Associate MITRE ATLAS information with security incidents

---
title: Associate MITRE ATLAS information with security incidents
description: Associate MITRE ATLAS tactics and techniques with a security incident for better security incident and threat analysis.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/associate-mitre-atlas-with-sir.html
release: australia
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [MITRE ATLAS, security incidents, threat analysis]
breadcrumb: [MITRE ATLAS framework, Threat Intelligence, Enterprise security case management applications, Security Operations]
---

# Associate MITRE ATLAS information with security incidents

Associate MITRE ATLAS tactics and techniques with a security incident for better security incident and threat analysis.

## Before you begin

Role required: sn\_si.analyst

## Procedure

1.  Navigate to **All** > **Security Incidents** > **Show All Incidents**.

2.  Select the security incident to enrich with MITRE ATLAS information.

3.  Select the **Associate MITRE Technique** related link.

    The Associate MITRE Technique pane appears.\[Omitted image "mitre-atlas-assoc-technique.png"\] Alt text: Screenshot showing the Associate MITRE Technique pane with Source, Tactic, and Techniques fields

4.  Select **Source**.

    **Note:** If the MITRE ATLAS collection is activated, it appears in the source list alongside MITRE-ATT&CK sources.

5.  Select the **Tactic** and **Techniques**.

6.  Review the information based on relevance and remove sources, tactics, or techniques as needed.

7.  Select **Save**.


## Result

The MITRE ATLAS information is associated with the security incident. You can now view the associated information in the MITRE-ATT&CK Card.