Generate an ATT&CK Navigator layer for visualization.

This wraps mitreattack.navlayers.UsageLayerGenerator and produces a
JSON layer highlighting techniques associated with a given ATT&CK ID.

Only the following ATT&CK ID prefixes are supported:
  - Gxxxx : groups (intrusion sets)
  - Mxxxx : mitigations (course-of-action)
  - Sxxxx : software (tool/malware)
  - Dxxxx : data components

Technique IDs (Txxxx / Txxxx.xxx) are NOT supported here.

Args:
    attack_id: ATT&CK ID (Gxxxx, Mxxxx, Sxxxx, or Dxxxx)
    score: Score to assign to all matched techniques in the layer
    domain: ATT&CK domain (e.g., "enterprise", "mobile", "ics")

Returns:
    {
      "success": bool,
      "attack_id": "<G/M/S/D ID>",
      "domain": "<domain>",
      "count": int,              # number of techniques in layer
      "layer": { ... } | null,   # ATT&CK Navigator layer JSON
      "message": "<summary or error>"
    }

Get all ATT&CK assets in a domain (primarily ICS).

Assets represent industrial control system components 
(PLC, HMI, Engineering Workstation, Control Server, etc.)

Args:
    domain: ATT&CK domain ("ics" recommended)
    remove_revoked_deprecated: Exclude revoked/deprecated entries
    include_description: Include asset descriptions

Returns:
    {
      "domain": "<domain>",
      "count": <number>,
      "assets": [
        {
          "name": "...",
          "stix_id": "x-mitre-asset--UUID",
          "description": "...",
          "attack_id": "<Axxxx or None>"
        }
      ],
      "formatted": "<human-readable output>",
      "message": "<summary>"
    }

Get all ATT&CK campaigns in a domain.

Campaigns represent specific intrusion events or long-running operations 
attributed to threat actors (e.g., SolarWinds, Operation Ghost).

Args:
    domain: ATT&CK domain ("enterprise", "mobile", "ics")
    remove_revoked_deprecated: Whether to exclude revoked/deprecated entries
    include_description: Include campaign descriptions in the output

Returns:
    {
      "domain": "<domain>",
      "count": <int>,
      "campaigns": [
         {
            "attack_id": "<Cxxxx or None>",
            "name": "<campaign name>",
            "stix_id": "campaign--UUID",
            "description": "<text or null>"
         },
         ...
      ],
      "formatted": "<nicely formatted output>",
      "message": "<summary>"
    }

Get all ATT&CK data components in a domain.

Data components are specific aspects of a data source that can be monitored.
For example, the "Process" data source has components like
"Process Creation", "Process Termination", etc.

Args:
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    remove_revoked_deprecated: Whether to exclude revoked/deprecated entries.
    include_description: Whether to include descriptions.

Returns:
    {
      "domain": "<domain>",
      "count": <number of data components>,
      "datacomponents": [
        {
          "name": "<data component name>",
          "stix_id": "<x-mitre-data-component--UUID>",
          "description": "<text or null>",
          "data_source_stix_id": "<x-mitre-data-source--UUID or null>",
          "data_source_name": "<parent data source name or null>",
          "data_source_attack_id": "<data source ATT&CK ID or null>"
        },
        ...
      ],
      "formatted": "<optional human-readable output>",
      "message": "<summary>"
    }

Get all ATT&CK data sources in a domain.

Data sources represent *what* kind of telemetry you collect
(e.g., Process Monitoring, Network Traffic, File Monitoring).

Args:
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    remove_revoked_deprecated: Whether to exclude revoked/deprecated data sources.
    include_description: Whether to include descriptions.

Returns:
    {
      "domain": "<domain>",
      "count": <number of data sources>,
      "datasources": [
        {
          "name": "<data source name>",
          "stix_id": "<x-mitre-data-source--UUID>",
          "description": "<text or null>",
          "platforms": ["<Windows>", "<Linux>", ...]  # if available
        },
        ...
      ],
      "formatted": "<optional human-readable output>",
      "message": "<summary>"
    }

Get all APT groups (intrusion sets) in a domain.

Args:
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    remove_revoked_deprecated: Whether to exclude revoked/deprecated groups.
    include_description: Whether to include descriptions.

Returns:
    {
      "domain": "<domain>",
      "count": <number of groups>,
      "groups": [
        {
          "attack_id": "GXXXX",
          "name": "<group name>",
          "aliases": [...],
          "stix_id": "<intrusion-set--UUID>",
          "description": "<text or null>"
        },
        ...
      ],
      "formatted": "<optional human-readable listing>",
      "message": "<summary>"
    }

Get all ATT&CK matrices in a domain.

Matrices are the top-level organizational structures in ATT&CK.
Each domain typically has one or more matrices
(e.g., Enterprise ATT&CK matrix).

Args:
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    remove_revoked_deprecated: Whether to exclude revoked/deprecated matrices.
    include_description: Whether to include descriptions.

Returns:
    {
      "domain": "<domain>",
      "count": <number of matrices>,
      "matrices": [
        {
          "attack_id": "<matrix ID or None>",
          "name": "<matrix name>",
          "stix_id": "<x-mitre-matrix--UUID>",
          "description": "<text or null>"
        },
        ...
      ],
      "formatted": "<optional human-readable output>",
      "message": "<summary>"
    }

Get all mitigations (defensive countermeasures) in a domain.

Mitigations are security controls or practices that can reduce the
effectiveness of adversary techniques (e.g., M1013, M1017).

Args:
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    remove_revoked_deprecated: Whether to exclude revoked/deprecated mitigations.
    include_description: Whether to include descriptions.

Returns:
    {
      "domain": "<domain>",
      "count": <number of mitigations>,
      "mitigations": [
        {
          "attack_id": "MXXXX" | null,
          "name": "<mitigation name>",
          "stix_id": "<course-of-action--UUID>",
          "description": "<text or null>"
        },
        ...
      ],
      "formatted": "<optional human-readable output>",
      "message": "<summary>"
    }

Get all parent techniques (exclude subtechniques) in a given domain.

Parent techniques are the main techniques without a dot in their ATT&CK ID,
e.g., T1566, T1055 (not T1566.001).

Args:
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    remove_revoked_deprecated: Whether to exclude revoked/deprecated techniques.
    include_description: Whether to include descriptions.

Returns:
    {
      "domain": "<domain>",
      "count": <number of parent techniques>,
      "parent_techniques": [
        {
          "attack_id": "<TXXXX>",
          "name": "<technique name>",
          "stix_id": "<attack-pattern--UUID>",
          "description": "<text or null>",
          "tactics": ["<Tactic 1>", "<Tactic 2>", ...]
        },
        ...
      ],
      "formatted": "<optional human-readable output>",
      "message": "<summary>"
    }

Get all software (malware and tools) in a domain.

