---
sourceDocument: Yokohama Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/security-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Create and map detection rules

# Create and map detection rules {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read

Create detection rules and map them against the tactics and techniques. With this
mapping, you can see the coverage for the detection rules in your organization.

## Before you begin

Role required:

* sn_ti.admin, sn_si.admin: create, write, delete access
* sn_ti.read: read access
{#create-detection-rules__ul_kg3_lwl_wnb}

## About this task

Detection rule mapping enables your organization to see which detection rules are
available to identify specific techniques.

The primary purpose of the mapping is to provide visibility if your organization has
the necessary detection rules to identify when an alert or event is triggered as a
result of an attack by an adversary using a specific technique.

For example, view the following illustration that shows a list of the detection rules
mapped to various techniques. You can also view this information in [the MITRE-ATT\&CK navigator](https://www.servicenow.com/docs/BY9GrF5jowMrXEBCQ9bdHw#mitre-att-ck-heatmap-and-navigator "You can use the MITRE-ATT&CK heat map and navigator for basic navigation and to visualize your overall technique detection coverage.").

If you do not intend to use the base system SIEM auto-extraction rules, then enable
the automatic rollup of MITRE-ATT\&CK TTPs based on the detection rule
mapping. You can populate the alert or event rule that triggers the security
incident in the Alert Rule name field. You can also populate the Alert Rule name field by using SIEM integration, email parsing, manual creation,
etc. For more information, see [Rollup MITRE-ATT\&CK information from detection rules](https://www.servicenow.com/docs/BIc2rgLqqNl~83uu6pE2yg "Enable rollup of MITRE-ATT&CK information from the detection rules to the security incidents for better security incident and threat analysis.").  
Note:  
The detection rules feature has been updated to include mapping a single tactic
to multiple techniques. Previously, you could map a single tactic with a single
technique. If you are upgrading the Threat Intelligence plugin from
version 12.0.4 to a higher version, then review the following points before
using the detection rules in MITRE-ATT\&CK module.  
* You find multiple records merged into a single record if the fields - rule name, alert sensor, source, category, subcategory, and MITRE-ATT\&CK tactic are common.
* The old records are marked as true in the deprecated column and false in the active column.
* The new merged records are available for use and are marked as false in the deprecated column and true in the active column.
* After you verify the upgrade, and view that all your detection rules are successfully migrated, you can delete the old records that are marked as true in the deprecated column.
{#create-detection-rules__ul_b5c_ptz_5rb}

## Procedure

1. Navigate to AllThreat IntelligenceMITRE ATT\&CK AdministrationDetection Rules - MITRE ATT\&CK Mappings.
2. Use one of the following methods to create your detection rule:  
   Method 1: Manually create detection rules.
   1. Click New and on the form, fill in the fields.{#create-detection-rules__table_t2v_3ds_wnb__entry__2}

      | Field | Description |
      |-|-|
      | Rule Name | Detection rule's name. |
      | MITRE-ATT\&CK Tactic | Relevant MITRE-ATT\&CK tactic. |
      | MITRE-ATT\&CK Techniques | Relevant MITRE-ATT\&CK technique. You can select multiple techniques for a single tactic. |
      | Source | Source of the security incident, such as email, firewall, network monitoring, and so on. |
      | Alert Sensor | Security integration through which you ingest the alert or event data such as CarbonBlack, CrowdStrike, McAfee, and so on. |
      | Subcategory | Subcategory that further defines the issue. |
      | Category | Category that identifies the type of security issue. |
      | MITRE-ATT\&CK Technique | Relevant MITRE-ATT\&CK technique. You can select multiple techniques for a single tactic. |
      | Security Incident Count | The number of security incidents that the techniques are appended to. This count appears when you have enabled the roll up of MITRE-ATT\&CK information automatically from alert rules to security incidents. |
      | Deprecated | The detection rule mapping is deprecated. |
      | Active | Option to specify if the detection rule is active and deployed in your environment. |
      [Table 1. Detection Rules - MITRE-ATT\&CK Mapping]

      {#create-detection-rules__table_t2v_3ds_wnb}

   2. Click Submit.

   {#create-detection-rules__ul_vnm_qfs_wnb} Method 2: Import and create detection rules.
   1. Right-click the Rule Name column header.
   2. From the list, click Import.
   3. Click Create Excel template.
   4. Click Download after the export completes. An excel template with the filename sn_ti_alert_rules_mitre_attack_technique_mapping is downloaded to your computer.

