USTA Threat Stream IoC Feed connects your PRODAFT USTA Threat Stream subscription directly to ServiceNow Threat Intelligence. It retrieves indicators of compromise on a schedule and writes them into the platform's own indicator and observable tables, so analysts work through the Threat Intelligence interface they already use.
Three feeds can be enabled independently: Malicious URLs, Phishing Sites and Malware Hashes. Each runs on its own schedule and tracks its own position in the stream.
-
Automated IOC Feed Ingestion
Automatically retrieves Indicators of Compromise (IOCs) from the PRODAFT USTA Threat Stream API and ingests them into ServiceNow. -
Multiple Threat Intelligence Feed Types
Supports ingestion of multiple IOC categories including:-
Malicious Sites (including domains and IP's and URLs)
-
Malware Hashes
-
Phishing Sites
-
-
Native ServiceNow Threat Intelligence Integration
Ingested IOC data is written directly into ServiceNow Threat Intelligence tables such as:-
sn_ti_indicator
-
sn_ti_observable
-
-
Observable Mapping for Security Operations
IOC data is automatically normalized and mapped to ServiceNow observable types.
-
Scheduled Threat Intelligence Sources
Uses ServiceNow Threat Intelligence Sources to retrieve IOC data on a scheduled basis, ensuring continuous intelligence updates.
Initial Release
Threat Intelligence Support Common
Other Requirements:USTA License/Subscription