---
sourceDocument: Yokohama Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/security-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Auto-extract technique rules for importing MITRE-ATT\&CK information

# Auto-extract technique rules for importing MITRE-ATT\&CK information {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read

Use the base system auto-extraction rules to import the MITRE-ATT\&CK
information from any existing third-party integrations.
**Related tasks**   

* [Set up the MITRE-ATT\&CK framework](https://www.servicenow.com/docs/Ld7f25ZcgWw7PdriP0K3jA "Activate the MITRE-ATT&CK profile, and set up a scheduled job so that you can set up MITRE-ATT&CK collections for threat detection in your organization.")
* [Manage matrices](https://www.servicenow.com/docs/yws2nKfjlanumWOVNq9rig "Manage the matrices that have been imported from the MITRE TAXII collections. Matrices are a collection of tactics and techniques. You can view the matrices to review if your collections are available in the MITRE-ATT&CK repository.")
* [Manage techniques](https://www.servicenow.com/docs/f5UTJ9u0heSamMptkLqrVA "Manage the techniques that have been imported from the MITRE TAXII collections. The techniques contain various ways attackers have developed to employ a given tactic. You can review and deactivate techniques that are not relevant to your organization. In STIX, techniques are known as attack patterns.")
* [Manage mitigations](https://www.servicenow.com/docs/_ehLNpEZhnog4q3cucInXQ "Manage the mitigations that have been imported from the MITRE TAXII collections. Mitigations enable you to prevent an adversary from successfully executing techniques or sub-techniques against your organization. In STIX, mitigations are known as course of actions.")
* [Manage groups](https://www.servicenow.com/docs/L5wKoVXDZ6w225rn_~Tmwg "Manage the groups that have been imported from the MITRE TAXII collections. Groups are sets of related intrusion activity that are tracked by a common name in the security community. Analysts track clusters of activities using various terms such as threat groups, activity groups, threat actors, intrusion sets, and campaigns. In STIX, groups are known as intrusion sets.")
* [Manage malware](https://www.servicenow.com/docs/0HJ6OpkySaP_HrjJt8WeDA "Manage the malware information that you imported from the MITRE TAXII collections. Malware is a type of TTP that represents malicious code. It refers to a program that is covertly inserted into a system. The intent of a malware is to compromise the confidentiality, integrity, or availability of the victim's data, applications, or operating system (OS).")
* [Manage tools](https://www.servicenow.com/docs/kp0uesuQlslbugXzjZBLpg "Manage the tools information that you imported from the MITRE TAXII collections. Tools are legitimate software that are used by threat actors to perform attacks.")
* [Manage MITRE relationships](https://www.servicenow.com/docs/B19p8SZYczeNZOJwKJ4_Ag "Manage the MITRE relationships information that you imported from the MITRE TAXII collections.")
* [Manage CVE and technique mapping](https://www.servicenow.com/docs/ziAfSeIttOd8APCvnuMVoA "Manage the CVE and technique information that is mapped after you import the MITRE TAXII collections.")
* [Extend the MITRE-ATT\&CK data](https://www.servicenow.com/docs/VNeFz9OVokfAR37udh7pjw "Extend the MITRE-ATT&CK repository data in the ServiceNow AI Platform by enriching it.")
* [Define the data source and detection tool mapping](https://www.servicenow.com/docs/nHqKoFCQ6kYWOBMAKDTLXw "Define the data source and detection tool mapping for MITRE-ATT&CK tactics and techniques. The data source mapping provides you with insight into the relevance and availability of the data sources and the detection tools for monitoring the data sources in your environment.")
* [Define the data source and data component mapping](https://www.servicenow.com/docs/E6JH7_cytds7nG~0c_tUuw "Use the Data Component Mapping if you are using the latest TAXII collections, and you want to maintain a relationship between the data sources, data components, and the various techniques. Map the data sources with the additional context of data components that provides an extra sublayer of context to data sources that enable you to understand adversary behaviors in MITRE-ATT&CK better.")
* [Define the technique detection coverage](https://www.servicenow.com/docs/2Wk9PxgJ~bK7LejpeZJzig "Define the technique detection coverage that your organization must measure and detect specific adversary techniques.")
* [Map your technique detection coverage to a technique](https://www.servicenow.com/docs/4mNj12D~vHdVEbNa~gxZmQ "Map your overall technique detection coverage with the technique that enables your organization to detect specific adversary techniques.")
* [Define the mitigation coverage](https://www.servicenow.com/docs/HxGcw6gKrVCHpIkPq6b0kg "Define the mitigation coverage for each mitigation that is associated with a technique so that you gain visibility into how well your organization can prevent the attacks that happen due to a particular technique.")
* [Map your mitigation coverage to a technique](https://www.servicenow.com/docs/NgsJPVMAGr2jIP~EMAk6hQ "Map your mitigation coverage with the technique that enables you to detect your organization's overall mitigation strategy.")
* [Create and map detection rules](https://www.servicenow.com/docs/GJQNkvR4BsJndl7s_OJonQ "Create detection rules and map them against the tactics and techniques. With this mapping, you can see the coverage for the detection rules in your organization.")
* [Review threat group and MITRE-ATT\&CK techniques mapping](https://www.servicenow.com/docs/AyZBwl7rzJRlh_SW3K1HCg "Review the threat group and techniques object to object relationship mapping information that is imported from the MITRE TAXII collections. This mapping enables you to view the technique group and the corresponding technique mapping.")
* [Threat group to technique heatmap definition](https://www.servicenow.com/docs/CBvilbs0meywww7eXCfjew "Define the threat group to technique heatmap definition so that on the heatmap you can measure and detect the attack patterns that threat groups are using to attack your organization. The probability of an attack using a particular technique increases when you have a high number of attackers.")
* [Review the MITRE-ATT\&CK system properties](https://www.servicenow.com/docs/ssnQTt~FrjjemkHHqY74zA "Review the MITRE-ATT&CK system property values.")  
**Related reference**   

