Using MITRE-ATT&CK to detect and analyze threats

---
title: Using MITRE-ATT&CK to detect and analyze threats
description: Use the MITRE-ATT&CK framework across the Threat Intelligence and the SIR module to detect and analyze threats to your organization.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/mitre-att-ck-features.html
release: brazil
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [MITRE-ATT&CK framework overview, Threat Intelligence, Enterprise security case management applications, Security Operations]
---

# Using MITRE-ATT&CK to detect and analyze threats

Use the MITRE-ATT&CK framework across the Threat Intelligence and the SIR module to detect and analyze threats to your organization.

-   **[Associate MITRE-ATT&CK information with security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/associate-mitre-with-sir.md)**  
Associate the MITRE-ATT&CK tactics and techniques to the security incident for better security incident and threat analysis.
-   **[Associate MITRE-ATT&CK information with observables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/associate-mitre-observables.md)**  
Associate MITRE-ATT&CK tactics and techniques to an observable for better security incident and threat analysis at a granular level.
-   **[Associate MITRE-ATT&CK information with security case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/associate-mitre-att-ck-information-with-security-case-management.md)**  
Associate MITRE-ATT&CK tactics and techniques to a security case for better security case management and threat analysis at a granular level.
-   **[Rollup MITRE-ATT&CK information using Threat Lookup results](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/rollup-threat-lookup-results.md)**  
If you have not enabled automatic rollup of MITRE-ATT&CK information, you can do this manually.
-   **[Rollup MITRE-ATT&CK information from detection rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/rollup-mitre-attack-information-detection-rules.md)**  
Enable rollup of MITRE-ATT&CK information from the detection rules to the security incidents for better security incident and threat analysis.
-   **[Rollup MITRE-ATT&CK information from child security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/rollup-mitre-att-ck-information-from-child-security-incidents.md)**  
If you have not enabled automatic rollup of MITRE-ATT&CK information or MITRE ATLAS information, you can do this manually.
-   **[Perform link analysis and threat hunting using MITRE-ATT&CK specific filters](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/link-analysis-threat-hunt-mitre.md)**  
Correlate and perform link analysis of observables, security incidents, and MITRE-ATT&CK related information so that your organization can start hunting for threats.
-   **[MITRE-ATT&CK heat map and navigator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/mitre-att-ck-heatmap-and-navigator.md)**  
You can use the MITRE-ATT&CK heat map and navigator for basic navigation and to visualize your overall technique detection coverage.
-   **[Using the MITRE-ATT&CK dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/mitre-dashboards.md)**  
The MITRE-ATT&CK dashboard provides an executive view of the data source coverage, tactics, and techniques that are used in your organization.

**Parent Topic:**[MITRE-ATT&CK framework overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/about-mitre-attack.md)

**Related topics**  


[MITRE-ATT&CK administration]()