This is effectively an alias for the MITRE helper get_software(), but it
returns structured results suitable for LLMs and clients.

Args:
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    remove_revoked_deprecated: Whether to exclude revoked/deprecated software.
    include_description: Whether to include descriptions.

Returns:
    {
      "domain": "<domain>",
      "count": <number of software objects>,
      "software": [
        {
          "attack_id": "<SXXXX or similar> | null",
          "name": "<software name>",
          "aliases": [...],
          "stix_id": "<malware--UUID or tool--UUID>",
          "type": "<malware|tool|...>",
          "description": "<text or null>"
        },
        ...
      ],
      "formatted": "<optional human-readable listing>",
      "message": "<summary>"
    }

Get all subtechniques in a given ATT&CK domain.

Subtechniques are more specific versions of parent techniques,
e.g., T1566.001 and T1566.002 are subtechniques of T1566.

Args:
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    remove_revoked_deprecated: Whether to exclude revoked/deprecated subtechniques.
    include_description: Whether to include descriptions.

Returns:
    {
      "domain": "<domain>",
      "count": <number of subtechniques>,
      "subtechniques": [
        {
          "attack_id": "<TXXXX.YYY>",
          "name": "<subtechnique name>",
          "stix_id": "<attack-pattern--UUID>",
          "description": "<text or null>",
          "tactics": ["<Tactic 1>", "<Tactic 2>", ...],
          "parent_attack_id": "<TXXXX>",
          "parent_name": "<parent technique name>",
          "parent_stix_id": "<attack-pattern--UUID>"
        },
        ...
      ],
      "formatted": "<optional human-readable output>",
      "message": "<summary>"
    }

Get all ATT&CK tactics for a domain.

Tactics represent the adversary's tactical goals (e.g., Initial Access,
Defense Evasion, Persistence).

Args:
    domain: ATT&CK domain ('enterprise', 'mobile', 'ics')
    include_description: Whether to include tactic descriptions.

Returns:
    {
      "domain": "<domain>",
      "count": <number>,
      "tactics": [
         {
           "attack_id": "<TAxxxx>" | null,
           "name": "...",
           "stix_id": "x-mitre-tactic--UUID",
           "description": "...",
         }
      ],
      "formatted": "<optional human-readable text>",
      "message": "<summary>"
    }

Get all ATT&CK techniques for a given domain.

Args:
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    remove_revoked_deprecated: Whether to exclude revoked/deprecated techniques.
    include_description: Whether to include technique descriptions.

Returns:
    {
      "domain": "<domain>",
      "count": <number of techniques>,
      "techniques": [
        {
          "attack_id": "TXXXX or TXXXX.YYY",
          "name": "<technique name>",
          "stix_id": "<attack-pattern--UUID>",
          "description": "<text or null>",
          "tactics": [ "<tactic 1>", "<tactic 2>", ... ]
        },
        ...
      ],
      "formatted": "<optional human-readable output>",
      "message": "<summary>"
    }

Get all ICS assets targeted by a specific technique.

Assets represent industrial control system components such as
PLCs, RTUs, Engineering Workstations, HMIs, Control Servers, etc.

Args:
    technique_stix_id: Technique STIX UUID identifier
    domain: ATT&CK domain ('ics' strongly recommended)
    include_description: Include asset descriptions, if available

Returns:
    {
      "technique": {
          "attack_id": "Txxxx",
          "name": "...",
          "stix_id": "<attack-pattern--UUID>"
      },
      "count": int,
      "assets": [
        {
          "name": "...",
          "stix_id": "<x-mitre-asset--UUID>",
          "description": "<optional text>",
          "asset_type": "<ICS component type>",
        },
        ...
      ],
      "formatted": "<multi-line readable text>",
      "message": "<summary>"
    }

Convert a STIX UUID into its human-readable ATT&CK ID.

This tool resolves internal STIX identifiers such as:
    attack-pattern--UUID
    malware--UUID
    intrusion-set--UUID
    tool--UUID
    course-of-action--UUID

into ATT&CK IDs such as:
    T1566      (Technique)
    T1055.002  (Sub-technique)
    G0016      (Group)
    S0154      (Software)
    M1013      (Mitigation)

Args:
    stix_id: Full STIX UUID identifier.
    domain: ATT&CK domain ("enterprise", "mobile", "ics").

Returns:
    {
      "found": bool,
      "attack_id": "<ATT&CK ID or null>",
      "message": "<status message>"
    }

Get all campaigns attributed to a specific intrusion set (APT group),
identified by its STIX ID.

Campaigns represent specific operations or intrusion events attributed
to a threat group.

Args:
    group_stix_id: STIX UUID of the group (e.g., "intrusion-set--UUID").
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    include_description: Whether to include campaign descriptions.

Returns:
    {
      "group": {
          "attack_id": "GXXXX" | null,
          "name": "<group name or null>",
          "stix_id": "<intrusion-set--UUID>",
          "description": "<text or null>"
      } | null,

      "count": <number of campaigns>,

      "campaigns": [
        {
          "attack_id": "CXXXX" | null,
          "name": "<campaign name>",
          "stix_id": "<campaign--UUID>",
          "description": "<text or null>"
        },
        ...
      ],

      "formatted": "<formatted human-readable block>",
      "message": "<status summary>"
    }

Get campaigns by their alias.

Campaigns frequently have multiple names assigned by different vendors
or research teams. This function resolves those aliases.

Args:
    alias: Campaign alias or alternate name (case-insensitive)
    domain: ATT&CK domain ("enterprise", "ics", etc.)
    include_description: Include campaign descriptions in output

Returns:
    {
      "alias": "<requested name>",
      "count": int,
      "campaigns": [
        {
          "name": "...",
          "stix_id": "<campaign--UUID>",
          "attack_id": "Cxxxx" | null,
          "description": "..." | null
        },
        ...
      ],
      "formatted": "<multi-line readable text>",
      "message": "<summary>"
    }

Get all campaigns that use specific software/malware.

This is a reverse lookup: Software → Campaigns.

Args:
    software_stix_id: Software STIX UUID identifier (e.g., 'malware--UUID', 'tool--UUID').
    domain: ATT&CK domain ('enterprise', 'mobile', 'ics').
    include_description: Whether to include campaign descriptions.

