--- title: Define the mitigation coverage description: Define mitigation coverage per technique to gain visibility into how well your organization can prevent related attacks. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/define-the-mitigation-coverage.html release: australia topic_type: task last_updated: "2026-03-12" reading_time_minutes: 6 breadcrumb: [MITRE-ATT&CK administration, MITRE-ATT&CK framework overview, Threat Intelligence, Enterprise security case management applications, Security Operations] --- # Define the mitigation coverage Define mitigation coverage per technique to gain visibility into how well your organization can prevent related attacks. ## Before you begin - Role required: sn\_ti.admin, sn\_si.admin: create, write, delete access - Role required: sn\_ti.read: read access ## About this task The mitigation coverage definitions are used in the overall mitigation and technique coverage mapping. You can use the base system mitigation coverage. The base system mitigation coverage consists of coverage types None, Poor, Fair, Good, Very Good, and Excellent. The base system mitigation coverage is also associated with pre-defined colors, and coverage percentages. You can customize the coverage types \(add or remove coverage types\), coverage percentages for lower limits and higher limits, and colors, or create your custom mitigation coverage. The customizations that you make to the coverage types, colors, or percentages are used in the mitigation coverage mapping and also in the [heat map](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/mitre-att-ck-heatmap-and-navigator.md). ## Procedure 1. Navigate to **All** > **Threat Intelligence** > **MITRE ATT&CK Administration** > **Mitigation Coverage Definition**. 2. Review the mitigation detection entries and customize the entries for your environment.

Field	Description
Overall Technique Mitigation Coverage	Name of the technique mitigation coverage. The [base system mitigation coverage](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/technique-mitigation-coverage-definitions.md) consists of None, Poor, Fair, Good, Very Good, or Excellent.
Coverage Percentage Lower Limit	The lower percentage limit of the mitigation coverage. Define the numerical values between 0 through 100.
Coverage Percentage Higher Limit	The higher percentage limit of the mitigation coverage. Define the numerical values between 0 through 100.
Coverage Color	Color that is assigned to the detection coverage score. The color that you define is used for the technique mitigation coverage in the heat map.You can customize the colors using HEX codes and RGB\(A\) values.
Description	Overall mitigation detection coverage. See the base system definition in the [technique mitigation coverage definition](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/technique-mitigation-coverage-definitions.md).

**Note:** Ensure that you don't overlap the coverage percentage ranges if you customize the percentage limits \(lower or higher\). For example, if a coverage record has the ranges 0 to 20, then the next consecutive record must have lower limit range of 21 or higher to avoid overlapping the coverage percentage range. 3. To add an entry, select **New**, complete the entries, and select **Submit**. - **[Technique mitigation coverage definitions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/technique-mitigation-coverage-definitions.md)** Define your organization's mitigation coverage so that you can effectively measure and detect specific adversary techniques. **Parent Topic:**[MITRE-ATT&CK administration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/mitre-att-ck-administration.md) **Related topics** [Get started with MITRE-ATT&CK framework]() [Understand the MITRE to STIX data model]() [Domain separation and MITRE-ATT&CK]() [Set up the MITRE-ATT&CK framework]() [Manage matrices]() [Manage techniques]() [Manage mitigations]() [Manage groups]() [Manage malware]() [Manage tools]() [Manage MITRE relationships]() [Manage CVE and technique mapping]() [Extend the MITRE-ATT&CK data]() [Define the data source and detection tool mapping]() [Define the data source and data component mapping]() [Define the technique detection coverage]() [Map your technique detection coverage to a technique]() [Map your mitigation coverage to a technique]() [Create and map detection rules]() [Auto-extract technique rules for importing MITRE-ATT&CK information]() [Review threat group and MITRE-ATT&CK techniques mapping]() [Threat group to technique heatmap definition]() [Review the MITRE-ATT&CK system properties]()