---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# View extracted MITRE ATT\&CK Techniques

# View extracted MITRE ATT\&CK Techniques {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of View extracted MITRE ATT\&CK Techniques

This documentation explains how ServiceNow's Threat Intelligence Security Center extracts and associates MITRE ATT\&CK techniques with various threat-related records such as observables, objects, threat lookups, observable enrichments, and RSS feeds.
The extraction process identifies relevant MITRE techniques from data fields and links them to entity records, enabling customers to analyze and track threat behaviors effectively within the platform.
Show full answer Show less  

## Technique Extraction for Observables and Objects

* Extraction rules apply when an observable or object source record is created, processing all applicable fields except date, number fields, Usage category, and Attack phases.
* Extracted MITRE techniques are linked to the entity source record and deduplicated when aggregated to the parent entity record.
* Users can view associated techniques by navigating to **Workspaces \> Threat Intelligence Security Center \> Threat Intel Library \> Observables**, selecting an observable, and accessing the MITRE Techniques section under Related Records.
* The Sources column shows all sources tied to the technique extraction for that entity, consolidating duplicates from multiple sources.
* For troubleshooting, the specific extraction rule used can be viewed in the Technique Source Relations list, adding the Extraction Rule column if not visible.

## Technique Extraction for Threat Lookups and Observable Enrichment

Extraction is performed on the raw data payload when threat lookup or observable enrichment results are created, triggered by respective actions. Only the rawdata field content is analyzed for MITRE technique extraction.

## Technique Extraction for RSS Feeds

* When RSS feed records are created or updated, extraction rules apply to all fields except date, number fields, and Attack phases.
* Extracted techniques are linked at the entity level rather than source level, with existing technique associations moved to entity-level records upon system upgrade.
* Techniques can be viewed by navigating to **Workspaces \> Threat Intelligence Security Center \> Threat Intel Library \> RSS Feeds \> All RSS Feeds**, selecting a feed, and checking the MITRE Techniques in Related Records.
* The extraction rule responsible for technique association can be examined for troubleshooting purposes.

## Important Notes on Technique Associations

* If no tactic ID is present in the extracted source or enrichment result, technique associations are created for all tactics linked to that technique in the MITRE repository.
* If a tactic ID is present, associations are limited to those specific tactics linked to the technique.
* Only tactic-technique pairs currently mapped by MITRE are associated; revoked or unmapped pairs are excluded from extraction and reporting.  
MITRE ATT\&CK Technique Extraction method describes how the extraction methods are performed and associated techniques are verified for observables, objects, and RSS feeds.

## View MITRE ATT\&CK techniques for Observables/ Objects {#mitre-extraction-method__section_dkv_g2v_cdc}

* The extraction rules for data sources (threat lookups are not applicable) are processed whenever an entity (for example, observable source or object source) source record gets created.
* The rules are applicable for any fields within the entity source record (except date, number fields, and Usage category and Attack phases).
* The extracted MITRE techniques are associated to the corresponding entity record and you view the records in the MITRE techniques related list in the Related Records tab.  
  Note:  
  The MITRE techniques are first extracted and associated to the entity source record then the techniques associations are de-duplicated and aggregated to the parent entity record.

{#mitre-extraction-method__ul_pcq_m2k_m3c}

To view the techniques for observables and objects:

1. Navigate to WorkspacesThreat Intelligence Security CenterThreat Intel LibraryObservables
2. Select any Observable record.
3. Go to Related Records tab.
4. Select MITRE Techniques section to view the extracted MITRE ATT\&CK techniques.
5. Click on the MITRE technique ID to view the MITRE technique association record. The Sources column displays all the sources (separated by a comma if there are one or more sources) which are associated to the entity source record on which the MITRE extraction is performed.  
   Note:  
   If the same tactic and technique IDs are extracted from multiple sources then only one tactic and technique association record is displayed and the Sources column displays all the extracted sources.
6. For troubleshooting, you can view the MITRE Extraction rule which was responsible for extraction of the tactic and technique associations by navigating to the Technique Source Relations.  
   Note:  
   Make sure to add the Extraction Rule column using the List Actions icon in case if you don't see the Extraction Rule column.

{#mitre-extraction-method__ol_ntr_h2v_cdc}

The extraction rules for threat lookups or observable enrichment are processed whenever the threat lookup observable enrichment result or observable enrichment record is record is created for any observable for which Run threat lookup or Run observable enrichment action is triggered and the extraction is performed only on the raw data (raw_data field) payload which is available in the threat lookup result or
observable enrichment record.

## View MITRE ATT\&CK techniques for RSS feeds {#mitre-extraction-method__section_q3f_pdk_m3c}

* Whenever an RSS feed record is created or updated, the MITRE ATT\&CK technique extraction rules are processed.
* The rules are applicable for any fields within the RSS feed record (except date, number fields, and Attack phases).
* The extracted MITRE techniques are associated to the corresponding RSS feed record and you can view these records in the MITRE techniques related records list in the Related Records section.
* The extracted techniques are stored as entity-level MITRE technique associations rather than source-level associations. When you upgrade, the technique associations that already exist on your RSS feed records are moved to the entity-level records.

{#mitre-extraction-method__ul_fx4_35q_m3c}

1. Navigate to WorkspacesThreat Intelligence Security CenterThreat Intel LibraryRSS FeedsAll RSS Feeds
2. Select any RSS feed record.
3. Go to Related Records tab.
4. Select MITRE Techniques to view the extracted MITRE ATT\&CK techniques.
5. Click on the MITRE technique ID to view the MITRE technique association record.
6. For troubleshooting, you can view the MITRE Extraction rule which was responsible for extraction of the tactic and technique associations.
{#mitre-extraction-method__ol_r3f_pdk_m3c} Note:  
* If there is no tactic ID present in the extracted entity (observable or object) source or threat lookup result for any MITRE ATT\&CK technique, then the technique associations are created for all the tactics that are associated to the corresponding technique in the MITRE repository.
* If there is any tactic ID present in the extracted entity (observable or object) source or threat lookup result for any MITRE ATT\&CK technique, then the technique associations is specifically created only for all that extracted tactic(s) that are associated to the corresponding technique in the MITRE repository.
{#mitre-extraction-method__ul_esd_sp1_n3c}  
Note:  
Technique associations are created only for the tactic and technique pairs that MITRE currently maps. A pair that MITRE has stopped mapping is excluded from the extraction results and from the counts on the MITRE ATT\&CK
framework. For more information, see [Review revoked MITRE tactic and technique associations](https://www.servicenow.com/docs/OmKCT5dod5kOcNQIW~OyGA "Review the tactic and technique pairs that MITRE no longer maps, then delete or remap the entity and case associations that were created from them.").

*[\>]: and then