n \"id\": \"17431\",\n \"type\": \"md5\",\n \"category\": \"Payload delivery\",\n \"to_ids\": true,\n \"uuid\": \"56f92ea6-009c-4348-a0b2-6f2302de0b81\",\n \"event_id\": \"134\",\n \"distribution\": \"5\",\n \"timestamp\": \"1459170982\",\n \"comment\": \"TREASUREHUNT 0.1\",\n \"value\": \"6a9348f582b2e121a5d9bff1e8f0935f\",\n \"Galaxy\": [],\n \"ShadowAttribute\": []\n }\n ],\n \"Tag\": [\n {\n \"id\": \"35\",\n \"name\": \"tlp:white\",\n \"colour\": \"#ffffff\",\n \"exportable\": true\n }\n ]\n }\n },\n {\n \"Event\": {\n \"id\": \"646\",\n \"orgc_id\": \"3\",\n \"org_id\": \"1\",\n \"date\": \"2017-03-10\",\n \"threat_level_id\": \"2\",\n \"info\": \"OSINT - Wikileaks Vault7 JQJSNICKER code leak\",\n \"published\": true,\n \"uuid\": \"58c2fcf1-283c-45fa-b289-45ae02de0b81\",\n \"attribute_count\": \"14\",\n \"analysis\": \"2\",\n \"timestamp\": \"1489174168\",\n \"distribution\": \"3\",\n \"event_creator_email\": \"user.name@example.com\",\n \"Org\": {\n \"id\": \"1\",\n \"name\": \"ORGNAME\",\n \"uuid\": \"ed6dd3f3-f4a9-4109-974c-4b8da8795b96\",\n \"local\": true\n },\n \"Orgc\": {\n \"id\": \"3\",\n \"name\": \"CIRCL\",\n \"uuid\": \"55f6ea5e-2c60-40e5-964f-47a8950d210f\",\n \"local\": false\n },\n \"Attribute\": [\n {\n \"id\": \"140266\",\n \"type\": \"link\",\n \"category\": \"External analysis\",\n \"to_ids\": false,\n \"uuid\": \"58c2fd63-b1a4-4f74-aa79-41a602de0b81\",\n \"value\": \"http://example.com/\",\n \"Tag\": [\n {\n \"id\": \"35\",\n \"name\": \"tlp:white\",\n \"colour\": \"#ffffff\"\n }\n ]\n },\n {\n \"id\": \"140268\",\n \"type\": \"filename|sha1\",\n \"category\": \"Payload delivery\",\n \"to_ids\": true,\n \"uuid\": \"58c2fdc4-e6d8-4f6e-9eb5-4dbb02de0b81\",\n \"comment\": \"JQJSNICKER\",\n \"value\": \"Installer.dll.embedded.core.dll.file|02aa4d3712f324aa4b125056b52a5200691eb62b\"\n },\n {\n \"id\": \"140269\",\n \"type\": \"filename|sha256\",\n \"category\": \"Payload delivery\",\n \"to_ids\": true,\n \"uuid\": \"58c2fdc6-5064-49be-b39a-429402de0b81\",\n \"comment\": \"JQJSNICKER\",\n \"value\": \"Installer.dll.embedded.core.dll.file|ea042bd3a7df11273e233c423e9740e6b51001911139855ef39501472a1e5fb0\"\n }\n ],\n \"Tag\": [\n {\n \"id\": \"35\",\n \"name\": \"tlp:white\",\n \"colour\": \"#ffffff\"\n }\n ]\n }\n }\n ]'\n```\n\nResponse body.\n\n```\n{\n \"result\": {\n \"receivedIntelligenceRecord\": \"IBTI0001005\",\n \"createdEntitiesCount\": {\n \"observables\": 9,\n \"indicators\": 0,\n \"objects\": 2\n }\n }\n}\n```\n\n"}}