---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Rollup MITRE-ATT\&CK information using Threat Lookup results

# Rollup MITRE-ATT\&CK information using Threat Lookup results {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
If you have not enabled automatic rollup of MITRE-ATT\&CK information, you
can do this manually.

## Before you begin

Role required: sn_si.analyst

## About this task

If you have enabled [automatic roll up of MITRE-ATT\&CK information from Threat Lookup results](https://www.servicenow.com/docs/w1Vgqo6m4i9ZMj1HsMRQkg "Review the MITRE-ATT&CK system property values.") to security incident, then the information is automatically rolled up. If you have not enabled automatic rollup, you can do this manually.

## Procedure

1. Navigate to AllSecurity IncidentsShow All Incidents.
2. Select the security incident that you want to enrich with the MITRE-ATT\&CK information.
3. Select Show All Related Lists and the Threat Lookup Results tab.
4. Select the observable and then from the Actions menu, select Roll up MITRE ATT\&CK Information to SI.  
   You can select multiple observables and rollup the information.
5. Select Reload to confirm the changes.  
   You can view the MITRE-ATT\&CK Card to confirm that the Threat Lookup results have been rolledup to the security incident.
**Related concepts**   

* [MITRE-ATT\&CK heat map and navigator](https://www.servicenow.com/docs/VRnjqjSHICBggygx0omrkA#mitre-att-ck-heatmap-and-navigator "You can use the MITRE-ATT&CK heat map and navigator for basic navigation and to visualize your overall technique detection coverage.")
* [Using the MITRE-ATT\&CK dashboard](https://www.servicenow.com/docs/imunAQ_IeggrtvWlWddKEw#mitre-dashboards "The MITRE-ATT&CK dashboard provides an executive view of the data source coverage, tactics, and techniques that are used in your organization.")  
**Related tasks**   

* [Associate MITRE-ATT\&CK information with security incidents](https://www.servicenow.com/docs/J3z4piiw4XfDN0sHmTmUlw#associate-mitre-with-sir "Associate the MITRE-ATT&CK tactics and techniques to the security incident for better security incident and threat analysis.")
* [Associate MITRE-ATT\&CK information with observables](https://www.servicenow.com/docs/OFTiAqgRV6uKVG2hbJBVWg "Associate MITRE-ATT&CK tactics and techniques to an observable for better security incident and threat analysis at a granular level.")
* [Associate MITRE-ATT\&CK information with security case](https://www.servicenow.com/docs/vR0MxG6Hmr3ZC~hcuvahbg "Associate MITRE-ATT&CK tactics and techniques to a security case for better security case management and threat analysis at a granular level.")
* [Rollup MITRE-ATT\&CK information from detection rules](https://www.servicenow.com/docs/VlfxcmUxRdd_cpzNcHN1TA "Enable rollup of MITRE-ATT&CK information from the detection rules to the security incidents for better security incident and threat analysis.")
* [Rollup MITRE-ATT\&CK information from child security incidents](https://www.servicenow.com/docs/Ojj0100Xlq4DON4dNamzMQ "If you have not enabled automatic rollup of MITRE-ATT&CK information or MITRE ATLAS information, you can do this manually.")
* [Perform link analysis and threat hunting using MITRE-ATT\&CK specific filters](https://www.servicenow.com/docs/AGX_TGwRVFohiU0FJYsdlA "Correlate and perform link analysis of observables, security incidents, and MITRE-ATT&CK related information so that your organization can start hunting for threats.")

*[\>]: and then