--- title: "Enriching Data With Tags From the MITRE ATT&CK Source | ThreatConnect" slug: "enriching-data-with-tags-from-the-mitre-attack-source" description: "This article describes how to copy Tags from the MITRE ATT&CK Source to your Organization and use them to enrich ThreatConnect data in your Organization." tags: ["Enriching Data"] updated: 2024-01-23T14:47:14Z published: 2024-01-23T14:47:14Z canonical: "knowledge.threatconnect.com/enriching-data-with-tags-from-the-mitre-attack-source" deprecated: true --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # Enriching Data With Tags From the MITRE ATT&CK Source > **Deprecated.** System-generated [ATT&CK Tags](https://knowledge.threatconnect.com/docs/attack-tags) that represent techniques and sub-techniques in the MITRE ATT&CK Enterprise Matrix were added to ThreatConnect starting with version 7.2, and support for ATT&CK Tags was added to the **MITRE ATT&CK** App starting with version 2.0.3. If you are on a ThreatConnect instance with version 7.2 or newer installed and use the MITRE ATT&CK App version 2.0.3 or newer, use system-generated ATT&CK Tags to enrich ThreatConnect objects with MITRE ATT&CK data instead of copying Tags from the **MITRE ATT&CK** Source to your Organization for enrichment purposes. To enrich ThreatConnect® objects in your Organization with metadata created by the **MITRE ATT&CK****®** App, you must copy [Tags](/v1/docs/applying-tags) in the **MITRE ATT&CK** Source to your Organization. This process makes the Tags available for association with other objects in the Organization, allowing those objects essentially to be labeled with ATT&CK® techniques, sub-techniques, and tactics. The **MITRE ATT&CK** Source contains a [Document Group](https://knowledge.threatconnect.com/v1/docs/the-threatconnect-data-model#group-types) named **MITRE ATT&CK** that is associated to all Tags in the Source. Copying this Group to your Organization will also copy all Tags in the **MITRE ATT&CK** Source, as long as you choose to create Tags that do not exist during the copying process. It is the easiest way to move ATT&CK data in ThreatConnect to your Organization for immediate use in data enrichment. NoteIf you added MITRE ATT&CK data objects to an existing owner via a [manually created Job](/v1/docs/mitre-attack-manual-job-configuration), follow the same process described in the following section to copy the **MITRE ATT&CK** Document and all associated Tags from that owner to your Organization. ## Copying Tags From the MITRE ATT&CK Source to Your Organization 1. On the top navigation bar, hover over **Browse** and select **Document**. All Document Groups in the owners selected in the [**My Intel Sources** selector](https://knowledge.threatconnect.com/docs/the-browse-screen#my-intel-sources-selector) will be displayed on the [**Browse** screen](https://knowledge.threatconnect.com/v1/docs/the-browse-screen). 2. Click the **My Intel Sources** selector at the upper-left corner of the **Browse** screen, locate the **MITRE ATT&CK** Source in the **Intel Sources** section, hover over it, and click![View Only Eye icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/View%20Only%20Eye%20icon.png)**only** (Figure 1). Only the one Document Group in the **MITRE ATT&CK** Source will be displayed on the screen.NoteYou can also use the **Filter sources** bar in the **My Intel Sources** selector to filter the list of Sources to display only the **MITRE ATT&CK** Source. ![Graphical user interface, text, application, email Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_Enriching%20Data%20With%20Tags%20From%20the%20MITRE%20ATT&CK%20Source_7.1.0.png) 3. Hover over the **MITRE ATT&CK** Document Group’s entry on the **Browse** screen and click on one of the following icons displayed in its **Summary** cell to navigate to its **Details** screen: - **View full details![View full details_Browse](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/View%20full%20details_Browse.png)**: Click this icon to open the Group’s **Details** screen in the current browser tab. - **View full details in new tab![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/View%20full%20details%20in%20new%20tab%20icon.png)**: Click this icon to open the Group’s **Details** screen in a new browser tab 4. Click the **Revert to Legacy View** button on the Document Group’s **Details** screen to navigate to its [legacy **Details** screen](https://knowledge.threatconnect.com/docs/the-details-screen-legacy). 5. The Document Group contains a **.txt** file that is a placeholder document with no contents of value, but it is associated with all of the MITRE ATT&CK Tags. To copy the Group and its associations to your Organization, click the **Copy To My Org** button in the header of the [legacy **Details** screen](https://knowledge.threatconnect.com/docs/the-details-screen-legacy). The **Initial** tab of the **Copy Data** window will be displayed (Figure 2). ![Graphical user interface, text, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_Enriching%20Data%20With%20Tags%20From%20the%20MITRE%20ATT&CK%20Source_7.1.0.png) - Select **NEW GROUP** to copy the Document Group to your Organization as a new Group. - **Group Name**: The name of the Document Group (**MITRE ATT&CK**) will be displayed automatically after you select **NEW GROUP**. - Click the **Next** button. 6. The **Data** tab of the **Copy Data** window will be displayed (Figure 3). ![Graphical user interface Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%203_Enriching%20Data%20With%20Tags%20From%20the%20MITRE%20ATT&CK%20Source_7.1.0.png) - **Copy Attributes?**: Keep the selection of **Yes** to copy all information in the Document’s Group's Attributes. - **Include Tags?**: Keep the selection of **Yes** to include all Tags associated with the Document Group. - **Create Tags that Don’t Exist?**: Select **Yes** to create all Tags that do not already exist in your Organization. - **Copy Associated Groups?**: Keep the selection of **No**. - Click the **Next** button. 7. The **Security Labels** tab of the **Copy Data** window will be displayed (Figure 4). ![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%204_Enriching%20Data%20With%20Tags%20From%20the%20MITRE%20ATT&CK%20Source_7.1.0.png) - There are no Security Labels associated with data in the **MITRE ATT&CK** Source, so you can keep all default selections on this tab. - Click the **Next** button. 8. The **Save** tab of the **Copy Data** window will be displayed (Figure 5). This tab lists all objects to be copied to your Organization—that is, the **MITRE ATT&CK** Document Group. ![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%205_Enriching%20Data%20With%20Tags%20From%20the%20MITRE%20ATT&CK%20Source_7.2.0.png) - **Merge Hashes**: Leave this checkbox cleared. - Click the **SAVE** button to complete the copying process. To view the Document Group or any of the Tags copied to your Organization, return to the **Browse** screen, toggle on the **View **** slider and clear the checkbox for **MITRE ATT&CK** Source in the **My Intel Sources** selector, and use the [object filters](https://knowledge.threatconnect.com/docs/the-browse-screen#object-filters) to display only Document Groups or Tags in your Organization. ## Using Tags to Enrich Data After you copy Tags from the **MITRE ATT&CK** Source to your Organization, you can enrich Groups and Indicators in your Organization by applying the Tags to them, which also creates [associations](https://knowledge.threatconnect.com/v1/docs/associations) to the Tags. When [applying Tags](https://knowledge.threatconnect.com/docs/applying-tags) copied from the **MITRE ATT&CK** Source, utilize the auto-complete feature to ensure that you use the proper syntax and select the correct Tag, as shown in Figure 6. ![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%206_Enriching%20Data%20With%20Tags%20From%20the%20MITRE%20ATT&CK%20Source_7.1.0.png) --- *ThreatConnect® is a registered trademark of ThreatConnect, Inc.* *MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.* 20119-10 v.04.A