---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# MITRE ATLAS framework

# MITRE ATLAS framework {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
The MITRE ATLAS framework documents adversarial tactics and techniques targeting AI (artificial intelligence) and ML (machine learning) systems, complementing traditional IT security frameworks.

## Framework overview {#about-mitre-atlas__section_about_mitre_atlas_overview}

The MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) framework provides a structured knowledge base for understanding and defending against attacks on AI and ML
systems.

It complements the MITRE-ATT\&CK framework, which documents threats to traditional IT infrastructure.  
Note:  
AI systems may produce inaccurate results. Implement human review processes when working with AI-generated data.

## Integration with Security Operations {#about-mitre-atlas__section_about_mitre_atlas_secops}

MITRE ATLAS techniques and tactics are ingested, viewed, and associated with security incidents using the same MITRE-ATT\&CK Repository, MITRE-ATT\&CK Card, and association workflow as MITRE-ATT\&CK.

MITRE ATLAS is distinguished from MITRE-ATT\&CK by an AML-prefixed technique or tactic ID.

For example, a technique ID might be `AML.T0000`, and a tactic ID might be `AML.TA0002`.

Technique names can collide between the two frameworks, so the ID is the reliable indicator. There is no separate object type for MITRE ATLAS.

For setup steps, see [Activate the MITRE ATLAS framework](https://www.servicenow.com/docs/R1DeMQ1vBXhJoIfgR0c5GQ "Activate the MITRE ATLAS profile to ingest MITRE ATLAS data for threat detection in AI and machine learning systems.").

## TAXII collection {#about-mitre-atlas__section_about_mitre_atlas_collection}

Unlike MITRE-ATT\&CK, which exposes three TAXII collections (Enterprise, Mobile, and ICS), MITRE ATLAS exposes only one TAXII collection ("ATLAS").

## STIX object mapping {#about-mitre-atlas__section_about_mitre_atlas_stix_mapping}

MITRE ATLAS techniques and tactics are ingested using the same STIX object types as MITRE-ATT\&CK (for example, Attack Pattern for techniques and Course of Action for mitigations).

The Data Source and Detection fields available for MITRE-ATT\&CK techniques are not populated for MITRE ATLAS techniques.