Define the data source and detection tool mapping
Define the data source and detection tool mapping for MITRE-ATT&CK tactics and techniques. This mapping provides the insight into the relevance and availability of the data sources and the detection tools for monitoring the data sources in your environment.
Before you begin
Role required:
- sn_ti.admin, sn_si.admin: write, delete access
- sn_ti.read: read access
About this task
You can identify the data sources and the detection tools that your organization needs to detect the techniques effectively.
For example, if your organization focuses on 5 techniques, you may need 10 data sources and 10 detection tools to monitor those sources. Let's say that you identify that your organization does not have two data sources and five detection tools. This exercise gives you visibility into the data sources, their relevance to your organization, and to identify gaps in the coverage. You can also focus on enhancing your environment with the right data sources and detection tools.
All the active tactics, techniques, ID, and data sources are automatically populated based on your TAXII profile
Procedure
- Navigate to All > Threat Intelligence > MITRE ATT&CK Administration > Data Source Mapping.
|
Field |
Description |
|---|---|
|
Tactic |
Adversary’s objective or the reason for performing an action. |
|
ID |
Technique’s unique identity. |
|
Technique |
How an adversary achieves a tactical objective by performing an action. |
|
Data Source |
Data source that is associated with the technique. |
|
Data Source Revoked |
Data source is revoked if set to true, however the data source mapping is still retained.If the data source value is not found in MITRE, then the Data Source Revoked value is automatically marked as true. The data source mapping for a record is revoked if the technique and data source relationships are missing from the updated MITRE data. Default: false |
|
Data Source Available |
Availability of the data source. |
|
Detection Tool |
Tool that supplements the data source by detecting the techniques that are used. The detection tool is mapped with the alert sensor in SIR. |
|
Revoked |
The data source mapping for a record is revoked if the technique and data source relationships are missing from the updated MITRE data.Default: false |
-
Note: You can't edit this entry from the list view.
In the Detection Tool field, do the following steps:
- Select the information icon, and select Open Record.
- Unlock Detection Tool entry.
- Use the lookup list to select a detection tool. You can multi-select detection tools.
- Select Update.
Parent Topic:MITRE-ATT&CK administration
Related topics
Get started with MITRE-ATT&CK framework
Understand the MITRE to STIX data model
Domain separation and MITRE-ATT&CK
Set up the MITRE-ATT&CK framework
Manage CVE and technique mapping
Define the data source and data component mapping
Define the technique detection coverage
Map your technique detection coverage to a technique
Define the mitigation coverage
Map your mitigation coverage to a technique
Create and map detection rules
Auto-extract technique rules for importing MITRE-ATT&CK information
Review threat group and MITRE-ATT&CK techniques mapping
---
title: Define the data source and detection tool mapping
description: Define the data source and detection tool mapping for MITRE-ATT&CK tactics and techniques. This mapping provides the insight into the relevance and availability of the data sources and the detection tools for monitoring the data sources in your environment.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/manage-mitre-att-ck-data-sources.html
release: australia
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 6
breadcrumb: [MITRE-ATT&CK administration, MITRE-ATT&CK framework overview, Threat Intelligence, Enterprise security case management applications, Security Operations]
---
# Define the data source and detection tool mapping
Define the data source and detection tool mapping for MITRE-ATT&CK tactics and techniques. This mapping provides the insight into the relevance and availability of the data sources and the detection tools for monitoring the data sources in your environment.
## Before you begin
Role required:
- sn\_ti.admin, sn\_si.admin: write, delete access
- sn\_ti.read: read access
## About this task
You can identify the data sources and the detection tools that your organization needs to detect the techniques effectively.
For example, if your organization focuses on 5 techniques, you may need 10 data sources and 10 detection tools to monitor those sources. Let's say that you identify that your organization does not have two data sources and five detection tools. This exercise gives you visibility into the data sources, their relevance to your organization, and to identify gaps in the coverage. You can also focus on enhancing your environment with the right data sources and detection tools.
All the active tactics, techniques, ID, and data sources are automatically populated based on your [TAXII profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/setup-mitre-profile.md)
## Procedure
1. Navigate to **All** > **Threat Intelligence** > **MITRE ATT&CK Administration** > **Data Source Mapping**.
<table id="table_ayl_v1r_znb"><thead><tr><th>
Field
</th><th>
Description
</th></tr></thead><tbody><tr><td>
Tactic
</td><td>
Adversary’s objective or the reason for performing an action.
</td></tr><tr><td>
ID
</td><td>
Technique’s unique identity.
</td></tr><tr><td>
Technique
</td><td>
How an adversary achieves a tactical objective by performing an action.
</td></tr><tr><td>
Data Source
</td><td>
Data source that is associated with the technique.
</td></tr><tr><td>
Data Source Revoked
</td><td>
Data source is revoked if set to true, however the data source mapping is still retained.If the data source value is not found in MITRE, then the Data Source Revoked value is automatically marked as true. The data source mapping for a record is revoked if the technique and data source relationships are missing from the updated MITRE data.
Default: false
</td></tr><tr><td>
Data Source Available
</td><td>
Availability of the data source.
</td></tr><tr><td>
Detection Tool
</td><td>
Tool that supplements the data source by detecting the techniques that are used. The detection tool is mapped with the alert sensor in SIR.
</td></tr><tr><td>
Revoked
</td><td>
The data source mapping for a record is revoked if the technique and data source relationships are missing from the updated MITRE data.Default: false
</td></tr></tbody>
</table>2. Review the listed data sources and modify the value in the **Data Source Available** field based on your environment.
3. **Note:** You can't edit this entry from the list view.
In the **Detection Tool** field, do the following steps:
1. Select the information icon, and select **Open Record**.
2. Unlock **Detection Tool** entry.
3. Use the lookup list to select a detection tool. You can multi-select detection tools.
4. Select **Update**.
**Parent Topic:**[MITRE-ATT&CK administration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/mitre-att-ck-administration.md)
**Related topics**
[Get started with MITRE-ATT&CK framework]()
[Understand the MITRE to STIX data model]()
[Domain separation and MITRE-ATT&CK]()
[Set up the MITRE-ATT&CK framework]()
[Manage matrices]()
[Manage techniques]()
[Manage mitigations]()
[Manage groups]()
[Manage malware]()
[Manage tools]()
[Manage MITRE relationships]()
[Manage CVE and technique mapping]()
[Extend the MITRE-ATT&CK data]()
[Define the data source and data component mapping]()
[Define the technique detection coverage]()
[Map your technique detection coverage to a technique]()
[Define the mitigation coverage]()
[Map your mitigation coverage to a technique]()
[Create and map detection rules]()
[Auto-extract technique rules for importing MITRE-ATT&CK information]()
[Review threat group and MITRE-ATT&CK techniques mapping]()
[Threat group to technique heatmap definition]()
[Review the MITRE-ATT&CK system properties]()
| title | Define the data source and detection tool mapping |
| description | Define the data source and detection tool mapping for MITRE-ATT&CK tactics and techniques. This mapping provides the insight into the relevance and availability of the data sources and the detection tools for monitoring the data sources in your environment. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/security-management/manage-mitre-att-ck-data-sources.html |
| release | australia |
| topic_type | task |
| last_updated | 2026-09-10 |
| reading_time_minutes | 6 |
| breadcrumb | MITRE-ATT&CK administrationMITRE-ATT&CK framework overviewThreat IntelligenceEnterprise security case management applicationsSecurity Operations |