Removing an IOC from a Feed (SOAR Action in ServiceNow)

Use this SOAR action to remove an IOC from a feed.

• This SOAR action can be run from an alert.
• You must configure the Watchlist and report details in the Actions section of the Configuration Profile. See Configuring a ServiceNow Configuration Profile and Configure ServiceNow Actions (Optional).
• If the Watchlist is correctly configured in the Configuration Profile, a popup window displays. In this window, select the Field and provide the IOC values to be removed from the feed. The report is updated to remove the IOC.

Note: If the Actions section in the associated Configuration Profile is not configured, a message indicates that you need to configure the action.