---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Roll up of MITRE Techniques from Artifacts to Case

# Roll up of MITRE Techniques from Artifacts to Case {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
When intelligence records are added to a case, all associated MITRE Techniques are automatically rolled up to the case level.

## Before you begin

Role required: admin

## About this task

Only the associations that come from tactic and technique pairs that MITRE currently maps are rolled up to the case. A pair that MITRE has stopped mapping is excluded from the roll-up and
from the technique counts on the case. For more information, see [Review revoked MITRE tactic and technique associations](https://www.servicenow.com/docs/oLwx0jf_VbPacB0cjk_RSw "Review the tactic and technique pairs that MITRE no longer maps, then delete or remap the entity and case associations that were created from them.").

## Procedure

1. Navigate to WorkspacesThreat Intelligence Security Center.
2. Click the Threat Analyst Workbench icon.
3. Go to Case ManagementAll Cases.  
   All the cases are displayed.
4. Select any case.
5. Go to Artifacts tab.  
   The associated artifacts are displayed as the related lists for that specific case.

*[\>]: and then