      In the following illustration, you see how to export the
      excel template, fill the details in the spreadsheet, upload the
      file, preview the fields, and import it back to the ServiceNow AI Platform.
   5. Open the spreadsheet, select the second sheet tab, and review what you entered. On the form, fill in the fields and then, save your file.{#create-detection-rules__table_v4k_rj5_rsb__entry__2}

      | Field | Description |
      |-|-|
      | Rule Name | Detection rule name. |
      | Active | Option to specify if the detection rule is active and deployed in your environment. |
      | Alert Sensor | Security integration through which you ingest the alert or event data such as CarbonBlack, CrowdStrike, McAfee, and so on. |
      | Category | Category that identifies the type of security issue. |
      | Comments | Description about the detection rule. |
      | Deprecated | The detection rule mapping is deprecated. |
      | MITRE-ATT\&CK Technique IDs | MITRE-ATT\&CK technique ID, such as T1546.008, for Accessibility Features. |
      | MITRE-ATT\&CK Tactic ID | MITRE-ATT\&CK tactic ID, such as TA0003, for Persistence. |
      | Security Incident Count | The number of security incidents that the techniques are appended to. This count appears when you have enabled the roll up of MITRE-ATT\&CK information automatically from alert rules to security incidents and the detection rule is active. |
      | Source | Source of the security incident, such as email, firewall, network monitoring, and so on. |
      | Subcategory | Subcategory that further defines the issue. |
      | MITRE-ATT\&CK Tactic | Relevant MITRE-ATT\&CK tactic. |
      | MITRE-ATT\&CK Technique | Relevant MITRE-ATT\&CK technique. |
      [Table 2. Import template]

      {#create-detection-rules__table_v4k_rj5_rsb}

      The following illustration shows the spreadsheet template.
      The required fields are highlighted in red - Rule Name, MITRE-ATT\&CK Tactic ID, and MITRE-ATT\&CK
      Technique ID.

   6. Click Choose file and select the spreadsheet on your computer.
   7. Click Upload.
   8. Click Preview Imported Data.
   9. Preview the mappings and click Complete Import.

      The following illustration shows how to upload
      the spreadsheet, preview the data, review any errors, and complete
      the detection rule mapping import process.

   {#create-detection-rules__ol_t4k_rj5_rsb}
**Related concepts**   

* [Auto-extract technique rules for importing MITRE-ATT\&CK information](https://www.servicenow.com/docs/eYGE1Uu1pdpn8sAzyt8WJA#auto-extract-technique-rules "Use the base system auto-extraction rules to import the MITRE-ATT&CK information from any existing third-party integrations.")  
**Related tasks**   