Returns:
    {
      "software": {
          "attack_id": "SXXXX or similar" | null,
          "name": "<software name or null>",
          "stix_id": "<software STIX ID>",
          "type": "<malware|tool|...> or null",
          "description": "<text or null>",
      } | null,

      "count": <number of campaigns>,

      "campaigns": [
        {
          "attack_id": "CXXXX" | null,
          "name": "<campaign name>",
          "stix_id": "<campaign--UUID>",
          "description": "<text or null>",
          "relationships": [
            {
              "stix_id": "<relationship--UUID>",
              "relationship_type": "<type>",
              "description": "<relationship description or null>",
              "source_ref": "<source STIX ID>",
              "target_ref": "<target STIX ID>",
            },
            ...
          ]
        },
        ...
      ],

      "formatted": "<human-readable list of campaigns>",
      "message": "<status summary>"
    }

Get all campaigns that use a specific technique.

This is a reverse lookup: Technique → Campaigns.

Args:
    technique_stix_id: Technique STIX UUID identifier
                       (e.g., 'attack-pattern--UUID').
    domain: ATT&CK domain ('enterprise', 'mobile', 'ics').
    include_description: Whether to include campaign descriptions.

Returns:
    {
      "technique": {
          "attack_id": "TXXXX or TXXXX.YYY" | null,
          "name": "<technique name or null>",
          "stix_id": "<attack-pattern--UUID>",
          "description": "<text or null>",
      } | null,

      "count": <number of campaigns>,

      "campaigns": [
        {
          "attack_id": "CXXXX" | null,
          "name": "<campaign name>",
          "stix_id": "<campaign--UUID>",
          "description": "<text or null>",
          "relationships": [
            {
              "stix_id": "<relationship--UUID>",
              "relationship_type": "<type>",
              "description": "<relationship description or null>",
              "source_ref": "<source STIX ID>",
              "target_ref": "<target STIX ID>",
            },
            ...
          ]
        },
        ...
      ],

      "formatted": "<human-readable list of campaigns>",
      "message": "<status summary>"
    }

Get all data components that can detect a specific technique.

Primary mode:
  - Use mitreattack-python relationship traversal (if present)

Fallback mode (when relationship traversal yields 0):
  - Read technique.x_mitre_data_sources (strings)
  - Resolve data source objects by name
  - Return data components whose x_mitre_data_source_ref points to those data sources
  - If the string includes a component name (e.g., "Process: Process Creation"),
    filter to that component when possible.

Returns the same structure as before, plus a debug block.

Retrieve an intrusion set (APT group) by name or alias (case-insensitive match).

This tool searches ATT&CK intrusion sets by name or alias and returns the first
matching group. Matching is case-insensitive and supports partial matches.

Examples:
    - get_group_by_name("APT29")
    - get_group_by_name("Lazarus")
    - get_group_by_name("Fancy Bear")

Args:
    group_name: The group name or alias to search for (case-insensitive).
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    include_description: Whether to include descriptions in the output.

Returns:
    {
      "found": bool,
      "group": {
          "attack_id": "<GXXXX>",
          "name": "<group name>",
          "aliases": [...],
          "stix_id": "<intrusion-set--...>",
          "description": "<description or null>"
      },
      "formatted": "<human-readable text>",
      "message": "<status>"
    }

Get all APT groups (intrusion sets) attributed to a specific campaign.

This is a reverse lookup: Campaign → Groups.
It follows attribution relationships from a campaign STIX ID to
intrusion sets (groups).

Args:
    campaign_stix_id: STIX ID of the campaign (e.g., "campaign--UUID").
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    include_description: Whether to include group descriptions.

Returns:
    {
      "campaign": {
          "attack_id": "CXXXX" | null,
          "name": "<campaign name or null>",
          "stix_id": "<campaign--UUID>",
          "description": "<text or null>"
      } | null,

      "count": <number of groups>,

      "groups": [
        {
          "attack_id": "GXXXX" | null,
          "name": "<group name>",
          "aliases": [...],
          "stix_id": "<intrusion-set--UUID>",
          "description": "<text or null>",
          "relationships": [
            {
              "stix_id": "<relationship--UUID>",
              "relationship_type": "<type>",
              "description": "<relationship description or null>",
              "source_ref": "<source STIX ID>",
              "target_ref": "<target STIX ID>",
            },
            ...
          ]
        },
        ...
      ],

      "formatted": "<human-readable list of groups>",
      "message": "<status summary>"
    }

Get APT groups (intrusion sets) matching a given alias.

Many groups have multiple aliases—e.g., APT29 is also known as:
"Cozy Bear", "NOBELIUM", "Midnight Blizzard", etc.

This tool returns all groups whose alias list contains the given alias
(case-insensitive exact match, per MITRE's own alias indexing).

Args:
    alias: Alias to search for (e.g., "Cozy Bear", "NOBELIUM").
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    include_description: Whether to include group descriptions.

Returns:
    {
      "count": <number>,
      "groups": [
        {
          "attack_id": "GXXXX",
          "name": "<group name>",
          "aliases": [...],
          "stix_id": "<intrusion-set--UUID>",
          "description": "<text or null>"
        },
        ...
      ],
      "formatted": "<formatted list>",
      "message": "<status summary>"
    }

Get all APT groups (intrusion sets) that use a specific software/malware.

This is a reverse lookup: Software → Groups.
It follows 'uses' relationships from a software STIX ID (tool/malware)
to intrusion sets.

Args:
    software_stix_id: STIX ID of the software object
                      (e.g., "malware--UUID", "tool--UUID").
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    include_description: Whether to include group descriptions.

Returns:
    {
      "software": {
          "attack_id": "SXXXX or similar" | null,
          "name": "<software name or null>",
          "stix_id": "<software STIX ID>",
          "type": "<tool|malware|...> or null",
          "description": "<text or null>",
      } | null,

      "count": <number of groups>,

      "groups": [
        {
          "attack_id": "GXXXX" | null,
          "name": "<group name>",
          "aliases": [...],
          "stix_id": "<intrusion-set--UUID>",
          "description": "<text or null>",
          "relationships": [
            {
              "stix_id": "<relationship--UUID>",
              "relationship_type": "uses",
              "description": "<relationship description or null>",
              "source_ref": "<source STIX ID>",
              "target_ref": "<target STIX ID>",
            },
            ...
          ]
        },
        ...
      ],

      "formatted": "<human-readable list of groups>",
      "message": "<status summary>"
    }

Get all APT groups (intrusion sets) that use a specific technique.

This is a reverse lookup: Technique → Groups.
It follows 'uses' relationships from a technique STIX ID to intrusion sets.

Args:
    technique_stix_id: STIX ID of the technique
                       (e.g., "attack-pattern--UUID").
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    include_description: Whether to include group descriptions.

