--- sourceDocument: Australia Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # MITRE attack and defend technique graph # MITRE attack and defend technique graph {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of MITRE attack and defend technique graph The MITRE attack and defend technique graph in ServiceNow Security Incident Response (SIR) provides security analysts with an interactive, hierarchical visualization of attack techniques, defense techniques, and related artifacts for a security incident. This graph helps analysts understand the full attack and defense landscape, facilitating deeper investigation and incident analysis. Show full answer Show less The graph is only visible when MITRE attack and defend data has been ingested into the system, appearing in the SIR workspace under the MITRE attack and defend technique tab. ## Graph Structure and Nodes * **SIR node (root):** Represents the Security Incident Response record, serving as the root of the graph. * **Attack technique nodes:** First or second-level nodes representing specific attack methods, labeled by source framework (MITRE-ATT\&CK or MITRE ATLAS) with distinct icons. * **Defend technique nodes:** First or second-level nodes representing defensive measures. * **Artifact nodes:** Second or third-level nodes connected to defend techniques, representing associated artifacts. Shared artifacts appear once with multiple connecting edges. Nodes at the same level may have cross-references, creating additional connections and enriching the visualization. ## Available Actions * **SIR node actions:** Display or associate attack and defend techniques with the incident. * **Attack technique node actions:** View details, show related defend techniques, and hide or restore nodes for customized views. * **Defend technique node actions:** View details, show related defend artifacts with labeled relationships, and hide or restore nodes. * **Graph-level actions:** Save the current graph state (including visibility and layout), refresh data to reflect backend updates, search and highlight specific nodes, and restore hidden nodes. * **Association actions:** Easily associate new attack or defend techniques via modal windows matching the MITRE-ATT\&CK interface, with options to save or cancel. ## Node Relationships and Edges The graph uses connecting lines (edges) to depict relationships: * Direct parent-child associations between nodes. * Shared artifact relationships linking single artifact nodes to multiple defend techniques. * Cross-level references connecting nodes at the same hierarchy level. * Edges between defend techniques and artifacts include labels specifying relationship types from MITRE-ATT\&CK data. ## Benefits for ServiceNow Customers This visualization enables security teams to: * Gain a comprehensive understanding of how attack techniques relate to defense measures and artifacts within incidents. * Interactively explore, associate, and manage MITRE-based techniques directly in the SIR workspace. * Customize views by hiding or highlighting nodes, saving preferences, and refreshing data to maintain accuracy. * Efficiently locate specific techniques or artifacts in complex graphs with search and highlight features. Overall, the MITRE attack and defend technique graph enhances investigation workflows by providing clear, actionable insights into the attack-defense dynamics of security incidents. The MITRE attack and defend technique graph provides security analysts with an interactive, node-based visualization of attack techniques, defense techniques, and associated artifacts for a security incident. ## MITRE attack and defend technique graph Overview {#mitre-attack-defend-graph-sir__section_kkx_1hc_yhc} The MITRE technique graphs enables analysts to explore relationships between security threats and defensive measures, helping them understand the complete attack and defense landscape for an incident. The graph uses a hierarchical structure with the SIR record as the root node, branching out to display attack techniques, defend techniques, and their associated artifacts. Analysts can interact with nodes to view details, establish associations, and manage the visibility of information based on their investigation needs. The visualization only appears when MITRE attack and defend technique data has been ingested into the system. Without ingested data, the MITRE attack and defend technique tab remains hidden from the SIR workspace. ## Graph structure {#mitre-attack-defend-graph-sir__section_cyf_zjc_yhc} The graph consists of the following node types arranged in a hierarchical structure: * SIR node (root): The central node representing the Security Incident Response record. * Attack technique nodes: First or second-level nodes representing specific attack methods. * Defend technique nodes: First or second-level nodes representing defensive measures. * Artifact nodes: Second or third level nodes representing specific artifacts related to defend techniques. {#mitre-attack-defend-graph-sir__ul_njc_nrd_yhc} Nodes at the same hierarchical level can have cross-references, creating connecting edges when the same node relates to multiple parent nodes. Attack technique nodes are labeled and iconized according to their source framework. The source framework is either MITRE-ATT\&CK or MITRE ATLAS. You can visually distinguish which framework a technique belongs to at a glance. ## Available actions {#mitre-attack-defend-graph-sir__section_obk_2kc_yhc} The graph provides different actions depending on the node type being interacted with. SIR node actions * Show attack technique: Display all attack techniques associated with the SIR. * Show defend technique: Display all defend techniques associated with the SIR. * Associate attack technique: Open a modal window to associate new attack techniques with the SIR. * Associate defend technique: Open a modal window to associate new defend techniques with