Define the data source and data component mapping

---
title: Define the data source and data component mapping
description: Use the Data Component Mapping if you are using the latest TAXII collections, and you want to maintain a relationship between the data sources, data components, and the various techniques. Map the data sources with the additional context of data components that provides an extra sublayer of context to data sources that enable you to understand adversary behaviors in MITRE-ATT&CK better.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/map-the-data-source-and-data-components.html
release: australia
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 7
breadcrumb: [MITRE-ATT&CK administration, MITRE-ATT&CK framework overview, Threat Intelligence, Enterprise security case management applications, Security Operations]
---

# Define the data source and data component mapping

Use the Data Component Mapping if you are using the latest TAXII collections, and you want to maintain a relationship between the data sources, data components, and the various techniques. Map the data sources with the additional context of data components that provides an extra sublayer of context to data sources that enable you to understand adversary behaviors in MITRE-ATT&CK better.

## Before you begin

Role required:

-   sn\_ti.admin, sn\_si.admin: write, delete access
-   sn\_ti.read: read access

## About this task

Mapping the data sources and data components provides visibility into the data sources or components and the techniques that are relevant for your organization.

For example, if your organization focuses on 7 techniques, you may need 5 data sources and 10 data components to monitor these sources. Your evaluation of internal tools reveals that your organization doesn’t have two data sources and four data components. This mapping exercise provides visibility into the data sources, components, & techniques, their relevance to your organization, and to identify the gaps in coverage. You can thus focus your investment on the right data sources and alert sensors to detect and mitigate adversary threats.

The MITRE-ATT&CK framework contains an updated structure for the data sources - Data Source: Data Component. This new form of data source provides an extra context to the data sources. The data source object features the name of the data source as well as key details about the collected data \(file, process, network traffic, and so on\) and specific values or properties required to detect adversary behaviors.

The following illustration shows the MITRE-ATT&CK STIX™ structure representation for data sources and data components. You can see both the data sources and data components captured as custom STIX™ objects. The illustration shows that each data source contains one or more data components, and each data component detects one or more techniques.

\[Omitted image "mitre-datasourcecomponent.png"\] Alt text: This image shows the general structure of data sources and data components.

You can continue using the [Data Source Mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/manage-mitre-att-ck-data-sources.md) if your MITRE-ATT&CK repository contains the old TAXII collections, and you’ve mapped your data sources to various techniques. However, use the [Data Component Mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/map-the-data-source-and-data-components.md) if you’re using the latest TAXII collections, and you want to maintain a relationship between the data sources, data components, and the various techniques.

## Procedure

1.  Navigate to **All** > **Threat Intelligence** > **MITRE ATT&CK Administration** > **Data Component Mapping**.

    |Field|Description|
    |-----|-----------|
    |Tactic|Adversary’s objective or the reason for performing an action.|
    |ID|Technique’s unique identity.|
    |Technique|How an adversary achieves a tactical objective by performing an action.|
    |Data Source|Data source that is associated with the technique.|
    |Data Component|Data component that is associated with the data source. A data component can only have one parent data source.|
    |Data Component Revoked|Identifies if the data component has been revoked in the MITRE-ATT&CK knowledge base.|
    |Detection Tool|Tool that supplements the data source by detecting the techniques that are used. The detection tool is mapped with the alert sensor in SIR.|
    |Comment|Description about the data source and data component mapping.|
    |Revoked|Identifies if the data component to technique mapping is revoked by MITRE-ATT&CK.|

2.  Review the listed data sources and data components and modify the values based on your environment.

3.  Follow these steps to add a data component.

    1.  Navigate to **Threat Intelligence** > **MITRE ATT&CK Administration** > **Techniques**.

    2.  Select a technique that you want to modify the data source: data component information.

    3.  Unlock Data Source: Data Component.

    4.  Use the lookup list to select MITRE-ATT&CK data components.

    5.  Lock Data Source: Data Component.

    6.  Select **Update**.


**Parent Topic:**[MITRE-ATT&CK administration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/mitre-att-ck-administration.md)

**Related topics**  


[Get started with MITRE-ATT&CK framework]()

[Understand the MITRE to STIX data model]()

[Domain separation and MITRE-ATT&CK]()

[Set up the MITRE-ATT&CK framework]()

[Manage matrices]()

[Manage techniques]()

[Manage mitigations]()

[Manage groups]()

[Manage malware]()

[Manage tools]()

[Manage MITRE relationships]()

[Manage CVE and technique mapping]()

[Extend the MITRE-ATT&CK data]()

[Define the data source and detection tool mapping]()

[Define the technique detection coverage]()

[Map your technique detection coverage to a technique]()

[Define the mitigation coverage]()

[Map your mitigation coverage to a technique]()

[Create and map detection rules]()

[Auto-extract technique rules for importing MITRE-ATT&CK information]()

[Review threat group and MITRE-ATT&CK techniques mapping]()

[Threat group to technique heatmap definition]()

[Review the MITRE-ATT&CK system properties]()