Skip to main content
ServiceNow Threat Intelligence Security Center (TISC) is the module security teams use to collect, store, and act on threat intelligence inside ServiceNow. With this integration, Pulsedive acts as a TAXII 2.1 server and TISC connects as a TAXII client, polling Pulsedive on a schedule and importing indicators in STIX format. Because Pulsedive scores and deduplicates indicators before export, your analysts start from enriched context instead of raw, unsorted data. TISC provides Pulsedive TAXII as one of its built-in threat intelligence feeds, so you can use the feed that ships with your instance or configure a new source of your own.

Prerequisites

Before you connect ServiceNow to Pulsedive, make sure you have the account and access the integration needs, so setup goes smoothly. In Pulsedive, make sure you have:
  • A Pulsedive account and API key. Find your API key on your Pulsedive account page.
  • A Pulsedive Pro or Feed plan to access the Indicator and Threat collections. The free Test collection works with any account, so you can evaluate the integration first.
In ServiceNow, make sure you have:
  • Threat Intelligence Security Center installed in your instance. TISC is a paid application from the ServiceNow Store, so check whether your organization licenses it before you plan the work.
  • The sn_sec_tisc.admin role, which ServiceNow requires to configure a TAXII feed.
  • Outbound connectivity to https://pulsedive.com on port 443.

Connecting ServiceNow to Pulsedive

TISC retrieves Pulsedive data through a TAXII feed record that holds your API key and points at Pulsedive’s TAXII server. Once the feed is set up and a collection is enabled, TISC imports Pulsedive indicators on each run, ready for correlation with your security data.
1

Set up the feed

TISC ships with a built-in Pulsedive TAXII feed, and you can also configure a new source of your own. Both connect to Pulsedive the same way, so choose based on how your organization handles out-of-box records:
  • Built-in feed: Add only your API key to the record that ships with TISC. Editing the record marks it as customized, which raises a Medium Risk warning and leaves a skipped record for someone to resolve at any upgrade that ships a new version of it.
  • New source: Fill in a few more fields, but keep your configuration separate from the records ServiceNow maintains, so upgrades leave nothing to resolve.
ServiceNow provides a Pulsedive TAXII feed out of the box, so you can connect by adding your API key to the existing record instead of creating a new one.
  1. Navigate to Workspaces > Threat Intelligence Security Center.
  2. Select the Integrations icon.
  3. Select Intel feeds > STIX TAXII > TAXII Feeds.
  4. Select Pulsedive TAXII, then select any field to enter edit mode.
    The record already has Authentication set to API Key and URL set to https://pulsedive.com/taxii2/api/, which is Pulsedive’s TAXII API root. Leave both as they are.
  5. In the API Key field, enter your Pulsedive API key.
  6. Set your schedule:
  7. Select Save.
2

Configure the collections

Connect your feed to Pulsedive and choose which collections to import, so TISC knows what to retrieve on each run.
  1. Select Validate Connection. ServiceNow reports success or failure. If it returns 401 - Invalid username/password or API key, check that you copied your full API key from your Pulsedive account.
  2. Select Get TAXII Collections. ServiceNow adds Pulsedive’s collections to the feed’s TAXII Collections tab:
    • Pulsedive indicator data: All Pulsedive indicator objects.
    • Pulsedive threat data: All Pulsedive threat objects.
    • Pulsedive test data: Live sample data.
  3. Open each collection you want to retrieve and select Enable.
3

Verify the connection

Confirm that Pulsedive indicators are flowing into ServiceNow before you rely on them in your workflows.
  1. Open each collection you enabled and select Execute Now.
  2. On the collection’s Integration Runs tab, confirm the run reaches a completed state.
  3. Open Threat Intel Library, then All Observables, and remove the default Processing Status != Draft filter. Imported observables arrive in Draft, so the default view shows a count of zero even when the import succeeds.
  4. Open an observable and confirm that its Sources value names your Pulsedive feed and collection, such as TAXII Collection: Pulsedive TAXII : Pulsedive test data.
    If the test collection returns data and the indicator and threat collections don’t, check that your Pulsedive plan includes them.If a run returns no data, check your API key’s remaining request allowance.

Using Pulsedive Data in ServiceNow

Once Pulsedive indicators are in TISC, ServiceNow correlates them with your existing security data so you can enrich records, drive detections, and inform response. To shape which indicators you ingest, apply Pulsedive’s filtering parameters to your collection queries. To learn more, visit Filtering. To review the vendor-agnostic setup, visit Quick Setup. For the full TAXII reference, visit STIX/TAXII Reference.