TISC TAXII Server API

Provides Trusted Automated Exchange of Intelligence Information (TAXII) server endpoints for sharing threat intelligence data in Threat Intelligence Security Center (TISC).

This API requires the Threat Intelligence Security Center application, which is available on the ServiceNow Store.

For additional information about TISC, see Threat Intelligence Security Center.

This API runs in the sn_sec_tisc namespace. The calling user must have the sn_sec_tisc.taxii_server_api_user role.

The current version of this API is v2. The following capabilities are supported in each version.

• v1

  Supports sharing threat intelligence data from one ServiceNow instance to another.

• v2

  • Adds support for sharing threat intelligence data from a ServiceNow instance to an external system.
  • Supports trailing slashes.

Parent Topic:REST API reference

TISC TAXII Server - GET /sn_sec_tisc/taxii_server/taxii2

Discovery endpoint for the TAXII server. Provides metadata about available API roots, services offered by the TISC TAXII server, and how to interact with it.

URL format

Versioned URL: /api/sn_sec_tisc/{api_version}/taxii_server/taxii2

Default URL: /api/sn_sec_tisc/taxii_server/taxii2

Supported request parameters

Headers

The following request and response headers apply to this HTTP action only, or apply to this action in a distinct way. For a list of general headers used in the REST API, see Supported REST API headers.

Status codes

The following status codes apply to this HTTP action. For a list of possible status codes used in the REST API, see REST API HTTP response codes.

Response body parameters (JSON)

cURL request

This example returns metadata about available API roots.

curl "https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/taxii2" \ 
--request GET \ 
--header "Accept:application/taxii+json;version=2.1" \ 
--user 'username':'password'

Response body.

{ 
    "title": "ServiceNow TAXII Server", 
    "description": "Discovery endpoint for sharing cyber threat intelligence via TAXII", 
    "contact": "TAXII Server Contact", 
    "default": "https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root", 
    "api_roots": [ 
        "https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root" 
    ] 
}

TISC TAXII Server - GET /sn_sec_tisc/taxii_server/{api_root}

Provides information about an API root.

Note: The only API root currently supported by Threat Intelligence Security Center is api/sn_sec_tisc/taxii_server/api_root.

URL format

Versioned URL: /api/sn_sec_tisc/{api_version}/taxii_server/{api_root}

Default URL: /api/sn_sec_tisc/taxii_server/{api_root}

Supported request parameters

Headers

The following request and response headers apply to this HTTP action only, or apply to this action in a distinct way. For a list of general headers used in the REST API, see Supported REST API headers.

Status codes

The following status codes apply to this HTTP action. For a list of possible status codes used in the REST API, see REST API HTTP response codes.

Response body parameters (JSON)

cURL request

This example returns information about an API root.

curl "https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root" \ 
--request GET \ 
--header "Accept:application/taxii+json;version=2.1" \ 
--user 'username':'password'

Response body.

{ 
    "title": "ServiceNow TAXII Server", 
    "description": "API root endpoint for sharing cyber threat intelligence via TAXII", 
    "versions": [ 
        "application/taxii+json;version=2.1" 
    ], 
    "max_content_length": 1024 
}

TISC TAXII Server - GET /sn_sec_tisc/taxii_server/{api_root}/collections

Returns data about all available TAXII collections at the specified API root.

A TAXII collection is a logical grouping of threat intelligence data that enables the exchange of information between a TAXII client and a TAXII server.

URL format

Versioned URL: /api/sn_sec_tisc/{api_version}/taxii_server/{api_root}/collections

Default URL: /api/sn_sec_tisc/taxii_server/{api_root}/collections

Supported request parameters

Headers

The following request and response headers apply to this HTTP action only, or apply to this action in a distinct way. For a list of general headers used in the REST API, see Supported REST API headers.

Status codes

The following status codes apply to this HTTP action. For a list of possible status codes used in the REST API, see REST API HTTP response codes.

Response body parameters (JSON)

"collections": [
    { 
        "can_read": Boolean,   
        "can_write": Boolean,
        "description": "String",  
        "id": "String", 
        "media_types": [Array], 
        "title": "String" 
    } 
]

cURL request

This example returns data about all available TAXII collections at the specified API root.

curl "https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root/collections" \ 
--request GET \ 
--header "Accept:application/taxii+json;version=2.1" \ 
--user 'username':'password'

Response body.

{ 
    "collections": [ 
        { 
            "id": "308accee37cd22107253a2d734924baf", 
            "title": " Collection-1", 
            "can_read": true, 
            "can_write": false, 
            "media_types": [ 
                "application/taxii+json;version=2.1" 
            ] 
        }, 
        { 
            "id": "308accee37cd22107253a2d734926ghy", 
            "title": " Collection-2", 
            "can_read": true, 
            "can_write": false, 
            "media_types": [ 
                "application/taxii+json;version=2.1" 
            ] 
        } 
    ] 
}

TISC TAXII Server - GET /sn_sec_tisc/taxii_server/{api_root}/collections/{id}

Returns data about a specified collection.

