---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Revoked MITRE tactic-technique field reference

# Revoked MITRE tactic-technique review fields {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Fields on the review record that MITRE ingestion creates for a revoked tactic and technique pair, and the values that each field can hold.

## Field descriptions {#tisc-mitre-revoked-review-fields__section_review_fields}

The fields on the MITRE Tactic Technique Review \[sn_sec_tisc_mitre_tactic_technique_review\] table are described in the following table.  
{#tisc-mitre-revoked-review-fields__table_review_fields__entry__2}{#tisc-mitre-revoked-review-fields__table_review_fields__entry__3}{#tisc-mitre-revoked-review-fields__table_review_fields__entry__5}{#tisc-mitre-revoked-review-fields__table_review_fields__entry__7}{#tisc-mitre-revoked-review-fields__table_review_fields__entry__9}{#tisc-mitre-revoked-review-fields__table_review_fields__entry__11}{#tisc-mitre-revoked-review-fields__table_review_fields__entry__13}{#tisc-mitre-revoked-review-fields__table_review_fields__entry__15}{#tisc-mitre-revoked-review-fields__table_review_fields__entry__17}{#tisc-mitre-revoked-review-fields__table_review_fields__entry__19}{#tisc-mitre-revoked-review-fields__table_review_fields__entry__21}

| Field | Description |
| Name | Display name of the review record, in the format \<tactic ID\> - \<technique ID\>. Note: Review records that were created before this field was introduced have an empty name, because the name is set only when the record is created. |
| Tactic | MITRE ATT\&CK tactic that is no longer linked to the technique. |
| Technique | MITRE ATT\&CK technique that is no longer linked to the tactic. |
| Review Reason | Reason that the pair was raised for review. See the following table for the two values. |
| Revoked Collection Version | MITRE ATT\&CK collection version in which the pair was revoked. |
| Status | Progress of the review. See the status values described later in this topic. |
| Action Taken | Action that was run on the pair. Delete removes the associations, and Update mapping moves them to another pair. |
| New Tactic | Tactic that the associations were remapped to. This field is populated only when Action Taken is Update mapping. |
| New Technique | Technique that the associations were remapped to. This field is populated only when Action Taken is Update mapping. |
| Work Notes | Journal of the review activity, including the action that was requested and the pair that the associations were moved to. |
|-|-|
[Table 1. MITRE Tactic Technique Review form]

{#tisc-mitre-revoked-review-fields__table_review_fields}

## Review reason values {#tisc-mitre-revoked-review-fields__section_review_reason_values}

{#tisc-mitre-revoked-review-fields__table_review_reason_values__entry__2}{#tisc-mitre-revoked-review-fields__table_review_reason_values__entry__3}{#tisc-mitre-revoked-review-fields__table_review_reason_values__entry__5}

| Value | Meaning |
| Technique has been revoked in the MITRE Collection | MITRE revoked the technique itself, so every tactic that the technique belonged to loses the link. |
| Technique no longer mapped to the Tactic in the MITRE Collection | The technique is still current, but MITRE no longer maps it to this tactic. |
|-|-|
[Table 2. Review Reason values]

{#tisc-mitre-revoked-review-fields__table_review_reason_values}

## Status values {#tisc-mitre-revoked-review-fields__section_review_status_values}

{#tisc-mitre-revoked-review-fields__table_review_status_values__entry__2}{#tisc-mitre-revoked-review-fields__table_review_status_values__entry__3}{#tisc-mitre-revoked-review-fields__table_review_status_values__entry__5}{#tisc-mitre-revoked-review-fields__table_review_status_values__entry__7}{#tisc-mitre-revoked-review-fields__table_review_status_values__entry__9}

| Value | Meaning |
| Review | The pair is waiting for you to delete or remap its associations. This value is set when ingestion creates the record. |
| In Progress | An action was requested and is running in the background. |
| Complete | The requested action finished. |
| Error | The background work didn't finish. You can run the action again from the record. |
|-|-|
[Table 3. Status values]

{#tisc-mitre-revoked-review-fields__table_review_status_values}
**Related tasks**   

* [Review revoked MITRE tactic and technique associations](https://www.servicenow.com/docs/oLwx0jf_VbPacB0cjk_RSw "Review the tactic and technique pairs that MITRE no longer maps, then delete or remap the entity and case associations that were created from them.")