> ## Documentation Index > Fetch the complete documentation index at: https://docs.pulsedive.com/llms.txt > Use this file to discover all available pages before exploring further. # Integrate with ServiceNow > Import scored, deduplicated Pulsedive threat intelligence into ServiceNow Threat Intelligence Security Center over TAXII 2.1 for correlation, enrichment, and response. [ServiceNow Threat Intelligence Security Center (TISC)](https://www.servicenow.com/products/threat-intelligence-security-center.html) is the module security teams use to collect, store, and act on threat intelligence inside ServiceNow. With this integration, Pulsedive acts as a TAXII 2.1 server and TISC connects as a TAXII client, polling Pulsedive on a schedule and importing indicators in STIX format. Because Pulsedive scores and deduplicates indicators before export, your analysts start from enriched context instead of raw, unsorted data. TISC provides Pulsedive TAXII as one of its built-in threat intelligence feeds, so you can use the feed that ships with your instance or configure a new source of your own. ## Prerequisites Before you connect ServiceNow to Pulsedive, make sure you have the account and access the integration needs, so setup goes smoothly. In Pulsedive, make sure you have: * A Pulsedive account and API key. Find your API key on your [Pulsedive account page](https://pulsedive.com/account). * A Pulsedive Pro or Feed plan to access the Indicator and Threat collections. The free Test collection works with any account, so you can evaluate the integration first. In ServiceNow, make sure you have: * Threat Intelligence Security Center installed in your instance. TISC is a paid application from the ServiceNow Store, so check whether your organization licenses it before you plan the work. * The `sn_sec_tisc.admin` role, which ServiceNow requires to configure a TAXII feed. * Outbound connectivity to `https://pulsedive.com` on port `443`. ## Connecting ServiceNow to Pulsedive TISC retrieves Pulsedive data through a TAXII feed record that holds your API key and points at Pulsedive's TAXII server. Once the feed is set up and a collection is enabled, TISC imports Pulsedive indicators on each run, ready for correlation with your security data. **1. Set up the feed** TISC ships with a built-in Pulsedive TAXII feed, and you can also configure a new source of your own. Both connect to Pulsedive the same way, so choose based on how your organization handles out-of-box records: * **Built-in feed**: Add only your API key to the record that ships with TISC. Editing the record marks it as customized, which raises a **Medium Risk** warning and leaves a skipped record for someone to resolve at any upgrade that ships a new version of it. * **New source**: Fill in a few more fields, but keep your configuration separate from the records ServiceNow maintains, so upgrades leave nothing to resolve. > [tab] Built-in feed > > ServiceNow provides a Pulsedive TAXII feed out of the box, so you can connect by adding your API key to the existing record instead of creating a new one. > > 1. Navigate to **Workspaces** > **Threat Intelligence Security Center**. > > 2. Select the **Integrations** icon. > > 3. Select **Intel feeds** > **STIX TAXII** > **TAXII Feeds**. > > 4. Select **Pulsedive TAXII**, then select any field to enter edit mode. > > > [!NOTE] > > > > The record already has **Authentication** set to **API Key** and **URL** set to `https://pulsedive.com/taxii2/api/`, which is Pulsedive's TAXII API root. > > Leave both as they are. > > 5. In the **API Key** field, enter your Pulsedive API key. > > 6. Set your schedule: > > | Field Name | Description | > | - | - | > | **Run Frequency of Collections** | The scheduling interval applied to the TAXII collection records. The default, **On Demand**, retrieves data only when you select **Execute Now**, so choose an interval if you want Pulsedive data to stay current. | > | **Expiry period (days)** | How long imported data stays active. Defaults to `90`. | > > 7. Select **Save**. > [tab] New source > > Configure Pulsedive as a new TAXII feed to keep your configuration separate from the one ServiceNow maintains. > > 1. Navigate to **Workspaces** > **Threat Intelligence Security Center**. > 2. Select the **Integrations** icon. > 3. Select **Intel feeds** > **STIX TAXII** > **TAXII Feeds**. > 4. Select **Configure new source**. > 5. Enter details for the data source: > > | Field Name | Description | > | - | - | > | **Name** | A name for the feed, such as `Pulsedive`. | > | **Description** | A description of the feed. | > | **Source Type** | The type of source the feed provides. | > | **Logo** | The logo of the source feed. | > | **Industry** | The industry category the feed applies to. | > 6. Enter the connection details: > > | Field Name | Description | > | - | - | > | **TAXII Version** | Select `2.1`. | > | **Configuration Type** | Select **Enter API Root URL**. | > | **URL** | Use `https://pulsedive.com/taxii2/api/`. | > | **Authentication** | Select **API Key**. | > | **API Key** | Enter your Pulsedive API key. | > 7. Set your schedule: > > | Field Name | Description | > | - | - | > | **Run Frequency of Collections** | The scheduling interval applied to the TAXII collection records. The default, **On Demand**, retrieves data only when you select **Execute Now**, so choose an interval if you want Pulsedive data to stay current. | > | **Expiry period (days)** | How long imported data stays active. Defaults to `90`. | > 8. Select **Save**. > > For ServiceNow's reference, visit [Configure a new TAXII Feed](https://www.servicenow.com/docs/r/security-management/threat-intelligence-security-center/tisc-configure-a-new-taxii-feed.html). **2. Configure the collections** Connect your feed to Pulsedive and choose which collections to import, so TISC knows what to retrieve on each run. 1. Select **Validate Connection**. ServiceNow reports success or failure. If it returns **401 - Invalid username/password or API key**, check that you copied your full API key from [your Pulsedive account](https://pulsedive.com/account). 2. Select **Get TAXII Collections**. ServiceNow adds Pulsedive's collections to the feed's **TAXII Collections** tab: * `Pulsedive indicator data`: All Pulsedive indicator objects. * `Pulsedive threat data`: All Pulsedive threat objects. * `Pulsedive test data`: Live sample data. 3. Open each collection you want to retrieve and select **Enable**. **3. Verify the connection** Confirm that Pulsedive indicators are flowing into ServiceNow before you rely on them in your workflows. 1. Open each collection you enabled and select **Execute Now**. 2. On the collection's **Integration Runs** tab, confirm the run reaches a completed state. 3. Open **Threat Intel Library**, then **All Observables**, and remove the default **Processing Status != Draft** filter. Imported observables arrive in Draft, so the default view shows a count of zero even when the import succeeds. 4. Open an observable and confirm that its **Sources** value names your Pulsedive feed and collection, such as `TAXII Collection: Pulsedive TAXII : Pulsedive test data`. > [!TIP] > > If the test collection returns data and the indicator and threat collections don't, check that your Pulsedive plan includes them. > > If a run returns no data, check your API key's remaining request allowance. ## Using Pulsedive Data in ServiceNow Once Pulsedive indicators are in TISC, ServiceNow correlates them with your existing security data so you can enrich records, drive detections, and inform response. To shape which indicators you ingest, apply Pulsedive's filtering parameters to your collection queries. To learn more, visit [Filtering](https://docs.pulsedive.com/taxii/filtering.md). To review the vendor-agnostic setup, visit [Quick Setup](https://docs.pulsedive.com/taxii/quick-setup.md). For the full TAXII reference, visit [STIX/TAXII Reference](https://docs.pulsedive.com/taxii/overview.md). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.