---
sourceDocument: Yokohama Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/security-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# MITRE-ATT\&CK Repository

# MITRE-ATT\&CK Repository {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The MITRE-ATT\&CK repository is available under the Intelligence Library where the data from the MITRE sources are ingested.

The MITRE data that is coming to the repository is stored in a separate MITRE repository from Threat Intel Library data, where MITRE data isn't rolled up for aggregation or de-duplication flow and is independent.  
The available data sources within the application are:

1. MITRE - Enterprise ATT\&CK
2. MITRE - Mobile ATT\&CK
3. MITRE - ICS ATT\&CK
{#tisc-mitre-att-ck-framework-overview__ol_kd3_b1s_g1c}

The data for these sources are stored in a separate MITRE repository under TI library in the base system. In case, if you want to create a new MITRE source then configure a custom source. For more information, see [View Custom Feed](https://www.servicenow.com/docs/wpow_rMboqCdTd8mezQOEQ "View the custom feed that are shipped within the base system.") and in the form view click Advanced check box and select the Report Processor as: MITRECollectionDataProcessor.
* **[Manage Matrices](https://www.servicenow.com/docs/pPtIHJ1qCxjOnElqXaEChA)**   
  Manage the matrices that are imported from the MITRE TAXII collections. Matrices are a collection of tactics and techniques. You can view the matrices to review if your collections are available in the MITRE-ATT\&CK repository.
* **[Manage Techniques](https://www.servicenow.com/docs/Fond0J87PYOq5DdPrk4Qkg)**   
  Manage the techniques that are imported from the MITRE TAXII collections. The techniques contain various ways attackers have developed to employ a given tactic. You can review and deactivate techniques that are not relevant to your organization. In STIX, techniques are known as attack patterns.
* **[Manage Mitigations](https://www.servicenow.com/docs/ljFULvsH53cx1bCWNLmaOQ)**   
  Manage the mitigations that are imported from the MITRE TAXII collections. Mitigations enable you to prevent an adversary from successfully executing techniques or sub-techniques against your organization. In STIX, mitigations are known as course of actions.
* **[Manage Groups](https://www.servicenow.com/docs/s39yoOO_3kqesNue8pENcg)**   
  Manage the groups that are imported from the MITRE TAXII collections. Groups are sets of related intrusion activity that are tracked by a common name in the security community. Analysts track clusters of activities using various terms such as threat groups, activity groups, threat actors, intrusion sets, and campaigns. In STIX, groups are known as intrusion sets.
* **[Manage Malware](https://www.servicenow.com/docs/dQh1i18qDMFJV7Mr1ZSKvQ)**   
  Manage the malware information that you imported from the MITRE TAXII collections. It is a type of TTP that represents malicious code.
* **[Manage Tools](https://www.servicenow.com/docs/uFclS4LTZDHo6i4OO9t2JQ)**   
  Manage the tools information that you imported from the MITRE TAXII collections. Tools are legitimate software that are used by threat actors to perform attacks.
* **[Manage MITRE Relationships](https://www.servicenow.com/docs/EPbuNG3tkyo1s83hQ8~XjQ)**   
  Manage the MITRE relationships information that you imported from the MITRE TAXII collections.

**Related concepts**   

* [Observables](https://www.servicenow.com/docs/mtj0sOYtYVd9ZZ2fpM_hMg "Observables represent stateful properties (such as the MD5 hash of a file or the value of a registry key) or measurable events (such as the creation of a registry key or the deletion of a file) that are pertinent to the operation of computers and networks.")
* [Indicators](https://www.servicenow.com/docs/B69N6Wdc7W0nI0ks7FqyYA "Indicators are artifacts observed on a network or operating system that are likely to indicate an intrusion. Typical IoCs are virus signatures and IP addresses, MD5 hashes of malware files or URLs, or domain names.")
* [Threat Entities](https://www.servicenow.com/docs/_5DGFV0RjbonAf2KRyZj9g "The Threat Entities module provides structured records used to manage threat intelligence objects in the TISC. These records align with STIX domain object concepts and help standardize how threat activity is documented and analyzed.")
* [Other Objects](https://www.servicenow.com/docs/NqecVRly6M6WQnxqn9Ixkw "Define and manage data classifications within TISC.")
* [Vulnerability](https://www.servicenow.com/docs/mObzIXRkQGKQMcKeLtA7JQ "A Vulnerability is a weakness or defect in a software or hardware component that attackers exploit. Vulnerabilities apply for STIX 2.x.")
* [Working with Reports in TISC](https://www.servicenow.com/docs/hPkrs37a6HKieeOtSSJxKg "The Reports module in the Threat Intelligence Library section enables you to create, manage, and publish reports that use any intelligence available in the Threat Intelligence Library.")
* [Relationships Objects](https://www.servicenow.com/docs/Kffra0ZJbg3rrW_AS5wO_g "Use the relationships objects to link together two observables or an observable and SDO to explain how they relate to each other.")
* [Potential Relationships](https://www.servicenow.com/docs/dc1NAg3gI_TtywVl9FXRcg "The application uses automated correlation to establish potentially possible relationships between two SDOs, two Observables or an observable and SDO.")
* [Vulnerability relationship mapping](https://www.servicenow.com/docs/ibGmPhY7zIIuaKPXbv8OzA "Use many-to-many (M2M) relationship records to map connections between vulnerabilities and other entities.")  
**Related tasks**   

* [Define RSS Feeds](https://www.servicenow.com/docs/izYjMP8Xu6MPWNyfL5cJxw "A threat intelligence feed is a real time, continuous data stream that gathers information related to cyber risks or threats. RSS Feeds provides an easy way to stay up to date with your favorite websites, such as blogs or latest cyber security news.")