Create and map detection rules

---
title: Create and map detection rules
description: Create detection rules and map them against the tactics and techniques. With this mapping, you can see the coverage for the detection rules in your organization.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/create-detection-rules.html
release: brazil
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 8
breadcrumb: [MITRE-ATT&CK administration, MITRE-ATT&CK framework overview, Threat Intelligence, Enterprise security case management applications, Security Operations]
---

# Create and map detection rules

Create detection rules and map them against the tactics and techniques. With this mapping, you can see the coverage for the detection rules in your organization.

## Before you begin

Role required:

-   sn\_ti.admin, sn\_si.admin: create, write, delete access
-   sn\_ti.read: read access

## About this task

Detection rule mapping enables your organization to see which detection rules are available to identify specific techniques.

The primary purpose of the mapping is to provide visibility if your organization has the necessary detection rules to identify when an alert or event is triggered as a result of an attack by an adversary using a specific technique.

If you do not intend to use the base system SIEM auto-extraction rules, then enable the automatic rollup of MITRE-ATT&CK TTPs based on the detection rule mapping. You can populate the alert or event rule that triggers the security incident in the Alert Rule name field. You can also populate the Alert Rule name field by using SIEM integration, email parsing, manual creation, etc. For more information, see [Rollup MITRE-ATT&CK information from detection rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/rollup-mitre-attack-information-detection-rules.md).

**Note:**

The detection rules feature has been updated to include mapping a single tactic to multiple techniques. Previously, you could map a single tactic with a single technique. If you are upgrading the Threat Intelligence plugin from version 12.0.4 to a higher version, then review the following points before using the detection rules in MITRE-ATT&CK module.

-   You find multiple records merged into a single record if the fields - rule name, alert sensor, source, category, subcategory, and MITRE-ATT&CK tactic are common.
-   The old records are marked as true in the deprecated column and false in the active column.
-   The new merged records are available for use and are marked as false in the deprecated column and true in the active column.
-   After you verify the upgrade, and view that all your detection rules are successfully migrated, you can delete the old records that are marked as true in the deprecated column.

## Procedure

1.  Navigate to **All** > **Threat Intelligence** > **MITRE ATT&CK Administration** > **Detection Rules - MITRE ATT&CK Mappings**.

2.  Use one of the following methods to create your detection rule:

    Method 1: Manually create detection rules.

    1.  Click **New** and on the form, fill in the fields.

        |Field|Description|
        |-----|-----------|
        |Rule Name|Detection rule's name.|
        |MITRE-ATT&CK Tactic|Relevant MITRE-ATT&CK tactic.|
        |MITRE-ATT&CK Techniques|Relevant MITRE-ATT&CK technique. You can select multiple techniques for a single tactic.|
        |Source|Source of the security incident, such as email, firewall, network monitoring, and so on.|
        |Alert Sensor|Security integration through which you ingest the alert or event data such as CarbonBlack, CrowdStrike, McAfee, and so on.|
        |Subcategory|Subcategory that further defines the issue.|
        |Category|Category that identifies the type of security issue.|
        |MITRE-ATT&CK Technique|Relevant MITRE-ATT&CK technique. You can select multiple techniques for a single tactic.|
        |Security Incident Count|The number of security incidents that the techniques are appended to. This count appears when you have enabled the roll up of MITRE-ATT&CK information automatically from alert rules to security incidents.|
        |Deprecated|The detection rule mapping is deprecated.|
        |Active|Option to specify if the detection rule is active and deployed in your environment.|

    2.  Select **Submit**.
    Method 2: Import and create detection rules.

    1.  Right-click the Rule Name column header.
    2.  From the list, select **Import**.
    3.  Select **Create Excel template**.
    4.  Select **Download** after the export completes. An excel template with the filename sn\_ti\_alert\_rules\_mitre\_attack\_technique\_mapping is downloaded to your computer.
    5.  Open the spreadsheet, select the second sheet tab, and review what you entered. On the form, fill in the fields and then, save your file.

        |Field|Description|
        |-----|-----------|
        |Rule Name|Detection rule name.|
        |Active|Option to specify if the detection rule is active and deployed in your environment.|
        |Alert Sensor|Security integration through which you ingest the alert or event data such as CarbonBlack, CrowdStrike, McAfee, and so on.|
        |Category|Category that identifies the type of security issue.|
        |Comments|Description about the detection rule.|
        |Deprecated|The detection rule mapping is deprecated.|
        |MITRE-ATT&CK Technique IDs|MITRE-ATT&CK technique ID, such as T1546.008, for Accessibility Features.|
        |MITRE-ATT&CK Tactic ID|MITRE-ATT&CK tactic ID, such as TA0003, for Persistence.|
        |Security Incident Count|The number of security incidents that the techniques are appended to. This count appears when you have enabled the roll up of MITRE-ATT&CK information automatically from alert rules to security incidents and the detection rule is active.|
        |Source|Source of the security incident, such as email, firewall, network monitoring, and so on.|
        |Subcategory|Subcategory that further defines the issue.|
        |MITRE-ATT&CK Tactic|Relevant MITRE-ATT&CK tactic.|
        |MITRE-ATT&CK Technique|Relevant MITRE-ATT&CK technique.|

    6.  Select **Choose file** and select the spreadsheet on your computer.
    7.  Select **Upload**.
    8.  Select **Preview Imported Data**.
    9.  Preview the mappings and select **Complete Import**.

        The following illustration shows how to upload the spreadsheet, preview the data, review any errors, and complete the detection rule mapping import process.


**Parent Topic:**[MITRE-ATT&CK administration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/mitre-att-ck-administration.md)

**Related topics**  


[Get started with MITRE-ATT&CK framework]()

[Understand the MITRE to STIX data model]()

[Domain separation and MITRE-ATT&CK]()

[Set up the MITRE-ATT&CK framework]()

[Manage matrices]()

[Manage techniques]()

[Manage mitigations]()

[Manage groups]()

[Manage malware]()

[Manage tools]()

[Manage MITRE relationships]()

[Manage CVE and technique mapping]()

[Extend the MITRE-ATT&CK data]()

[Define the data source and detection tool mapping]()

[Define the data source and data component mapping]()

[Define the technique detection coverage]()

[Map your technique detection coverage to a technique]()

[Define the mitigation coverage]()

[Map your mitigation coverage to a technique]()

[Auto-extract technique rules for importing MITRE-ATT&CK information]()

[Review threat group and MITRE-ATT&CK techniques mapping]()

[Threat group to technique heatmap definition]()

[Review the MITRE-ATT&CK system properties]()