Rollup MITRE-ATT&CK information using Threat Lookup results

If you have not enabled automatic rollup of MITRE-ATT&CK information, you can do this manually.

Before you begin

Role required: sn_si.analyst

About this task

If you have enabled automatic roll up of MITRE-ATT&CK information from Threat Lookup results to security incident, then the information is automatically rolled up. If you have not enabled automatic rollup, you can do this manually.

Procedure

1. Navigate to All > Security Incidents > Show All Incidents.
2. Select the security incident that you want to enrich with the MITRE-ATT&CK information.
3. Click Show All Related Lists and the Threat Lookup Results tab.
4. Select the observable and then from the Actions menu, click Roll up MITRE ATT&CK Information to SI.
   You can select multiple observables and rollup the information.
5. Click Reload to confirm the changes.
   The following illustration shows how to select an observable and roll up the Threat Lookup results to the security incident.
   You can view the MITRE-ATT&CK Card to confirm that the Threat Lookup results have been rolledup to the security incident.

Related concepts

• MITRE-ATT&CK heat map and navigator
• Using the MITRE-ATT&CK dashboard

Related tasks

• Associate MITRE-ATT&CK information with security incidents
• Associate MITRE-ATT&CK information with observables
• Associate MITRE-ATT&CK information with security case
• Rollup MITRE-ATT&CK information from detection rules
• Rollup MITRE-ATT&CK information from child security incidents
• Perform link analysis and threat hunting using MITRE-ATT&CK specific filters