---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Roll up of MITRE technique associations

# Roll up of MITRE technique associations {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Roll up of MITRE technique associations from observables, indicators, objects, and security incidents which are linked or unlinked from a case record.

## Before you begin

Note:  
* Roll up of MITRE technique associations for security incidents will roll up the MITRE technique associated data from security incidents to the case management in TISC.
* By default this property sn_sec_tisc.auto_rollup_mitre_data is enabled for the MITRE Technique(s), to be rolled up to case(s) from the associated objects or security incidents automatically.
* If you want to perform on demand roll up of MITRE technique associations then navigate to the more actions within the Case form view and select Roll Up MITRE Techniques option. This operation will happen asynchronously and you can verify the Activity Stream section for the updates on the roll up activity.
{#tisc-mitre-roll-up__ul_pj2_kjz_gdc} Role required: sn_sec_tisc.analyst

## About this task

* Whenever any entity such as an observable or indicator is linked to any case, then all the MITRE technique associations that are present for that entity are automatically rolled up to the case.
* Whenever any entity such as an observable or indicator is unlinked and removed from the case, then all the MITRE technique associations which are rolled up from the case that are present for that entity will be removed automatically and rolled up to the case.
* Only the technique associations that come from tactic and technique pairs that MITRE currently maps are rolled up. A pair that MITRE has stopped mapping is excluded from the roll-up, so the technique count on the case reflects only the mappings that MITRE currently publishes. For more information, see [Review revoked MITRE tactic and technique associations](https://www.servicenow.com/docs/oLwx0jf_VbPacB0cjk_RSw "Review the tactic and technique pairs that MITRE no longer maps, then delete or remap the entity and case associations that were created from them.").
{#tisc-mitre-roll-up__ul_dsj_p2z_gdc}

## Procedure

1. Navigate to WorkspacesThreat Intelligence Security Center.
2. Click the Threat Analyst Workbench icon.
3. Go to Case ManagementAll Cases.  
   All the cases are displayed.
4. Open any case.
5. Go to Artifacts tab.
6. Select Observables from the artifacts related list.
7. Select the Link button.
8. Select the observables that you may want to link to the case.
9. Click Link to link the observables.  
   After you link the observables to a case then the MITRE techniques associated for that particular observable are automatically rolled up and the MITRE techniques list count under the artifacts section is automatically updated.
10. Click Unlink to unlink the observables from the case.  
    After you unlink the observables to a case then the MITRE techniques associated for that particular observable are automatically removed and the MITRE techniques list count under the artifacts section is automatically updated.

*[\>]: and then