---
title: Associate MITRE-ATT&CK information with observables
description: Associate MITRE-ATT&CK tactics and techniques to an observable for better security incident and threat analysis at a granular level.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/associate-mitre-observables.html
release: australia
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 3
breadcrumb: [Using MITRE-ATT&CK to detect and analyze threats, MITRE-ATT&CK framework overview, Threat Intelligence, Enterprise security case management applications, Security Operations]
---

# Associate MITRE-ATT&CK information with observables

Associate MITRE-ATT&CK tactics and techniques to an observable for better security incident and threat analysis at a granular level.

## Before you begin

Role required: sn\_si.analyst

## About this task

Some SIEMs may provide MITRE-ATT&CK information with events, alerts, or observables. To associate the MITRE-ATT&CK information at a granular level, you can add the information with an observable.

You can choose to roll up the MITRE-ATT&CK information automatically from the observables to a security incident. For automatic rollup of observables to security incidents, [enable the system property](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/configure-mitre-att-ck-properties.md). Alternatively, you can roll up the information manually for each observable.

## Procedure

1.  Navigate to **All** > **Security Incidents** > **Show All Incidents**.

2.  Select the security incident that you want to enrich with the MITRE-ATT&CK information.

3.  Select **Show All Related Lists** and the **Associated Observables** tab.

4.  Point to the observable that you want to associate, right-click, and select **Associate MITRE ATT&CK Technique**.

5.  In the source lists, review the **Source**.

    **Note:** Only the [collections](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/setup-mitre-profile.md) and [matrices](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/view-mitre-collection.md) that have been activated appear in the source list.

6.  Review the **Tactic** and **Techniques**, and add or remove them based on the relevance with the observable.

7.  Click **Save**.

    The tactics and techniques that you have added appear in the MITRE-ATT&CK Information column in the observables related list.

8.  Select the observable and then from the Actions menu, click **Roll up MITRE ATT&CK Information to SI**.

    If you have enabled [automatic roll up of MITRE-ATT&CK information from observables to security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/configure-mitre-att-ck-properties.md), then the information is automatically rolled up. If you have not enabled automatic rollup,you need to do this manually.

9.  To see an aggregated view of the techniques that are associated with the observables, select two or more observables from the list and then from the **Actions** menu on the selected rows list, click the **Show MITRE ATT&CK Information**.


## Result

An aggregated view of the MITRE ATT&CK information for the selected observables is displayed.

**Parent Topic:**[Using MITRE-ATT&CK to detect and analyze threats](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/mitre-att-ck-features.md)

**Related topics**  


[Associate MITRE-ATT&CK information with security incidents]()

[Associate MITRE-ATT&CK information with security case]()

[Rollup MITRE-ATT&CK information using Threat Lookup results]()

[Rollup MITRE-ATT&CK information from detection rules]()

[Rollup MITRE-ATT&CK information from child security incidents]()

[Perform link analysis and threat hunting using MITRE-ATT&CK specific filters]()

[MITRE-ATT&CK heat map and navigator]()

[Using the MITRE-ATT&CK dashboard]()