---
title: Perform link analysis and threat hunting using MITRE-ATT&CK specific filters
description: Correlate and perform link analysis of observables, security incidents, and MITRE-ATT&CK related information so that your organization can start hunting for threats.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/link-analysis-threat-hunt-mitre.html
release: australia
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 2
breadcrumb: [Using MITRE-ATT&CK to detect and analyze threats, MITRE-ATT&CK framework overview, Threat Intelligence, Enterprise security case management applications, Security Operations]
---

# Perform link analysis and threat hunting using MITRE-ATT&CK specific filters

Correlate and perform link analysis of observables, security incidents, and MITRE-ATT&CK related information so that your organization can start hunting for threats.

## Before you begin

Role required: sn\_ti.mitre\_analyst, sn\_si.read

## About this task

After you associate the security incidents with MITRE-ATT&CK information, you can use the MITRE-ATT&CK specific filters for threat hunting. Use the MITRE-ATT&CK filters with the existing Security Incident Response filters to correlate and perform link analysis.

## Procedure

1.  Navigate to **All** > **Security Incidents** > **Show All Incidents**.

2.  Select **Update Personalized List** to add the MITRE columns.

3.  Select a filter condition so that you can view MITRE related information and associations with security incidents or observables:

    -   MITRE-ATT&CK Adversary Group
    -   MITRE-ATT&CK Data Source
    -   MITRE-ATT&CK Procedure \(Malware\)
    -   MITRE-ATT&CK Procedure \(Tools\)
    -   MITRE-ATT&CK Tactic
    -   MITRE-ATT&CK Technique
4.  Create a filter condition that is based on the above criteria and select **Run** to perform a link analysis or correlation between security incidents, observables, and MITRE-ATT&CK related information.

    **Note:** The MITRE-ATT&CK data is stored as a string and you can only use **contains** as the operator for filter conditions.

    For example, if you want to review that a configuration item \(CI\) is compromised, you select a CI. You then correlate the CI with techniques that are present by adding a MITRE-ATT&CK Technique ID. You can then continue to build your filter criteria to correlate the information and for threat hunting.


**Parent Topic:**[Using MITRE-ATT&CK to detect and analyze threats](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/mitre-att-ck-features.md)

**Related topics**  


[Associate MITRE-ATT&CK information with security incidents]()

[Associate MITRE-ATT&CK information with observables]()

[Associate MITRE-ATT&CK information with security case]()

[Rollup MITRE-ATT&CK information using Threat Lookup results]()

[Rollup MITRE-ATT&CK information from detection rules]()

[Rollup MITRE-ATT&CK information from child security incidents]()

[MITRE-ATT&CK heat map and navigator]()

[Using the MITRE-ATT&CK dashboard]()