Returns:
    {
      "technique": {
          "attack_id": "TXXXX or TXXXX.YYY" | null,
          "name": "<technique name or null>",
          "stix_id": "<attack-pattern--UUID>",
          "description": "<text or null>",
      } | null,

      "count": <number of groups>,

      "groups": [
        {
          "attack_id": "GXXXX" | null,
          "name": "<group name>",
          "aliases": [...],
          "stix_id": "<intrusion-set--UUID>",
          "description": "<text or null>",
          "relationships": [
            {
              "stix_id": "<relationship--UUID>",
              "relationship_type": "uses",
              "description": "<relationship description or null>",
              "source_ref": "<source STIX ID>",
              "target_ref": "<target STIX ID>",
            },
            ...
          ]
        },
        ...
      ],

      "formatted": "<human-readable list of groups>",
      "message": "<status summary>"
    }

Get all techniques used by a specific APT group (intrusion set).

This tool:
  1) Locates a group by name or alias (case-insensitive, partial match).
  2) Uses MITRE's get_techniques_used_by_group() to retrieve techniques
     related to that group (via 'uses' relationships).

Args:
    group_name: Group name or alias (e.g., "APT29", "Lazarus Group").
    domain: ATT&CK domain ("enterprise", "mobile", or "ics").
    include_description: Whether to include descriptions in the output.

Returns:
    {
      "found": bool,  # whether the group was found
      "group": {
          "attack_id": "GXXXX",
          "name": "...",
          "aliases": [...],
          "stix_id": "intrusion-set--...",
          "description": "..." | null
      } | null,
      "count": <number of techniques>,
      "techniques": [
        {
          "attack_id": "TXXXX or TXXXX.YYY",
          "name": "...",
          "stix_id": "attack-pattern--...",
          "description": "..." | null,
          "relationships": [
            {
              "stix_id": "relationship--...",
              "relationship_type": "uses",
              "description": "..." | null,
              "source_ref": "...",
              "target_ref": "..."
            },
            ...
          ]
        },
        ...
      ],
      "formatted": "<human-readable technique list>",
      "message": "<status summary>"
    }

Return a standard ATT&CK Navigator layer metadata template.

This provides default layer properties (version info, gradient settings,
layout, filters, etc.) adapted to a specific ATT&CK domain.

Useful for clients that want to build custom layers programmatically
without starting from scratch.

Args:
    domain: One of "enterprise", "mobile", "ics". Defaults to "enterprise".

Returns:
    {
      "success": bool,
      "domain": "<domain>",
      "metadata": { ... },  # Navigator layer metadata
      "message": "<summary>"
    }

Get all mitigations that address a specific technique.

Helper returns: list[RelationshipEntry[Mitigation]]
So each item is a wrapper that contains a Mitigation object (usually in `.object`).
We must unwrap before extracting fields.

Returns (same schema as before):
  {
    "found": bool,
    "technique": {...} | null,
    "count": int,
    "mitigations": [...],
    "formatted": str,
    "message": str
  }

Resolve the human-readable object name for a given STIX ID.

This converts internal STIX UUIDs such as:
    attack-pattern--UUID
    intrusion-set--UUID
    malware--UUID
    tool--UUID
    course-of-action--UUID

into ATT&CK object names such as:
    "Phishing"
    "APT29"
    "Cobalt Strike"
    "Valid Accounts"

Args:
    stix_id: STIX UUID of the object.
    domain: ATT&CK domain ("enterprise", "mobile", "ics").

Returns:
    {
      "found": bool,
      "name": "<object name or null>",
      "message": "<status message>"
    }

Retrieve any MITRE ATT&CK object by its external ATT&CK ID and STIX type.

This tool supports techniques, intrusion sets (APT groups), malware,
tools, mitigations, campaigns, data sources, data components, and tactics.

Args:
    attack_id: The external ATT&CK ID (e.g., "T1055", "G0016", "S0154", "M1013").
    stix_type: The STIX object type (e.g., "attack-pattern", "intrusion-set").
    domain: ATT&CK domain ("enterprise", "mobile", or "ics").
    include_description: Whether to include the object's description field.

Returns:
    {
      "found": bool,
      "object": {
          "id": "<ATT&CK ID>",
          "name": "<object name>",
          "stix_id": "<STIX object ID>",
          "type": "<stix_type>",
          "description": "<description or null>"
      },
      "formatted": "<human-readable formatted output>",
      "message": "<status>"
    }

Retrieve any MITRE ATT&CK object by its STIX ID (UUID).

STIX IDs are internal identifiers like:
  - attack-pattern--a62a8db3-f23a-4d8f-afd6-9dbc77e7813b

This tool is useful when you already have a STIX ID from another
query or relationship and want to resolve it to the full object.

Args:
    stix_id: STIX object ID (e.g., "attack-pattern--...").
    domain: ATT&CK domain to search in ("enterprise", "mobile", "ics").
    include_description: Whether to include the object's description.

Returns:
    {
      "found": bool,
      "object": {
          "attack_id": "<ATT&CK external ID or null>",
          "name": "<object name>",
          "stix_id": "<STIX ID>",
          "type": "<stix type>",
          "description": "<description or null>"
      },
      "formatted": "<human-readable formatted text>",
      "message": "<status message>"
    }

Search MITRE ATT&CK objects by matching text inside their description field.

This performs a full-text search over object descriptions. It is useful for:
  • Finding techniques related to specific technologies (e.g., “PowerShell”)
  • Finding groups mentioning a region or country (e.g., “Russia”)
  • Finding mitigations referencing specific defenses (e.g., “multi-factor”)
  • Searching malware or tool descriptions for keywords

Args:
    content: The text to search for (case-insensitive, partial match).
    object_type: STIX object type, such as:
        - "attack-pattern" (techniques)
        - "intrusion-set" (APT groups)
        - "malware"
        - "tool"
        - "course-of-action" (mitigations)
        - "campaign"
        - "x-mitre-data-source"
        - "x-mitre-data-component"
        - etc.
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    include_description: Whether to return descriptions in the structured output.

Returns:
    {
      "count": <number of matches>,
      "objects": [
         {
            "attack_id": "<ATT&CK ID or null>",
            "name": "<object name>",
            "stix_id": "<STIX ID>",
            "type": "<object_type>",
            "description": "<description or null>"
         },
         ...
      ],
      "formatted": "<human-readable formatted list>",
      "message": "<status message>"
    }

Retrieve MITRE ATT&CK objects by exact name match (case-sensitive).

This tool performs an exact name match for a specific STIX type within
a given ATT&CK domain. It is more strict than generic search methods,
which typically perform partial or keyword matching.

