---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Review revoked pairs

# Review revoked MITRE tactic and technique associations {#ariaid-title1}

Release version: Australia  
Updated August 14, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Review the tactic and technique pairs that MITRE no longer maps, then delete or remap the entity and case associations that were created from them.

## Before you begin

Role required: sn_sec_tisc.analyst

## About this task

A MITRE ATT\&CK release may revoke a technique or remove a technique-to-tactic mapping. When this occurs, the next MITRE ingestion retires the tactic and technique link, along with all entity and case associations built
from it. Retirement is a soft delete. If MITRE restores a pair in a later release, the pair is reinstated automatically.

Retired associations no longer appear on the MITRE ATT\&CK canvas, on the technique cards, or in the MITRE reports. The associations themselves remain on the entity and case records
until you act on them from the review list.  
Note:  
A review record is created only when at least one entity or case association was built from the revoked pair. If nothing was ever derived from the pair, there is nothing to review
and no record appears.

## Procedure

1. Navigate to WorkspacesThreat Intelligence Security CenterThreat Intel LibraryMITRE ATT\&CKRevoked Tactic-Techniques.  
   The list displays the revoked pairs that have a status of Review, In Progress, or Error. The pairs with the status of Complete move out of the list.
2. Select a record to open it, and review the Review Reason and Revoked Collection Version values.  
   Review Reason distinguishes the two ways a pair can be revoked. Either the technique itself was revoked in the MITRE collection, or the technique is no
   longer mapped to this tactic. For a description of every field on the record, see [Revoked MITRE tactic-technique review fields](https://www.servicenow.com/docs/4WFu05mYFSfYpNqQ0MWkvA "Fields on the review record that MITRE ingestion creates for a revoked tactic and technique pair, and the values that each field can hold.").
3. Review the Entity Associations and Case Associations related lists.  
   These lists show the entity and case records that the pair produced, so that you can see the full scope of an action before you run it.
4. To remove every association that the pair produced, select Delete Associations.  
   The pair is removed from the entity, entity source, and case association records within the domain of the review record. Action Taken is set to
   Delete.  
   Warning:  
   Deleting the associations can't be undone. Nothing is removed until you run this action.
5. To move the associations onto a different pair instead, select Re-Map Associations.
   1. Select the new tactic.
   2. Select the new technique.  
      Only pairs that MITRE currently maps are offered, so you can't remap onto another revoked pair.
   3. Select Submit.  
      Every entity and case association moves to the pair that you selected. Where the target association already exists on a record, the retired association is removed
      rather than duplicated. Action Taken is set to Update mapping, and the pair that you selected is recorded in
      New Tactic and New Technique.
   {#tisc-review-revoked-mitre-associations__substeps_remap}
{#tisc-review-revoked-mitre-associations__steps_revoked_review}

## Result

Both actions run in the background. The status of the review record moves from Review to In Progress and then to
Complete, and the requested action is recorded in the work notes of the record. Values on the review record change only through the two actions.

## What to do next

To clear a completed record from the worklist, open it and select Delete. This action is available only on completed records, and it requires the sn_sec_tisc.admin role.
* **[Revoked MITRE tactic-technique review fields](https://www.servicenow.com/docs/4WFu05mYFSfYpNqQ0MWkvA)**   
  Fields on the review record that MITRE ingestion creates for a revoked tactic and technique pair, and the values that each field can hold.

**Related concepts**   

* [MITRE-ATT\&CK repository](https://www.servicenow.com/docs/ku1Y8HlYCrL_WVXzCVI5aw "The MITRE-ATT&CK repository stores MITRE data separately from Threat Intel Library data in the Intelligence Library.")  
**Related reference**   

* [Revoked MITRE tactic-technique review fields](https://www.servicenow.com/docs/4WFu05mYFSfYpNqQ0MWkvA "Fields on the review record that MITRE ingestion creates for a revoked tactic and technique pair, and the values that each field can hold.")

*[\>]: and then