Associate MITRE-ATT&CK information with security case

Associate MITRE-ATT&CK tactics and techniques to a security case for better security case management and threat analysis at a granular level.

Before you begin

Role required: sn_si.analyst

Procedure

1. Navigate to All > Threat Intelligence > Case Management > All Cases.
2. Select the security case that you want to enrich with the MITRE-ATT&CK information.
3. From the related list, click Associate MITRE ATT&CK Technique.

   In the following illustration, you can see how to navigate from the related list to Associate MITRE ATT&CK Technique, review the source, and add a tactic and technique.

4. In the source lists, review the Source.
5. Review the Tactic and Techniques, and add or remove them based on the relevance with the case.
6. Click Save.
   The tactics and techniques that you have added appear in the MITRE-ATT&CK Card.

Related concepts

• MITRE-ATT&CK heat map and navigator
• Using the MITRE-ATT&CK dashboard

Related tasks

• Associate MITRE-ATT&CK information with security incidents
• Associate MITRE-ATT&CK information with observables
• Rollup MITRE-ATT&CK information using Threat Lookup results
• Rollup MITRE-ATT&CK information from detection rules
• Rollup MITRE-ATT&CK information from child security incidents
• Perform link analysis and threat hunting using MITRE-ATT&CK specific filters
• Add artifacts to a case