Examples:
    - Technique: get_objects_by_name("Phishing", "attack-pattern")
    - Group: get_objects_by_name("APT29", "intrusion-set")
    - Malware: get_objects_by_name("Cobalt Strike", "malware")

Args:
    name: Exact object name to search for (case-sensitive).
    stix_type: STIX object type (same values as get_object_by_attack_id),
               e.g. "attack-pattern", "intrusion-set", "malware",
               "tool", "course-of-action", etc.
    domain: ATT&CK domain ("enterprise", "mobile", or "ics").
    include_description: Whether to include descriptions in the formatted output
                         and structured result.

Returns:
    {
      "count": <number of matching objects>,
      "objects": [
        {
          "attack_id": "<ATT&CK external ID or null>",
          "name": "<object name>",
          "stix_id": "<STIX ID>",
          "type": "<stix_type>",
          "description": "<description or null>"
        },
        ...
      ],
      "formatted": "<human-readable multi-object formatted text>",
      "message": "<status summary>"
    }

Get all objects of a specific STIX type.

This is a generic method to retrieve ATT&CK/CTI objects by STIX type.
It complements more specific tools such as get_all_techniques(),
get_all_groups(), etc.

Common STIX types include:
  - 'attack-pattern'          (techniques)
  - 'malware'                 (malware)
  - 'tool'                    (tools)
  - 'intrusion-set'           (APT groups)
  - 'campaign'                (campaigns)
  - 'course-of-action'        (mitigations)
  - 'x-mitre-matrix'          (matrices)
  - 'x-mitre-tactic'          (tactics)
  - 'x-mitre-data-source'     (data sources)
  - 'x-mitre-data-component'  (data components)
  - 'x-mitre-asset'           (ICS assets)

Args:
    stix_type: STIX object type to fetch.
    domain: ATT&CK domain ('enterprise', 'mobile', 'ics', ...).
    remove_revoked_deprecated: Exclude revoked/deprecated objects.
    include_description: Include object descriptions in output.

Returns:
    {
      "stix_type": "<type>",
      "domain": "<domain>",
      "count": int,
      "objects": [
        {
          "name": "...",
          "stix_id": "<stix-id>",
          "attack_id": "<T/G/S/M/C/... or null>",
          "description": "<text or null>",
        },
        ...
      ],
      "formatted": "<multi-line readable text>",
      "message": "<summary>"
    }

Get all ATT&CK objects created after a specific timestamp.

Useful for detecting new additions to the framework.
Timestamp must be ISO8601 format, e.g., '2024-01-01T00:00:00Z'.

Returns:
    {
        "found": bool,
        "count": int,
        "objects": [
            {
                "id": "<ATT&CK ID or None>",
                "name": "...",
                "stix_id": "...",
                "type": "<stix-type>",
                "description": "..." | None
            },
            ...
        ],
        "formatted": "<pretty text>",
        "message": "..."
    }

Get all ATT&CK objects modified after a specific timestamp.

Useful for tracking updates and changes to the ATT&CK framework.
Timestamp must be ISO8601 format, e.g., '2024-01-01T00:00:00Z'.

Returns:
    {
        "found": bool,
        "count": int,
        "objects": [
            {
                "id": "<ATT&CK ID or None>",
                "name": "...",
                "stix_id": "...",
                "type": "<stix-type>",
                "description": "..." | None
            },
            ...
        ],
        "formatted": "<pretty text>",
        "message": "..."
    }

Get the parent technique of a subtechnique.

Args:
    technique_stix_id: STIX UUID of the subtechnique.
    domain: ATT&CK domain ('enterprise', 'mobile', 'ics').
    include_description: Whether to include the parent's description.

Returns:
    {
      "subtechnique_stix_id": "...",
      "subtechnique_attack_id": "Txxxx.xxx" or null,
      "parent": {
          "attack_id": "Txxxx",
          "name": "...",
          "stix_id": "attack-pattern--UUID",
          "description": "..." | null
      } or null,
      "formatted": "<human readable description>",
      "message": "<summary>"
    }

Get all procedure examples for techniques in a specific tactic.

Shows real-world examples of how threat groups use techniques that fall
under a given tactic (e.g., Initial Access, Persistence).

Args:
    tactic: Tactic name (e.g., "Initial Access", "Persistence").
            Case-insensitive; should match ATT&CK tactic names.
    domain: ATT&CK domain ('enterprise', 'mobile', 'ics').
    include_description: Include example descriptions when available.

Returns:
    {
      "tactic": {
          "name": "<tactic name>",
          "attack_id": "TAxxxx" | null,
          "stix_id": "x-mitre-tactic--UUID" | null,
      },
      "count": int,
      "examples": [
        {
          "relationship_id": "relationship--UUID",
          "description": "<procedure text or null>",
          "group": {
            "attack_id": "Gxxxx" | null,
            "name": "<group name or null>",
            "stix_id": "intrusion-set--UUID" | null,
          },
          "technique": {
            "attack_id": "Txxxx or Txxxx.xxx" | null,
            "name": "<technique name or null>",
            "stix_id": "attack-pattern--UUID" | null,
          },
        },
        ...
      ],
      "formatted": "<multi-line human-readable text>",
      "message": "<summary>"
    }

Get procedure examples showing how threat groups used a specific technique.

Procedure examples describe real incident behavior tied to this technique.

Args:
    technique_stix_id: STIX UUID of the technique
    domain: ATT&CK domain
    include_description: Include descriptions of the examples if available

Returns:
    {
      "technique": {
          "attack_id": "Txxxx",
          "name": "...",
          "stix_id": "attack-pattern--UUID"
      },
      "count": N,
      "examples": [
          {
            "relationship_id": "relationship--UUID",
            "source_group_attack_id": "Gxxxx",
            "source_group_name": "...",
            "description": "...",
            "stix_id": "relationship--UUID"
          },
          ...
      ],
      "formatted": "<multi-line readable text>",
      "message": "<summary>"
    }

Get all revoked techniques for a domain.

Revoked techniques are no longer valid in the framework, often because
they were merged or replaced.

Returns:
    {
        "found": bool,
        "count": int,
        "techniques": [...],
        "formatted": "<pretty output>",
        "message": "..."
    }

Get all software (malware and tools) in a given ATT&CK domain.

This returns non-revoked, non-deprecated software objects, including
both malware and tools, as defined by the MITRE ATT&CK dataset.

Args:
    domain: ATT&CK domain to search ("enterprise", "mobile", or "ics").
    include_description: Whether to include descriptions in the output and
                         formatted text.

