---
title: Rollup MITRE-ATT&CK information from detection rules
description: Enable rollup of MITRE-ATT&CK information from the detection rules to the security incidents for better security incident and threat analysis.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/rollup-mitre-attack-information-detection-rules.html
release: australia
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 3
breadcrumb: [Using MITRE-ATT&CK to detect and analyze threats, MITRE-ATT&CK framework overview, Threat Intelligence, Enterprise security case management applications, Security Operations]
---

# Rollup MITRE-ATT&CK information from detection rules

Enable rollup of MITRE-ATT&CK information from the detection rules to the security incidents for better security incident and threat analysis.

## Before you begin

Role required: none.

Ensure that you have performed the following:

-   Enable the Rollup MITRE ATT&ACK information automatically from alert rules to security incidents property in the Properties module. By default, this option is disabled. For more information, see [Review the MITRE-ATT&CK system properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/configure-mitre-att-ck-properties.md).
-   Perform mapping of detection rules to MITRE-ATT&CK TTPs in Detection Rules - MITRE ATT&CK TTP Mapping module. The detection rule name must match the alert rule name that triggers the security incident. For more information, see [Create and map detection rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/create-detection-rules.md).

## About this task

If you do not intend to use the base system SIEM auto-extraction rules, then enable the automatic rollup of MITRE-ATT&CK TTPs based on the detection rule mapping. You can populate the alert or event rule that triggers the security incident in the Alert Rule name field. You can also populate the Alert Rule name field by using SIEM integration, email parsing, manual creation, and so on.

## Procedure

1.  Navigate to **MITRE ATT&CK Administration** > **Properties**.

2.  Enable the Rollup MITRE ATT&ACK information automatically from alert rules to security incidents property, and select **Save**.

    By default, this option is disabled.

3.  You need to populate the **Alert Rule** name field of the security incident with the required alert rules.

    **Note:** Ensure that you add the exact Alert Rule name. To add multiple rules, you need to add the rules using a comma separator.

4.  Right-click the form, and select **Save**.

    If the alert rule name value in the security incident matches a record in the Detection rule - MITRE ATT&CK TTP Mapping module, the corresponding techniques and tactics associated to the alert rule are linked to the security incident automatically.

5.  Open the security incident, select the **MITRE ATT&CK Card** and validate whether the techniques are rolled up.

6.  Enable **Show origin of techniques** option to view the origin of the techniques.

    The origin of techniques should be Detection Rule.


**Parent Topic:**[Using MITRE-ATT&CK to detect and analyze threats](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/mitre-att-ck-features.md)

**Related topics**  


[Associate MITRE-ATT&CK information with security incidents]()

[Associate MITRE-ATT&CK information with observables]()

[Associate MITRE-ATT&CK information with security case]()

[Rollup MITRE-ATT&CK information using Threat Lookup results]()

[Rollup MITRE-ATT&CK information from child security incidents]()

[Perform link analysis and threat hunting using MITRE-ATT&CK specific filters]()

[MITRE-ATT&CK heat map and navigator]()

[Using the MITRE-ATT&CK dashboard]()