--- title: MITRE-ATT&CK framework overview description: The MITRE-ATT&CK framework is a knowledge base of common tactics, techniques, and procedures \(TTP\) that your organization can access to develop specific threat models and methodologies against cyberattacks. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/about-mitre-attack.html release: australia topic_type: concept last_updated: "2025-07-31" reading_time_minutes: 6 breadcrumb: [Threat Intelligence, Enterprise security case management applications, Security Operations] --- # MITRE-ATT&CK framework overview The MITRE-ATT&CK framework is a knowledge base of common tactics, techniques, and procedures \(TTP\) that your organization can access to develop specific threat models and methodologies against cyberattacks. The MITRE Adversarial Tactics, Techniques, and Common Knowledge \(ATT&CK\) framework documents and tracks various adversarial techniques that are used during different stages of a cyberattack. By using the MITRE-ATT&CK framework's knowledge base, the cyberthreat intelligence community can quickly identify threats and coordinate cyberattack responses. In addition to the MITRE-ATT&CK framework, ServiceNow also supports MITRE ATLAS. For an overview, see [MITRE ATLAS framework](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/about-mitre-atlas.md). ## MITRE-ATT&CK and Security Operations Learn how the MITRE-ATT&CK information flows with Security Operations applications. - The [pre-loaded TAXII client](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/setup-mitre-profile.md) connects to the TAXII server to ingest the [data collections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/view-mitre-collection.md) to Threat Intelligence. - Existing [Security Information and Event Manager \(SIEM\) integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/auto-extract-technique-rules.md) ingest their threat data \(alerts and events\), with relevant TTPs and are [associated with security incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/associate-mitre-with-sir.md). - When an [indicator of compromise \(IoC\) is associated to a security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/associate-mitre-observables.md), Threat Intelligence automatically searches threat feeds for relevant information and sends IoCs to third-party sources such as an endpoint detection and response \(EDR\) tool, a malware sandbox, or a threat intelligence platform \(TIP\) for additional analysis. - If any third-party source contains the MITRE-ATT&CK information, then [Threat Intelligence extracts the technique information](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/create-detection-rules.md) and enriches the data in the Threat Intelligence repository for correlation and analysis. - MITRE-ATT&CK also shares [Common Vulnerabilities and Exposures \(CVE\) context information](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/mitre-att-ck-heatmap-and-navigator.md) for each technique. Your security team can review the exploited techniques in Vulnerability Response to determine if your business-critical assets are threatened. ## MITRE-ATT&CK matrixes, tactics, and techniques The core of the MITRE-ATT&CK framework is a matrix of adversary tactics and techniques. The sequence of the tactics represents what an adversary is trying to accomplish at the stage of an incident. When your security team understands this sequence, you have an opportunity to anticipate an adversary's next move and break the kill chain. ATT&CK consists of the following matrixes: - Enterprise ATT&CK: Describes the behaviors and actions that an adversary takes to compromise and operate in an enterprise network and cloud. **Note:** The Pre ATT&CK matrix has been deprecated by MITRE and is merged with the Enterprise matrix. - ICS ATT&CK: Describes the actions that an adversary takes while operating within an Industrial Control Systems \(ICS\) network. - Mobile ATT&CK: Describes the adversary behaviors and actions that focus on mobile devices. Tactics represent the why of an ATT&CK technique. It is the adversary’s tactical objective for performing an action. Techniques represent how an adversary achieves a tactical objective by performing an action. Techniques may be associated with more than one tactic. For example, Access Token Manipulation is used by an adversary to achieve either the tactic of Privilege Escalation or Defense Evasion. ## Using an intent-based approach for incident responses An intent-based response uses a dynamic and contextual kill chain framework that can help your organization to correlate security incidents and to identify a large scope of attacks. Your security team can use an intent-based response to understand how the organization is being attacked and what the attacker might do next. This type of response enables you to predict an attacker's behavior so that you can focus your resources effectively. Using Security Incident Response, your security team can manage the life cycle of each security incident from analysis to containment by focusing on indicators of compromise \(IOCs\) like IP addresses, file hashes, and domains. By integrating Security Incident Response with the MITRE-ATT&CK framework, security incidents are handled as links in a larger enterprise-wide attack. ## How your organization can benefit from MITRE-ATT&CK in Security Operations Using the MITRE-ATT&CK framework can help your organization do the following: - Equip security analysts with MITRE-ATT&CK tactics, techniques, and procedures \(TTPs\) to better analyze and respond to security incidents. - Automate the incident workflows using the playbook for detecting and containing threats in the context of the MITRE-ATT&CK framework. - Prioritize indicators of compromise and threat hunting with MITRE-ATT&CK information. - Understand the high-level security posture of your organization in the context of the MITRE-ATT&CK framework. - **[MITRE-ATT&CK administration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/mitre-att-ck-administration.md)** You can set up, map data sources, map overall technique detection coverage, and maintain the MITRE-ATT&CK repository in the ServiceNow AI Platform. - **[Using MITRE-ATT&CK to detect and analyze threats](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/mitre-att-ck-features.md)** Use the MITRE-ATT&CK framework across the Threat Intelligence and the SIR module to detect and analyze threats to your organization. **Parent Topic:**[Threat Intelligence](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intel-landing-page.md) **Related topics** [Understanding Threat Intelligence]() [Set up Threat Intelligence]() [IoC Repository]() [MITRE D3FEND framework]() [MITRE ATLAS framework]() [Threat Intelligence administration]() [Threat Intelligence integrations]() [Threat Intelligence Orchestration]() [Security Case Management]()