Returns:
    {
      "count": <number of software objects>,
      "software": [
        {
          "attack_id": "<SXXXX or similar, if present>",
          "name": "<software name>",
          "stix_id": "<STIX ID>",
          "type": "<malware|tool|...>",
          "description": "<text or null>"
        },
        ...
      ],
      "formatted": "<human-readable list>",
      "message": "<status summary>"
    }

Find software/malware by alias (e.g., 'Beacon', 'Mimilib').

Many malware/tools have multiple alternative names. This tool searches
the software catalog for alias matches.

Args:
    alias: Alias to search for.
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    include_description: Whether to include description fields.

Returns:
    {
      "alias": "<alias>",
      "count": <number of matches>,
      "software": [
        {
          "attack_id": "<SXXXX or MXXXX or None>",
          "name": "<software name>",
          "aliases": [...],
          "stix_id": "<malware--UUID or tool--UUID>",
          "type": "<malware|tool|...>",
          "description": "<text or null>"
        },
        ...
      ],
      "formatted": "<human readable output>",
      "message": "<status summary>"
    }

Get all software/malware used in a specific campaign.

Args:
    campaign_stix_id: Campaign STIX UUID identifier (e.g., 'campaign--UUID').
    domain: ATT&CK domain ('enterprise', 'mobile', 'ics').
    include_description: Whether to include software descriptions.

Returns:
    {
      "campaign": {
          "attack_id": "CXXXX" | null,
          "name": "<campaign name or null>",
          "stix_id": "<campaign--UUID>",
          "description": "<text or null>",
      } | null,

      "count": <number of software objects>,

      "software": [
        {
          "attack_id": "SXXXX or similar" | null,
          "name": "<software name>",
          "stix_id": "<malware--UUID or tool--UUID>",
          "type": "<malware|tool|...> or null",
          "aliases": ["...", "..."],
          "description": "<text or null>",
          "relationships": [
            {
              "stix_id": "<relationship--UUID>",
              "relationship_type": "<type>",
              "description": "<relationship description or null>",
              "source_ref": "<source STIX ID>",
              "target_ref": "<target STIX ID>",
            },
            ...
          ]
        },
        ...
      ],

      "formatted": "<human-readable list of software>",
      "message": "<status summary>"
    }

Get all software (malware and tools) used by a specific APT group,
identified by its STIX ID.

This uses MITRE's `get_software_used_by_group` to follow 'uses'
relationships from an intrusion set (group) to software objects.

Args:
    group_stix_id: STIX ID of the group (e.g., "intrusion-set--UUID").
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    include_description: Whether to include software descriptions.

Returns:
    {
      "group": {
          "attack_id": "GXXXX" | null,
          "name": "<group name or null>",
          "stix_id": "<intrusion-set--UUID>",
          "description": "<text or null>"
      } | null,
      "count": <number of software objects>,
      "software": [
        {
          "attack_id": "SXXXX or similar" | null,
          "name": "<software name>",
          "stix_id": "<STIX ID>",
          "type": "<malware|tool|...>",
          "description": "<text or null>",
          "relationships": [
            {
              "stix_id": "<relationship--UUID>",
              "relationship_type": "uses",
              "description": "<relationship description or null>",
              "source_ref": "<source STIX ID>",
              "target_ref": "<target STIX ID>",
            },
            ...
          ]
        },
        ...
      ],
      "formatted": "<human-readable list of software>",
      "message": "<status summary>"
    }

Get all software (malware/tools) that use a specific technique.

This is a reverse lookup: Technique → Software.
It follows 'uses' relationships from a technique STIX ID to software
(malware and tools) that implement or leverage that technique.

Args:
    technique_stix_id: STIX ID of the technique
                       (e.g., "attack-pattern--UUID").
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    include_description: Whether to include software descriptions.

Returns:
    {
      "technique": {
          "attack_id": "TXXXX or TXXXX.YYY" | null,
          "name": "<technique name or null>",
          "stix_id": "<attack-pattern--UUID>",
          "description": "<text or null>",
      } | null,

      "count": <number of software objects>,

      "software": [
        {
          "attack_id": "SXXXX or similar" | null,
          "name": "<software name>",
          "stix_id": "<software STIX ID>",
          "type": "<malware|tool|...>",
          "description": "<text or null>",
          "relationships": [
            {
              "stix_id": "<relationship--UUID>",
              "relationship_type": "uses",
              "description": "<relationship description or null>",
              "source_ref": "<source STIX ID>",
              "target_ref": "<target STIX ID>",
            },
            ...
          ]
        },
        ...
      ],

      "formatted": "<human-readable list of software>",
      "message": "<status summary>"
    }

Get basic statistics about the loaded ATT&CK data for a given domain.

This returns counts of key object types (techniques, groups, software,
tactics, mitigations), excluding revoked/deprecated entries.

Args:
    domain: ATT&CK domain ("enterprise", "mobile", "ics").

Returns:
    {
      "domain": "<domain>",
      "stats": {
          "techniques": <int>,
          "groups": <int>,
          "software": <int>,
          "tactics": <int>,
          "mitigations": <int>
      },
      "message": "<status message>"
    }

Determine the STIX object type for a given STIX ID.

This is useful when you have a raw STIX UUID (e.g.,
"attack-pattern--xxxx") but need to know whether it corresponds to a
technique, intrusion set, malware, tool, mitigation, data source, etc.

Args:
    stix_id: The STIX UUID identifier to look up.
    domain: ATT&CK domain ("enterprise", "mobile", "ics").

Returns:
    {
        "found": bool,
        "stix_type": "<type string or null>",
        "message": "<status message>"
    }

Examples:
    get_stix_type("attack-pattern--a62a8db3-f23a-4d8f-afd6-9dbc77e7813b")
    → "attack-pattern"

Get all subtechniques of a parent technique.

Args:
    technique_stix_id: STIX UUID of the parent technique.
    domain: ATT&CK domain.
    include_description: Whether to include subtechnique descriptions.

Returns:
    {
      "parent": {
          "stix_id": "...",
          "attack_id": "...",
          "name": "..."
      },
      "count": int,
      "subtechniques": [
          {
              "attack_id": "...",
              "name": "...",
              "stix_id": "...",
              "description": "..." | null
          },
          ...
      ],
      "formatted": "<multi-line string>",
      "message": "<summary>"
    }

Get all ATT&CK tactics belonging to a specific matrix.

Args:
    matrix_stix_id: STIX ID of the matrix (e.g., x-mitre-matrix--UUID)
    domain: ATT&CK domain ('enterprise', 'mobile', 'ics')
    include_description: Whether to include tactic descriptions

Returns:
    {
      "found": bool,
      "count": int,
      "tactics": [
        {
          "name": "...",
          "stix_id": "...",
          "description": "...",
          "attack_id": "TAxxxx" or null
        }
      ],
      "formatted": "<multiline string>",
      "message": "..."
    }

Get all tactics associated with a specific ATT&CK technique.

