---
title: Roll up of MITRE Techniques from Artifacts to Case
description: When intelligence records are added to a case, all associated MITRE Techniques are automatically rolled up to the case level.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/roll-up-mitre-case.html
release: australia
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 1
breadcrumb: [Add artifacts to cases or case tasks, Threat Analyst Workbench, Use, Threat Intelligence Security Center, Security Operations]
---

# Roll up of MITRE Techniques from Artifacts to Case

When intelligence records are added to a case, all associated MITRE Techniques are automatically rolled up to the case level.

## Before you begin

Role required: admin

## About this task

Only the associations that come from tactic and technique pairs that MITRE currently maps are rolled up to the case. A pair that MITRE has stopped mapping is excluded from the roll-up and from the technique counts on the case. For more information, see [Review revoked MITRE tactic and technique associations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-review-revoked-mitre-associations.md).

## Procedure

1.  Navigate to **Workspaces** > **Threat Intelligence Security Center**.

2.  Click the **Threat Analyst Workbench** icon.

3.  Go to **Case Management** > **All Cases**.

    All the cases are displayed.

4.  Select any case.

5.  Go to **Artifacts** tab.

    The associated artifacts are displayed as the related lists for that specific case.


**Parent Topic:**[Add artifacts to cases or case tasks](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/add-artifacts-to-a-case-s.md)