* [Set up the MITRE-ATT\&CK framework](https://www.servicenow.com/docs/Ld7f25ZcgWw7PdriP0K3jA "Activate the MITRE-ATT&CK profile, and set up a scheduled job so that you can set up MITRE-ATT&CK collections for threat detection in your organization.")
* [Manage matrices](https://www.servicenow.com/docs/yws2nKfjlanumWOVNq9rig "Manage the matrices that have been imported from the MITRE TAXII collections. Matrices are a collection of tactics and techniques. You can view the matrices to review if your collections are available in the MITRE-ATT&CK repository.")
* [Manage techniques](https://www.servicenow.com/docs/f5UTJ9u0heSamMptkLqrVA "Manage the techniques that have been imported from the MITRE TAXII collections. The techniques contain various ways attackers have developed to employ a given tactic. You can review and deactivate techniques that are not relevant to your organization. In STIX, techniques are known as attack patterns.")
* [Manage mitigations](https://www.servicenow.com/docs/_ehLNpEZhnog4q3cucInXQ "Manage the mitigations that have been imported from the MITRE TAXII collections. Mitigations enable you to prevent an adversary from successfully executing techniques or sub-techniques against your organization. In STIX, mitigations are known as course of actions.")
* [Manage groups](https://www.servicenow.com/docs/L5wKoVXDZ6w225rn_~Tmwg "Manage the groups that have been imported from the MITRE TAXII collections. Groups are sets of related intrusion activity that are tracked by a common name in the security community. Analysts track clusters of activities using various terms such as threat groups, activity groups, threat actors, intrusion sets, and campaigns. In STIX, groups are known as intrusion sets.")
* [Manage malware](https://www.servicenow.com/docs/0HJ6OpkySaP_HrjJt8WeDA "Manage the malware information that you imported from the MITRE TAXII collections. Malware is a type of TTP that represents malicious code. It refers to a program that is covertly inserted into a system. The intent of a malware is to compromise the confidentiality, integrity, or availability of the victim's data, applications, or operating system (OS).")
* [Manage tools](https://www.servicenow.com/docs/kp0uesuQlslbugXzjZBLpg "Manage the tools information that you imported from the MITRE TAXII collections. Tools are legitimate software that are used by threat actors to perform attacks.")
* [Manage MITRE relationships](https://www.servicenow.com/docs/B19p8SZYczeNZOJwKJ4_Ag "Manage the MITRE relationships information that you imported from the MITRE TAXII collections.")
* [Manage CVE and technique mapping](https://www.servicenow.com/docs/ziAfSeIttOd8APCvnuMVoA "Manage the CVE and technique information that is mapped after you import the MITRE TAXII collections.")
* [Extend the MITRE-ATT\&CK data](https://www.servicenow.com/docs/VNeFz9OVokfAR37udh7pjw "Extend the MITRE-ATT&CK repository data in the ServiceNow AI Platform by enriching it.")
* [Define the data source and detection tool mapping](https://www.servicenow.com/docs/nHqKoFCQ6kYWOBMAKDTLXw "Define the data source and detection tool mapping for MITRE-ATT&CK tactics and techniques. The data source mapping provides you with insight into the relevance and availability of the data sources and the detection tools for monitoring the data sources in your environment.")
* [Define the data source and data component mapping](https://www.servicenow.com/docs/E6JH7_cytds7nG~0c_tUuw "Use the Data Component Mapping if you are using the latest TAXII collections, and you want to maintain a relationship between the data sources, data components, and the various techniques. Map the data sources with the additional context of data components that provides an extra sublayer of context to data sources that enable you to understand adversary behaviors in MITRE-ATT&CK better.")
* [Define the technique detection coverage](https://www.servicenow.com/docs/2Wk9PxgJ~bK7LejpeZJzig "Define the technique detection coverage that your organization must measure and detect specific adversary techniques.")
* [Map your technique detection coverage to a technique](https://www.servicenow.com/docs/4mNj12D~vHdVEbNa~gxZmQ "Map your overall technique detection coverage with the technique that enables your organization to detect specific adversary techniques.")
* [Define the mitigation coverage](https://www.servicenow.com/docs/HxGcw6gKrVCHpIkPq6b0kg "Define the mitigation coverage for each mitigation that is associated with a technique so that you gain visibility into how well your organization can prevent the attacks that happen due to a particular technique.")
* [Map your mitigation coverage to a technique](https://www.servicenow.com/docs/NgsJPVMAGr2jIP~EMAk6hQ "Map your mitigation coverage with the technique that enables you to detect your organization's overall mitigation strategy.")
* [Review threat group and MITRE-ATT\&CK techniques mapping](https://www.servicenow.com/docs/AyZBwl7rzJRlh_SW3K1HCg "Review the threat group and techniques object to object relationship mapping information that is imported from the MITRE TAXII collections. This mapping enables you to view the technique group and the corresponding technique mapping.")
* [Threat group to technique heatmap definition](https://www.servicenow.com/docs/CBvilbs0meywww7eXCfjew "Define the threat group to technique heatmap definition so that on the heatmap you can measure and detect the attack patterns that threat groups are using to attack your organization. The probability of an attack using a particular technique increases when you have a high number of attackers.")
* [Review the MITRE-ATT\&CK system properties](https://www.servicenow.com/docs/ssnQTt~FrjjemkHHqY74zA "Review the MITRE-ATT&CK system property values.")  
**Related reference**   

* [Get started with MITRE-ATT\&CK framework](https://www.servicenow.com/docs/JOQ_rN~TGjQVQGIY5GMuSg "Review the following information before you start setting up your MITRE-ATT&CK framework.")
* [Understand the MITRE to STIX data model](https://www.servicenow.com/docs/qUf~MpAS~74tQzL~8IKsoA "Review the terminology used by MITRE and STIX to efficiently use and understand the MITRE-ATT&CK framework in the ServiceNow AI Platform.")
* [Domain separation and MITRE-ATT\&CK](https://www.servicenow.com/docs/xGRYn1BZb3JFv4_e1saNNg "This domain separation overview pertains to MITRE-ATT&CK. Domain separation allows you to separate data, processes, and administrative tasks into logical groupings called domains. You can then control several aspects of this separation, including which users can see and access data.")

*[\>]: and then