Techniques can belong to one or more tactics (kill chain phases).

Args:
    technique_stix_id: Technique STIX UUID identifier (attack-pattern--UUID)
    domain: ATT&CK domain ('enterprise', 'mobile', 'ics')
    include_description: Whether to include tactic descriptions

Returns:
    {
      "found": bool,
      "count": int,
      "tactics": [
        {
          "name": "...",
          "stix_id": "...",
          "attack_id": "TAxxxx" or null,
          "description": "...",
        }
      ],
      "formatted": "<multiline formatted output>",
      "message": "..."
    }

This tool searches the specified ATT&CK domain (enterprise, mobile, or ics)
and returns both structured machine-readable data and an optional formatted
human-readable text block. It is useful for user-facing responses as well
as downstream programmatic reasoning.

Args:
    technique_id: The external ATT&CK technique ID (e.g., "T1055").
    domain: ATT&CK domain to search in ("enterprise", "mobile", "ics").
    include_description: If True, returns the full ATT&CK description text.

Returns:
    {
      "found": bool,
      "technique": {
          "id": "<ATT&CK ID>",
          "name": "<technique name>",
          "stix_id": "<STIX object ID>",
          "description": "<full description or null>"
      },
      "formatted": "<human-readable formatted block>",
      "message": "<status message>"
    }

Get all ATT&CK techniques that apply to a specific platform.

Args:
    platform: Platform name (e.g., 'Windows', 'Linux', 'macOS', 
              'Cloud', 'Azure AD', 'Network', etc.)
    domain: ATT&CK domain ('enterprise', 'mobile', 'ics').
    include_description: Whether to include technique descriptions.

Returns:
    {
      "platform": "<platform>",
      "count": <number>,
      "techniques": [
        {
          "attack_id": "Txxxx" or "Txxxx.xxx" or null,
          "name": "<technique name>",
          "stix_id": "<attack-pattern--UUID>",
          "description": "<text or null>"
        },
        ...
      ],
      "formatted": "<optional formatted string>",
      "message": "<summary>"
    }

Get all techniques associated with a specific ATT&CK tactic.

This uses the MITRE ATT&CK Navigator-style mapping between tactics and
techniques for a given domain (e.g., "enterprise-attack").

Examples:
    - get_techniques_by_tactic("Initial Access", "enterprise")
    - get_techniques_by_tactic("Execution", "enterprise")
    - get_techniques_by_tactic("Persistence", "enterprise")

Args:
    tactic: Tactic name (e.g., "Initial Access", "Persistence").
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    include_description: Whether to include technique descriptions
                         in the structured and formatted output.

Returns:
    {
      "count": <number of techniques>,
      "techniques": [
        {
          "attack_id": "<TXXXX or TXXXX.YYY>",
          "name": "<technique name>",
          "stix_id": "<attack-pattern--...>",
          "description": "<description or null>",
          "tactic": "<tactic name>",
        },
        ...
      ],
      "formatted": "<human-readable technique list>",
      "message": "<status summary>"
    }

Get all techniques that can be detected by a specific data component.

Shows which adversary techniques can be identified by monitoring
this specific aspect of telemetry.

Args:
    datacomponent_stix_id: Data component STIX UUID identifier
                           (e.g., 'x-mitre-data-component--UUID').
    domain: ATT&CK domain ('enterprise', 'mobile', 'ics').
    include_description: Whether to include technique descriptions.

Returns:
    {
      "datacomponent": {
          "name": "<data component name or null>",
          "stix_id": "<x-mitre-data-component--UUID>",
          "description": "<text or null>",
          "data_source_stix_id": "<x-mitre-data-source--UUID or null>",
          "data_source_name": "<data source name or null>",
          "data_source_attack_id": "<data source ATT&CK ID or null>",
      } | null,

      "count": <number of techniques>,

      "techniques": [
        {
          "attack_id": "Txxxx or Txxxx.xxx" | null,
          "name": "<technique name>",
          "stix_id": "<attack-pattern--UUID>",
          "description": "<text or null>",
        },
        ...
      ],

      "formatted": "<human-readable list of techniques>",
      "message": "<status summary>"
    }

Get all techniques mitigated by a specific mitigation (by STIX ID).

Args:
    mitigation_stix_id: STIX UUID of the mitigation (e.g., course-of-action--UUID).
    domain: ATT&CK domain ('enterprise', 'mobile', 'ics').
    include_description: Include technique descriptions in the output.

Returns:
    {
      "found": bool,
      "mitigation": {
          "attack_id": "...",
          "name": "...",
          "stix_id": "course-of-action--..."
      } | null,
      "count": int,
      "techniques": [
          {
              "attack_id": "Txxxx",
              "name": "...",
              "stix_id": "...",
              "description": "...",
          },
          ...
      ],
      "formatted": "<multi-line text>",
      "message": "<summary>"
    }

Get all techniques that target a specific ICS asset.

Shows which adversary techniques can affect a given industrial
control system component.

Args:
    asset_stix_id: STIX ID of the ICS asset
    domain: Domain (default: 'ics')
    include_description: Whether to include descriptions in formatted output

Returns:
    {
        "found": bool,
        "count": int,
        "techniques": [
            {
                "id": "<ATT&CK ID>",
                "name": "...",
                "stix_id": "...",
                "description": "..." | None
            },
            ...
        ],
        "formatted": "<optional pretty text>",
        "message": "..."
    }

Get all techniques used in a specific campaign.

Args:
    campaign_stix_id: Campaign STIX UUID identifier
                      (e.g., 'campaign--UUID').
    domain: ATT&CK domain ('enterprise', 'mobile', 'ics').
    include_description: Whether to include technique descriptions.

Returns:
    {
      "campaign": {
          "attack_id": "CXXXX" | null,
          "name": "<campaign name or null>",
          "stix_id": "<campaign--UUID>",
          "description": "<text or null>",
      } | null,

      "count": <number of techniques>,

      "techniques": [
        {
          "attack_id": "TXXXX or TXXXX.YYY" | null,
          "name": "<technique name>",
          "stix_id": "<attack-pattern--UUID>",
          "description": "<text or null>",
          "tactics": ["<Tactic 1>", "<Tactic 2>", ...],
          "relationships": [
            {
              "stix_id": "<relationship--UUID>",
              "relationship_type": "<type>",
              "description": "<relationship description or null>",
              "source_ref": "<source STIX ID>",
              "target_ref": "<target STIX ID>",
            },
            ...
          ]
        },
        ...
      ],

      "formatted": "<human-readable list of techniques>",
      "message": "<status summary>"
    }

Get all techniques used by a specific APT group, identified by its STIX ID.