* [Get started with MITRE-ATT\&CK framework](https://www.servicenow.com/docs/JOQ_rN~TGjQVQGIY5GMuSg "Review the following information before you start setting up your MITRE-ATT&CK framework.")
* [Understand the MITRE to STIX data model](https://www.servicenow.com/docs/qUf~MpAS~74tQzL~8IKsoA "Review the terminology used by MITRE and STIX to efficiently use and understand the MITRE-ATT&CK framework in the ServiceNow AI Platform.")
* [Domain separation and MITRE-ATT\&CK](https://www.servicenow.com/docs/xGRYn1BZb3JFv4_e1saNNg "This domain separation overview pertains to MITRE-ATT&CK. Domain separation allows you to separate data, processes, and administrative tasks into logical groupings called domains. You can then control several aspects of this separation, including which users can see and access data.")

## Use threat-lookup auto-extraction rules {#ariaid-title2}

Use the threat lookup auto-extraction rules to import the MITRE-ATT\&CK
information from any existing Threat Intelligence third-party
integrations.

### Before you begin

Role required:

* sn_ti.admin, sn_si.admin: create, write, delete access
* sn_ti.read: read access
{#threat-lookup-auto-extraction__ul_kg3_lwl_wnb}

### About this task

When any Threat Intelligence integration, such as Sandbox or a TIP, supports
the MITRE-ATT\&CK framework and if the MITRE-ATT\&CK
information is parsed at each integration level, then the information is displayed
in each threat lookup result record. However, not all Threat Intelligence
integrations parse the MITRE-ATT\&CK information. The threat lookup
global auto-extraction rule can extract MITRE-ATT\&CK information from
all Threat Intelligence integrations.

You can choose to roll up the MITRE-ATT\&CK information automatically from
the threat lookup results to a security incident. For automatic rollup of threat
lookup results to security incidents, [enable the system
property](https://www.servicenow.com/docs/ssnQTt~FrjjemkHHqY74zA "Review the MITRE-ATT&CK system property values."). Alternatively, you can [rollup the information
manually](https://www.servicenow.com/docs/PJrSILm1OxeTCGXqsfFDrQ "Associate MITRE-ATT&CK tactics and techniques to an observable for better security incident and threat analysis at a granular level.") for each individual threat lookup.

The base system Threat Intelligence automatically extracts the MITRE-ATT\&CK information from the third-party integrations raw payload
to the threat lookup result record, if the Threat Intelligence integration
provides you with MITRE-ATT\&CK information like the technique or
tactic.

If the MITRE-ATT\&CK information is not available in the raw payload field
of the threat lookup record, then you must define your own rule for auto-extraction
from the third-party integration.

