Threat feed always ingests from "Fetch Data From" instead of delta updates after update set migration <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Issue After migrating Threat Intelligence Security Center (TISC) threat feeds to a new instance using update sets, the feed always ingests the full data set from the configured Fetch Data From date on every run, instead of performing incremental (delta) updates from the last successful run time. Cause The sn_sec_tisc_threat_source_run table records are not included in update set captures. When a threat feed configuration is migrated via update set, no corresponding run record exists on the target instance. Because there is no run record to track last_run_time, the system falls back to the fetch_data_from value configured on the threat source for every execution. Affected Versions All versions prior to Threat Intelligence Security Center 4.2.0. Workaround For each affected feed on the target instance, trigger creation of a sn_sec_tisc_threat_source_run record by disabling and re-enabling the feed. This fires the Create Threat Source Run Record business rule, which creates the missing run record. Steps Navigate to Threat Intelligence Security Center > Integrations.Open the affected threat feed.Set Status to Disabled and save.Set Status back to Enabled and save.A sn_sec_tisc_threat_source_run record is now created for the feed.Verify by navigating to the sn_sec_tisc_threat_source_run table and confirming a record exists for the feed. Note: The first run after applying this workaround will still fetch data from the configured fetch_data_from date, since last_run_time is not yet populated. Subsequent runs will use incremental delta updates from the last successful run time. Permanent Fix This issue is resolved in PRB1978616 , included in Threat Intelligence Security Center 4.2.0 . After upgrading, the system automatically creates a missing run record at execution start time, eliminating the need for this workaround.