the SIR. Attack technique node actions * Show details: Opens a panel displaying the details of the selected node. * Show defend techniques: Display all defend techniques associated with this specific attack technique. * Hide node: Temporarily remove a node from the graph view. A Show hidden nodes option becomes available to restore hidden nodes. Defend technique node actions * Show details: Opens a panel displaying the details of the selected node. * Show defend artifacts: Display all artifacts associated with the selected defend technique. Artifacts shared across multiple defend techniques appear as a single node with multiple connecting edges. Edge labels indicate the relationship between the defend technique and artifact. * Hide node: Temporarily remove the defend technique node from the graph view. A Show hidden nodes option becomes available to restore hidden nodes. {#mitre-attack-defend-graph-sir__ul_mgd_llc_yhc} Graph-level actions * Save: Preserve the current graph view state. Saved views persist when users return to the tab. Includes node visibility, expanded sections, and layout preferences. * Refresh: Update the graph with the latest data from the backend. Updates node labels if names have changed, removes associations that have been deleted from the backend, and displays newly associated techniques not currently visible in the graph. Maintains the saved view structure while refreshing the data. * Find on map: Search for specific nodes by name. Highlights and centers the selected node in the graph. Useful for locating nodes in complex graphs with many techniques. * Show hidden nodes: Restore all nodes that have been hidden from view. {#mitre-attack-defend-graph-sir__ul_abm_zqd_yhc} ## Association actions {#mitre-attack-defend-graph-sir__section_p1r_4lc_yhc} When associating attack or defend techniques: * Select technique: Choose from available techniques in the modal window. * Save association: Confirm and create the association. Newly associated nodes appear at the end of the graph. Use the Find on map function to locate newly added nodes. * Cancel: Close the modal without creating an association. The association modal uses the same interface experience as the MITRE-ATT\&CK technique functionality. ## Node relationships and edges {#mitre-attack-defend-graph-sir__section_dpk_qlc_yhc} The graph displays relationships between nodes using connecting lines (edges): * Direct associations: Lines connect parent nodes to their directly associated child nodes. * Shared relationships: When a defend artifact relates to multiple defend techniques, a single artifact node connects to multiple parent nodes via separate edges. * Cross-level references: When nodes at the same hierarchical level share relationships, connecting lines appear between them. * Edge labels: Labels on the edges between defend techniques and artifacts indicate the relationship type (sourced from MITRE-ATT\&CK data). {#mitre-attack-defend-graph-sir__ul_rkw_frd_yhc} **Related concepts** * [Security Incident Overview section](https://www.servicenow.com/docs/6yceUsy~r3iSEJ7DTJLzqw "The Overview section on the workspace presents the key information associated with the security incident.") * [Security Incident Details section](https://www.servicenow.com/docs/0t4Cl0AJwylqeTkve~aFiA "This section displays the security incident form fields that are rendered from the security incident classic UI.") * [SIR Workspace Orchestration](https://www.servicenow.com/docs/X7nsvDJeYY1Bnu338I1MIg "Security Incident Response Workspace orchestration activities will help the security analysts to view the investigation canvas and perform various actions that are applicable.") * [Security Incident Response Tasks](https://www.servicenow.com/docs/kQkQaQKkHJA88mCNui7JdA "All the response tasks associated with a security incident are displayed within the Response Tasks section.") * [Security Incident Response Other Records](https://www.servicenow.com/docs/Bcb9H3wXk8iGqp6PMiXWwQ#security-incident-response-other-records "This section displays the other records such as IT related records and email records. Under IT records, Incident, Change Request, Problem and Outages are displayed.") * [Security Incident Response Post Incident Review](https://www.servicenow.com/docs/sMFZi8oFyMaTZougxKKaGQ "Post incident review appears when an incident is moved to a Review state.") * [TISC integration within SIR Workspace](https://www.servicenow.com/docs/QzgG5SDXAgV~kQZJg_WphA "The following section includes information about the Threat Intelligence Security Center integration from within the SIR workspace context.") * [Reports in Security Incident Response](https://www.servicenow.com/docs/tBOHHBL3DC9OGClj19ClBA "All the reports associated with a security incident are available within the Reports section for analysis and sharing.") * [Collaborate using conference call or chat in Security Incident Response](https://www.servicenow.com/docs/OrJI18mS_ktHmjCOgaEq0Q "You can collaborate with analysts and affected users to resolve or discuss about an incident in Security Incident Response application.") * [Viewing incident details with a relationship graph](https://www.servicenow.com/docs/ajJ36vkdUXiqndCfWCZsxw "Relationship graphs in the Security Incident Response workspace visually display the connections between a security incident and its related items to help you analyze the full context of a security incident.") **Related tasks** * [Update information in security incident related records](https://www.servicenow.com/docs/NT0C1x0hmtn6DMBUF67v8w "Edit related records for a security incident in Security Incident Response Workspace directly from the Related Records tab without having to leave the current context.") * [View and filter the incident timeline](https://www.servicenow.com/docs/3B4vOJllZEBtYa29ohM7tg "View the chronological timeline of events for a security incident and filter by event type to focus on relevant activities.")