Associate MITRE-ATT&CK information with security case

---
title: Associate MITRE-ATT&CK information with security case
description: Associate MITRE-ATT&CK tactics and techniques to a security case for better security case management and threat analysis at a granular level.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/associate-mitre-att-ck-information-with-security-case-management.html
release: brazil
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 2
breadcrumb: [Using MITRE-ATT&CK to detect and analyze threats, MITRE-ATT&CK framework overview, Threat Intelligence, Enterprise security case management applications, Security Operations]
---

# Associate MITRE-ATT&CK information with security case

Associate MITRE-ATT&CK tactics and techniques to a security case for better security case management and threat analysis at a granular level.

## Before you begin

Role required: sn\_si.analyst

## Procedure

1.  Navigate to **All** > **Threat Intelligence** > **Case Management** > **All Cases**.

2.  Select the security case that you want to enrich with the MITRE-ATT&CK information.

3.  From the related list, select **Associate MITRE ATT&CK Technique**.

    In the following illustration, you can see how to navigate from the related list to **Associate MITRE ATT&CK Technique**, review the source, and add a tactic and technique.

4.  In the source lists, review the **Source**.

5.  Review the **Tactic** and **Techniques**, and add or remove them based on the relevance with the case.

6.  Select **Save**.

    The tactics and techniques that you have added appear in the MITRE-ATT&CK Card.


**Parent Topic:**[Using MITRE-ATT&CK to detect and analyze threats](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/mitre-att-ck-features.md)

**Parent Topic:**[Create cases in Security Case Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/create-cases-in-case-mgmt.md)

**Related topics**  


[Associate MITRE-ATT&CK information with security incidents]()

[Associate MITRE-ATT&CK information with observables]()

[Rollup MITRE-ATT&CK information using Threat Lookup results]()

[Rollup MITRE-ATT&CK information from detection rules]()

[Rollup MITRE-ATT&CK information from child security incidents]()

[Perform link analysis and threat hunting using MITRE-ATT&CK specific filters]()

[MITRE-ATT&CK heat map and navigator]()

[Using the MITRE-ATT&CK dashboard]()

[Add artifacts to a case]()