Get techniques from the MITRE ATT&CK framework with token-optimized responses.

Args: domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) include_subtechniques: Include subtechniques in the result remove_revoked_deprecated: Remove revoked or deprecated objects include_descriptions: Whether to include technique descriptions (uses more tokens) limit: Maximum number of techniques to return (default: 20) offset: Index to start from when returning techniques (for pagination)

Returns: Dictionary containing a list of techniques and pagination metadata

Get all tactics from the MITRE ATT&CK framework.

Args: domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) remove_revoked_deprecated: Remove revoked or deprecated objects

Returns: Dictionary containing a list of tactics

Get all groups from the MITRE ATT&CK framework.

Args: domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) remove_revoked_deprecated: Remove revoked or deprecated objects

Returns: Dictionary containing a list of groups

Get all software from the MITRE ATT&CK framework.

Args: domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) remove_revoked_deprecated: Remove revoked or deprecated objects software_types: Optional list of ATT&CK object types to include (e.g., ["malware"])

Returns: Dictionary containing a list of software

Get techniques by tactic.

Args: tactic_shortname: The shortname of the tactic (e.g., 'defense-evasion') domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) remove_revoked_deprecated: Remove revoked or deprecated objects

Returns: Dictionary containing a list of techniques

Get techniques used by a group.

Args: group_name: The name of the group domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack)

Returns: Dictionary containing the group and a list of techniques

Get all mitigations from the MITRE ATT&CK framework.

Args: domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack) remove_revoked_deprecated: Remove revoked or deprecated objects

Returns: Dictionary containing a list of mitigations

Get techniques mitigated by a mitigation.

Args: mitigation_name: The name of the mitigation domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack)

Returns: Dictionary containing the mitigation and a list of techniques

Get a technique by its MITRE ATT&CK ID.

Args: technique_id: The MITRE ATT&CK ID of the technique (e.g., 'T1055') domain: Domain to query (enterprise-attack, mobile-attack, or ics-attack)

Returns: Dictionary containing the technique