USTA Threat Stream IoC Feed
IoC Feed Integrator App for ServiceNow Threat Intelligence
Install Trend
View Install Data
| Date | Install Count | Change |
|---|---|---|
| 2026-11-01 | 0 | - |
About
**USTA Threat Stream IoC Feed** connects your PRODAFT USTA Threat Stream subscription directly to ServiceNow Threat Intelligence. It retrieves indicators of compromise on a schedule and writes them into the platform's own indicator and observable tables, so analysts work through the Threat Intelligence interface they already use.
Three feeds can be enabled independently: Malicious URLs, Phishing Sites and Malware Hashes. Each runs on its own schedule and tracks its own position in the stream.
Key Features
- **Automated IOC Feed Ingestion**
Automatically retrieves Indicators of Compromise (IOCs) from the PRODAFT USTA Threat Stream API and ingests them into ServiceNow.
- **Multiple Threat Intelligence Feed Types**
Supports ingestion of multiple IOC categories including:
- **Native ServiceNow Threat Intelligence Integration**
Ingested IOC data is written directly into ServiceNow Threat Intelligence tables such as:
- **Observable Mapping for Security Operations**
IOC data is automatically normalized and mapped to ServiceNow observable types.
- **Scheduled Threat Intelligence Sources**
Uses ServiceNow Threat Intelligence Sources to retrieve IOC data on a scheduled basis, ensuring continuous intelligence updates.