---
title: Extend the MITRE-ATT&CK data
description: Extend the MITRE-ATT&CK repository data in the ServiceNow AI Platform by enriching it.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/view-and-extend-information.html
release: australia
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 5
breadcrumb: [MITRE-ATT&CK administration, MITRE-ATT&CK framework overview, Threat Intelligence, Enterprise security case management applications, Security Operations]
---

# Extend the MITRE-ATT&CK data

Extend the MITRE-ATT&CK repository data in the ServiceNow AI Platform by enriching it.

## Before you begin

Role required:

-   sn\_ti.admin: delete access
-   sn\_ti.read: read access
-   sn\_ti.write: create, write access

## About this task

You can extend the Malware, Group, Mitigation, and Tool objects to a technique in the MITRE-ATT&CK repository.

You can create an object and establish a relationship between a technique and the new object in the MITRE ATT&CK Repository module. But, you can't define the relationship type in this module. For more information about defining relationship types, see [object to object relationships](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/define-object-object.md). To define a relationship type, navigate to the **Threat Intelligence** > **IoC Repository** > **Object-Object Relationships** module.

If you map the relationship type between an existing technique and an existing object, then you must define the technique as the target object and the object as the source object. To do so, navigate to the **IoC Repository** > **Object-Object Relationships** module.

You can create a group and associate it with an attack pattern. But, in the MITRE ATT&CK Repository, you can only establish the relationship between the group and the attack pattern. To define the object-to-object relationship type, you must do so in the IoC Repository.

**Note:** Any customizations that you make to the objects are saved during scheduled updates.

## Procedure

1.  Navigate to **Threat Intelligence** > **MITRE ATT&CK Repository** > **Techniques**.

2.  Select a techniques or sub-technique to view all the associated information with this technique.

3.  Select a related list to enrich its data to associate it with a new group.


**Parent Topic:**[MITRE-ATT&CK administration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/mitre-att-ck-administration.md)

**Related topics**  


[Get started with MITRE-ATT&CK framework]()

[Understand the MITRE to STIX data model]()

[Domain separation and MITRE-ATT&CK]()

[Set up the MITRE-ATT&CK framework]()

[Manage matrices]()

[Manage techniques]()

[Manage mitigations]()

[Manage groups]()

[Manage malware]()

[Manage tools]()

[Manage MITRE relationships]()

[Manage CVE and technique mapping]()

[Define the data source and detection tool mapping]()

[Define the data source and data component mapping]()

[Define the technique detection coverage]()

[Map your technique detection coverage to a technique]()

[Define the mitigation coverage]()

[Map your mitigation coverage to a technique]()

[Create and map detection rules]()

[Auto-extract technique rules for importing MITRE-ATT&CK information]()

[Review threat group and MITRE-ATT&CK techniques mapping]()

[Threat group to technique heatmap definition]()

[Review the MITRE-ATT&CK system properties]()