URL format

Versioned URL: /api/sn_sec_tisc/{api_version}/taxii_server/{api_root}/collections/{id}

Default URL: /api/sn_sec_tisc/taxii_server/{api_root}/collections/{id}

Supported request parameters

Headers

The following request and response headers apply to this HTTP action only, or apply to this action in a distinct way. For a list of general headers used in the REST API, see Supported REST API headers.

Status codes

The following status codes apply to this HTTP action. For a list of possible status codes used in the REST API, see REST API HTTP response codes.

Response body parameters (JSON)

cURL request

This example returns data about a specified collection.

curl "https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root/collections/308accee37cd22107253a2d734924baf" \ 
--request GET \ 
--header "Accept:application/taxii+json;version=2.1" \ 
--user 'username':'password'

Response body.

{ 
    "id": "308accee37cd22107253a2d734924baf", 
    "title": " Collection-1", 
    "can_read": true, 
    "can_write": false, 
    "media_types": [ 
        "application/taxii+json;version=2.1" 
    ] 
}

TISC TAXII Server - GET /sn_sec_tisc/taxii_server/{api_root}/collections/{id}/objects

Returns objects from a specified collection.

URL format

Versioned URL: /api/sn_sec_tisc/{api_version}/taxii_server/{api_root}/collections/{id}/objects

Default URL: /api/sn_sec_tisc/taxii_server/{api_root}/collections/{id}/objects

Supported request parameters

Headers

The following request and response headers apply to this HTTP action only, or apply to this action in a distinct way. For a list of general headers used in the REST API, see Supported REST API headers.

Status codes

The following status codes apply to this HTTP action. For a list of possible status codes used in the REST API, see REST API HTTP response codes.

Response body parameters (JSON)

cURL request

This example returns all objects in the specified collection.

curl "https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root/collections/308accee37cd22107253a2d734924baf/objects" \ 
--request GET \ 
--header "Accept:application/taxii+json;version=2.1" \ 
--user 'username':'password'

Response body containing one URL object.

{
  "more": false,
  "objects": [
    {
      "id": "url--624ca0a8-ffd1-5210-8253-ffffffffffbe",
      "type": "url",
      "defanged": false,
      "value": "http://testurl.com",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "extensions": {
        "extension-definition--ef28a0ac-ff11-4210-8253-ffffffffffbd": {
          "x_is_false_positive": false,
          "x_domain": "testurl.com",
          "x_status": "Active",
          "x_source_count": 2,
          "x_threat_score": 50,
          "extension_type": "property-extension"
        }
      }
    },
    {
      "id": "indicator--657bef11-2b7c-4a50-8758-f8014391bff3",
      "type": "indicator",
      "spec_version": "2.1",
      "created": "2025-10-24T14:09:23.000Z",
      "modified": "2025-11-20T12:14:24.000Z",
      "revoked": false,
      "confidence": 75,
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "pattern": "url:value = 'http://testurl.com'",
      "pattern_type": "stix",
      "name": "Test Indicator",
      "pattern_version": "2.1",
      "valid_from": "2025-10-24T14:09:19.000Z",
      "extensions": {
        "extension-definition--4f5ba226-ff95-4210-8238-ffffffffff1d": {
          "x_status": "Active",
          "x_source_count": 1,
          "x_used_for_detection": false,
          "x_threat_level": "High",
          "x_threat_severity": "High",
          "x_ioc_classification": "Potential Threat",
          "extension_type": "property-extension"
        }
      }
    },
    {
      "name": "Test Campaign",
      "id": "campaign--a02ce391-2b7c-4a50-8758-f8014391bf45",
      "type": "campaign",
      "spec_version": "2.1",
      "created": "2025-10-24T14:12:19.000Z",
      "modified": "2025-11-20T12:14:39.000Z",
      "revoked": false,
      "confidence": 75,
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "aliases": [
        "Test Campaign"
      ],
      "extensions": {
        "extension-definition--8b5ba226-ff95-4210-8238-ffffffffff1d": {
          "x_source_count": 1,
          "x_threat_level": "High",
          "x_threat_severity": "High",
          "x_status": "Active",
          "extension_type": "property-extension"
        }
      }
    }
  ]
}

TISC TAXII Server - GET /sn_sec_tisc/taxii_server/{api_root}/collections/{id}/objects/{object_id}

Returns a specified object from a collection.

