---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Associate MITRE-ATT\&CK information with security case

# Associate MITRE-ATT\&CK information with security case {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Associate MITRE-ATT\&CK tactics and techniques to a security case for
better security case management and threat analysis at a granular level.

## Before you begin

Role required: sn_si.analyst

## Procedure

1. Navigate to AllThreat IntelligenceCase ManagementAll Cases.
2. Select the security case that you want to enrich with the MITRE-ATT\&CK information.
3. From the related list, select Associate MITRE ATT\&CK Technique.  
   In the following illustration, you can see how to navigate from the related list to Associate MITRE ATT\&CK Technique, review the source, and add a tactic and technique.
4. In the source lists, review the Source.
5. Review the Tactic and Techniques, and add or remove them based on the relevance with the case.
6. Select Save.  
   The tactics and techniques that you have added appear in the MITRE-ATT\&CK Card.
**Related concepts**   

* [MITRE-ATT\&CK heat map and navigator](https://www.servicenow.com/docs/2MoX9OwjjnE3fDmId7gNzw#mitre-att-ck-heatmap-and-navigator "You can use the MITRE-ATT&CK heat map and navigator for basic navigation and to visualize your overall technique detection coverage.")
* [Using the MITRE-ATT\&CK dashboard](https://www.servicenow.com/docs/xGJzR8fQT3dgBeeCMX0NSQ#mitre-dashboards "The MITRE-ATT&CK dashboard provides an executive view of the data source coverage, tactics, and techniques that are used in your organization.")  
**Related tasks**   

* [Associate MITRE-ATT\&CK information with security incidents](https://www.servicenow.com/docs/wQQLQNBf04SoT5jmxE~7aQ#associate-mitre-with-sir "Associate the MITRE-ATT&CK tactics and techniques to the security incident for better security incident and threat analysis.")
* [Associate MITRE-ATT\&CK information with observables](https://www.servicenow.com/docs/LhNsjWRNYAlchqkJRvNV7w "Associate MITRE-ATT&CK tactics and techniques to an observable for better security incident and threat analysis at a granular level.")
* [Rollup MITRE-ATT\&CK information using Threat Lookup results](https://www.servicenow.com/docs/Yi307jCAHP~HB3Q1Pz6BoA "If you have not enabled automatic rollup of MITRE-ATT&CK information, you can do this manually.")
* [Rollup MITRE-ATT\&CK information from detection rules](https://www.servicenow.com/docs/rSNMda6KHJZwDegoiqJ7gQ "Enable rollup of MITRE-ATT&CK information from the detection rules to the security incidents for better security incident and threat analysis.")
* [Rollup MITRE-ATT\&CK information from child security incidents](https://www.servicenow.com/docs/OFXVUbqFMNdIrGGzQCUajA "If you have not enabled automatic rollup of MITRE-ATT&CK information or MITRE ATLAS information, you can do this manually.")
* [Perform link analysis and threat hunting using MITRE-ATT\&CK specific filters](https://www.servicenow.com/docs/CfBEn1nxxzXGx4hwFcQI_A "Correlate and perform link analysis of observables, security incidents, and MITRE-ATT&CK related information so that your organization can start hunting for threats.")
* [Add artifacts to a case](https://www.servicenow.com/docs/82Y8Ji3l5VAMS~W4inDypg "After you have created a case, you can add artifacts, such as security incidents, CIs, and indicators of compromise, to the case. These artifacts act as clues in solving the case.")

*[\>]: and then