Define an attack pattern

---
title: Define an attack pattern
description: Define an attack pattern to help categorize attacks.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/define-attack-pattern.html
release: brazil
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 2
breadcrumb: [Attack patterns, IoC Repository, Threat Intelligence, Enterprise security case management applications, Security Operations]
---

# Define an attack pattern

Define an attack pattern to help categorize attacks.

## Before you begin

Role required: sn\_ti.admin

## Procedure

1.  Navigate to **All** > **Threat Intelligence** > **IoC Repository** > **Attack Patterns**.

2.  Click **New**.

3.  Complete the fields in the form as appropriate.

<table id="choicetable_sq4_yvf_wmb"><thead><tr><th align="left" id="d249632e80">

Field

</th><th align="left" id="d249632e83">

Description

</th></tr></thead><tbody><tr><td id="d249632e89">

**Name**

</td><td>

Enter a descriptive name for this attack pattern.

</td></tr><tr><td id="d249632e98">

**Spec Version**

</td><td>

The version of the STIX specification used to represent this object.The value of this property must be 2.1 for STIX Objects defined according to this specification.

</td></tr><tr><td id="d249632e110">

**Source**

</td><td>

Specifies the threat source from which this record is created.

</td></tr><tr><td id="d249632e119">

**Description**

</td><td>

Enter a description of the attack pattern.

</td></tr><tr><td id="d249632e129">

**Aliases**

</td><td>

Alternative names to identify this attack pattern.

</td></tr><tr><td id="d249632e138">

**Source ID**

</td><td>

Unique identifier for this object in the threat source.

</td></tr><tr><td id="d249632e147">

**Created Time in Source**

</td><td>

Specifies the time the object is created in the source.

</td></tr><tr><td id="d249632e156">

**Modified Time in Source**

</td><td>

Specifies the time the object is modified in the source.

</td></tr></tbody>
</table>4.  Click **Submit**.


## What to do next

You can now click any of the following related lists to view additional information about objects associated with the attack pattern.

<table id="table_zdn_szf_wmb"><thead><tr><th>

Related Links and Related Lists

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Show Relationships

</td><td>

Opens the STIX Visualizer where you can view the relationship of the STIX object.Show Relationships appears only when the object has an associated object.

</td></tr><tr><td>

External References

</td><td>

Lists external references which refer to non-STIX information. This property is used to provide one or more external object identifiers.

</td></tr><tr><td>

Associated Kill Chain Phases

</td><td>

Lists kill chain phases associated with this object.

</td></tr><tr><td>

Campaigns

</td><td>

Lists campaigns associated with this object.

</td></tr><tr><td>

Course of Actions

</td><td>

Lists the associated course of actions with this object that are technical or automated responses \(applying patches, reconfiguring firewalls\) to prevent an attack.

</td></tr><tr><td>

Identities

</td><td>

List of identities associated with this object.

</td></tr><tr><td>

Indicators

</td><td>

Lists related Indicators of Compromise \(IoC\) that have been identified by the threat source associated with this object.

</td></tr><tr><td>

Intrusion Set

</td><td>

Lists a set of adversarial behaviors and resources with common properties associated with this object.

</td></tr><tr><td>

Locations

</td><td>

Lists locations that provide geographic context to this object.

</td></tr><tr><td>

Malware

</td><td>

Lists malicious code associated with this object.

</td></tr><tr><td>

Threat Actors

</td><td>

Lists individuals, groups, or organizations who act with malicious intent associated with this object.

</td></tr><tr><td>

Tools

</td><td>

Lists legitimate software that is used by threat actors to perform attacks associated with this object.

</td></tr><tr><td>

Vulnerabilities

</td><td>

Lists a weakness or defect in a software or hardware that attackers exploit which is associated with this object.

</td></tr></tbody>
</table>**Parent Topic:**[Attack patterns](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/attack-patterns.md)