Rollup MITRE-ATT&CK information from child security incidents

  • 릴리스 버전: Australia
  • 업데이트 날짜 2026년 03월 12일
  • 소요 시간: 2분

    • If you have not enabled automatic rollup of MITRE-ATT&CK information, you can do this manually.

    시작하기 전에

    Role required: sn_si.analyst

    이 태스크 정보

    If you have enabled automatic roll up of MITRE-ATT&CK information from child security incidents, then the information is automatically rolled up. If you have not enabled automatic rollup, you can do this manually.

    프로시저

    1. Navigate to All > Incidents > Show All Incidents.
    2. Select the parent security incident that you want to enrich with the child MITRE-ATT&CK information.
    3. Click Show All Related Lists and the Child Security Incidents tab.
    4. Select the child security incident and then from the Actions menu, click Roll up MITRE ATT&CK Information to SI.
      You can click Show MITRE ATT&CK information to view the child security incident's MITRE information before you roll up the MITRE ATT&CK information.
    5. Click Reload to confirm the changes.
    6. Click the MITRE ATT&CK Card to view the origin of techniques.
      The following illustration shows how to select child security incident and roll up the MITRE-ATT&CK information to the parent security incident.This illustration shows how to roll up MITRE informtion from a child security incident to a parent security incident.

      You can view the MITRE-ATT&CK Card to confirm that the child security incident MITRE-ATT&CK information has been rolled up to the parent security incident.