URL format

Versioned URL: /api/sn_sec_tisc/{api_version}/taxii_server/{api_root}/collections/{id}/objects/{object_id}

Default URL: /api/sn_sec_tisc/taxii_server/{api_root}/collections/{id}/objects/{object_id}

Supported request parameters

Headers

The following request and response headers apply to this HTTP action only, or apply to this action in a distinct way. For a list of general headers used in the REST API, see Supported REST API headers.

Status codes

The following status codes apply to this HTTP action. For a list of possible status codes used in the REST API, see REST API HTTP response codes.

Response body parameters (JSON)

cURL request

This example returns a specified URL object.

curl "https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root/collections/308accee37cd22107253a2d734924baf/objects/url--624ca0a8-ffd1-5210-8253-ffffffffffbe" \ 
--request GET \ 
--header "Accept:application/taxii+json;version=2.1" \ 
--user 'username':'password' 

Response body.

{ 
    "objects": [ 
        { 
            "id": "url--624ca0a8-ffd1-5210-8253-ffffffffffbe", 
            "type": "url", 
            "defanged": false, 
            "value": "http://testurl.com ", 
            "object_marking_refs": [ 
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" 
            ], 
            "extensions": { 
                "extension-definition--ef28a0ac-ff11-4210-8253-ffffffffffbd": { 
                    "x_is_false_positive": false, 
                    "x_domain": "testurl.com", 
                    "x_status": "Active", 
                    "x_source_count": 2, 
                    "x_threat_score": 50, 
                    "extension_type": "property-extension" 
                } 
            } 
        } 
    ] 
}

TISC TAXII Server - GET /sn_sec_tisc/taxii_server/{api_root}/collections/{id}/objects/{object_id}/versions

Returns all versions of a specified object from a collection.

URL format

Versioned URL: /api/sn_sec_tisc/{api_version}/taxii_server/{api_root}/collections/{id}/objects/{object_id}/versions

Default URL: /api/sn_sec_tisc/taxii_server/{api_root}/collections/{id}/objects/{object_id}/versions

Supported request parameters

Headers

The following request and response headers apply to this HTTP action only, or apply to this action in a distinct way. For a list of general headers used in the REST API, see Supported REST API headers.

Status codes

The following status codes apply to this HTTP action. For a list of possible status codes used in the REST API, see REST API HTTP response codes.

Response body parameters (JSON)

cURL request

This example returns all versions of a specified object from a collection.

curl "https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root/collections/308accee37cd22107253a2d734924baf/objects/url--624ca0a8-ffd1-5210-8253-ffffffffffbe/versions" \ 
--request GET \ 
--header "Accept:application/taxii+json;version=2.1" \ 
--user 'username':'password'

Response body.

{
  "versions": [
    "2025-11-20T12:16:38.000000Z",
    "2025-11-20T12:18:51.000000Z"
  ]

TISC TAXII Server - GET /sn_sec_tisc/taxii_server/{api_root}/collections/{id}/manifest

Provides a summary of the objects in a collection.

This endpoint enables clients to quickly understand what data is available without retrieving the full objects.

URL format

Versioned URL: /api/sn_sec_tisc/{api_version}/taxii_server/{api_root}/collections/{id}/manifest

Default URL: /api/sn_sec_tisc/taxii_server/{api_root}/collections/{id}/manifest

Supported request parameters

Headers

The following request and response headers apply to this HTTP action only, or apply to this action in a distinct way. For a list of general headers used in the REST API, see Supported REST API headers.

Status codes

The following status codes apply to this HTTP action. For a list of possible status codes used in the REST API, see REST API HTTP response codes.

Response body parameters (JSON)

"objects": [ 
    { 
        "date_added": "String",
        "id": "String",
        "media_types": "String",
        "version": "String"
    }
]

cURL request

This example returns manifests for all objects in a collection.

curl "https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root/collections/308accee37cd22107253a2d734924baf/manifest" \ 
--request GET \ 
--header "Accept:application/taxii+json;version=2.1" \ 
--user 'username':'password'

Response body containing a manifest for one object.

{
  "more": false,
  "objects": [
    {
      "version": "2025-11-20T12:16:38.000000Z",
      "media_types": "application/taxii+json;version=2.1",
      "id": "indicator--657bef11-2b7c-4a50-8758-f8014391bff3",
      "date_added": "2025-11-20T04:16:38.000000Z"
    },
    {
      "version": "2025-11-20T12:16:38.000000Z",
      "media_types": "application/taxii+json;version=2.1",
      "id": "campaign--a02ce391-2b7c-4a50-8758-f8014391bf45",
      "date_added": "2025-11-20T04:16:38.000000Z"
    },
    {
      "version": "2025-11-20T12:18:51.000000Z",
      "media_types": "application/taxii+json;version=2.1",
      "id": "url--624ca0a8-ffd1-5210-8253-ffffffffffbe",
      "date_added": "2025-11-20T04:18:51.000000Z"
    }
  ]
}