### Procedure

1. Navigate to AllThreat IntelligenceMITRE ATT\&CK AdministrationTechnique Extraction Rule.
2. Click New.
3. On the form, fill in the fields.  
   {#threat-lookup-auto-extraction__table_o41_d3t_wnb__entry__2}

   | Field | Description |
   |-|-|
   | Name | Auto-extraction rule name. |
   | Rule Type | Auto-extraction rule type. Select Threat Lookup. |
   | Ignore Auto-Extraction | Setting that by default, is cleared. This setting enables automatic extraction of MITRE-ATT\&CK techniques. |
   | Source Engine | If a value is specified in this field, then the rule will be applied exclusively to the threat lookup results that include the specified source engine in the source engine field. |
   | Global | Source engine setting. When you set the source engine to Global, the extraction runs on all threat lookup integration results. |
   | Description | Description of the auto-extraction rule. |
   | Process Method | Regex or a script method that you specify to link the technique information from the raw payload. |
   | Regex Extraction | Option that you specify for the Target Field when using the regex extraction method. Regex is the default. |
   | Script Extraction | Process that you select when running a script. The script reviews the following: * threatLookupResultSysId:sys_id of the threat lookup result record * sourceName: Name of the threat lookup source. {#threat-lookup-auto-extraction__ul_cbr_4kt_wnb} |
   | Tactic Extraction | Option that you specify to extract tactic related information from the raw payload. If a payload contains specific tactic and technique related information, you can extract and append the information to the security incident. |
   [Table 1. Technique Extraction Rule form]

   {#threat-lookup-auto-extraction__table_o41_d3t_wnb}
4. Click Submit.

## Use SIEM auto-extraction rules {#ariaid-title3}

Use the SIEM auto-extraction rules to import the MITRE-ATT\&CK information
from any existing Security Operations SIEM third-party integrations.

### Before you begin

Role required:

* sn_ti.admin, sn_si.admin: create, write, delete access
* sn_ti.read: read access
{#siem-auto-extraction__ul_kg3_lwl_wnb}

### About this task

The technique extraction rule is available for all base system Security Operations SIEM integrations such as Splunk, IBM QRadar, and ArcSight integrations. When the ServiceNow AI Platform ingests alert or event data from these SIEM integrations and they contain MITRE-ATT\&CK information, the ServiceNow AI Platform processes the raw payload and auto-extracts the MITRE-ATT\&CK information.

If your ServiceNow AI Platform contains base
system SIEM integrations, that means that the technique extraction rules are already
created in the MITRE-ATT\&CK module. You should review and modify the
rules as needed.

Enable either the SIEM auto-extraction rule or the alert rule
at a time.

### Procedure

1. Navigate to AllThreat IntelligenceMITRE ATT\&CK AdministrationTechnique Extraction Rule.
2. Click New.
3. On the form, fill in the fields.  
   {#siem-auto-extraction__table_o41_d3t_wnb__entry__2}

   | Field | Description |
   |-|-|
   | Name | Auto-extraction rule name. |
   | Rule Type | Auto-extraction rule type. Select SIEM. |
   | Ignore Auto-Extraction | Setting that by default is cleared. This setting enables automatic extraction of MITRE-ATT\&CK techniques. |
   | Import Table | Import table that is automatically mapped for base system SIEM integrations. Review this field for other SIEM integrations for the MITRE-ATT\&CK information and map accordingly. |
   | Import Field | Import field that is automatically mapped for base system SIEM integrations. Review this field for other SIEM integrations for the MITRE-ATT\&CK information and map accordingly. |
   | Description | Auto-extraction rule. |
   | Process Method | Regex or a script method that you specify to link the technique information from the raw payload. |
   | Regex Extraction | Option that you specify for the Target Field when using the regex method. Regex extraction is the default process method. |
   | Script Extraction | Script process method that you use if you want to customize how the MITRE-ATT\&CK information is extracted. |
   | Tactic Extraction | Option that you specify to extract tactic related information from the raw payload. If a payload contains specific tactic and technique related information, you can extract and append the information to the security incident. |
   [Table 2. Technique Extraction Rule form]

   {#siem-auto-extraction__table_o41_d3t_wnb}

   In the following illustration, you see an example of the Splunk Enterprise SIEM technique extraction rule in the form
   view. This rule is similar to all the other SIEM technique extraction
   rules.
4. Click Submit.

*[\>]: and then