This is similar to `get_group_techniques`, but instead of a group name or
alias it takes the group's STIX UUID (e.g. "intrusion-set--..."), which is
useful when you already have the STIX ID from another query or relationship.

Args:
    group_stix_id: STIX ID of the group (intrusion-set--UUID).
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    include_description: Whether to include technique descriptions.

Returns:
    {
      "group": {
          "attack_id": "GXXXX" | null,
          "name": "<group name or null>",
          "stix_id": "<intrusion-set--UUID>",
          "description": "<text or null>"
      } | null,
      "count": <number of techniques>,
      "techniques": [
        {
          "attack_id": "TXXXX or TXXXX.YYY" | null,
          "name": "<technique name>",
          "stix_id": "<attack-pattern--UUID>",
          "description": "<text or null>",
          "relationships": [
            {
              "stix_id": "<relationship--UUID>",
              "relationship_type": "uses",
              "description": "<relationship description or null>",
              "source_ref": "<source STIX ID>",
              "target_ref": "<target STIX ID>"
            },
            ...
          ]
        },
        ...
      ],
      "formatted": "<human-readable technique list>",
      "message": "<status summary>"
    }

Get techniques used by the software that a group uses (Group → Software → Techniques).

This provides an indirect view of a group's capabilities by following:
    Group (intrusion set) → Software (malware/tools) → Techniques

Args:
    group_stix_id: STIX ID of the group (e.g., "intrusion-set--UUID").
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    include_description: Whether to include technique descriptions.

Returns:
    {
      "group": {
          "attack_id": "GXXXX" | null,
          "name": "<group name or null>",
          "stix_id": "<intrusion-set--UUID>",
          "description": "<text or null>",
      } | null,

      "count": <number of techniques>,

      "techniques": [
        {
          "attack_id": "TXXXX or TXXXX.YYY" | null,
          "name": "<technique name>",
          "stix_id": "<attack-pattern--UUID>",
          "description": "<text or null>",
          "relationships": [
            {
              "stix_id": "<relationship--UUID>",
              "relationship_type": "uses",
              "description": "<relationship description or null>",
              "source_ref": "<source STIX ID>",
              "target_ref": "<target STIX ID>",
            },
            ...
          ]
        },
        ...
      ],

      "formatted": "<human-readable list of techniques>",
      "message": "<status summary>"
    }

Get all techniques used by specific software/malware.

This shows what ATT&CK techniques a given software (tool/malware) is
capable of performing.

Args:
    software_stix_id: STIX ID of the software object
                      (e.g., "malware--UUID", "tool--UUID").
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    include_description: Whether to include technique descriptions.

Returns:
    {
      "software": {
          "attack_id": "SXXXX or similar" | null,
          "name": "<software name or null>",
          "stix_id": "<software STIX ID>",
          "type": "<malware|tool|...> or null",
          "description": "<text or null>",
      } | null,

      "count": <number of techniques>,

      "techniques": [
        {
          "attack_id": "TXXXX or TXXXX.YYY" | null,
          "name": "<technique name>",
          "stix_id": "<attack-pattern--UUID>",
          "description": "<text or null>",
          "relationships": [
            {
              "stix_id": "<relationship--UUID>",
              "relationship_type": "uses",
              "description": "<relationship description or null>",
              "source_ref": "<source STIX ID>",
              "target_ref": "<target STIX ID>",
            },
            ...
          ]
        },
        ...
      ],

      "formatted": "<human-readable list of techniques>",
      "message": "<status summary>"
    }

Get the ATT&CK tactic names associated with a given technique.

This tool:
  1) Looks up a technique by its external ATT&CK ID (e.g., "T1055").
  2) Extracts its kill chain phases (tactics) from the STIX object.
  3) Returns human-readable tactic names (e.g., "Initial Access"),
     along with the raw phase names and kill chain names.

Args:
    technique_id: External ATT&CK technique ID (e.g., "T1055", "T1055.002").
    domain: ATT&CK domain ("enterprise", "mobile", "ics").

Returns:
    {
      "found": bool,
      "technique": {
          "id": "<ATT&CK ID>",
          "name": "<technique name or null>",
          "stix_id": "<attack-pattern--... or null>",
      } | null,
      "tactics": [
        {
          "tactic": "<Human readable, e.g., 'Initial Access'>",
          "phase_name": "<raw phase name, e.g., 'initial-access'>",
          "kill_chain_name": "<kill chain name, e.g., 'mitre-attack'>"
        },
        ...
      ],
      "message": "<status message>"
    }

Search MITRE ATT&CK intrusion sets (APT groups) by name, alias, or
description (case-insensitive).

If the query is empty, all groups in the domain are returned.

Args:
    query: Search keyword (name, alias, or any text in the description).
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    include_description: Whether to include descriptions in the output.

Returns:
    {
      "count": <number of matches>,
      "groups": [
        {
          "attack_id": "GXXXX",
          "name": "...",
          "aliases": [...],
          "stix_id": "...",
          "description": "..." | null
        },
        ...
      ],
      "formatted": "<LLM-friendly block>",
      "message": "<summary>"
    }

Search MITRE ATT&CK software (malware & tools) by keyword in name or
description (case-insensitive).

Args:
    query: Keyword to search for in software names and descriptions.
    domain: ATT&CK domain ("enterprise", "mobile", "ics").
    include_description: Whether to include descriptions in the response.

Returns:
    {
      "count": <number of matches>,
      "software": [
        {
          "attack_id": "<SXXXX or similar>",
          "name": "...",
          "stix_id": "...",
          "type": "<tool|malware|...>",
          "description": "..." | null
        },
        ...
      ],
      "formatted": "<nicely formatted block>",
      "message": "<status summary>"
    }

Search MITRE ATT&CK techniques by keyword in their name or description.

This tool performs a case-insensitive search over all non-revoked,
non-deprecated techniques in the given domain. A technique is matched if
the query string appears in either:
  • the technique name, or
  • the technique description

Examples:
    - search_techniques("PowerShell")
    - search_techniques("credential dumping")
    - search_techniques("initial access", domain="enterprise")

Args:
    query: Text to search for in technique names and descriptions.
    domain: ATT&CK domain ("enterprise", "mobile", or "ics").
    include_description: Whether to include descriptions in the structured
                         result and formatted output.

Returns:
    {
      "count": <number of matches>,
      "techniques": [
        {
          "attack_id": "<TXXXX or TXXXX.YYY>",
          "name": "<technique name>",
          "stix_id": "<attack-pattern--...>",
          "description": "<description or null>",
        },
        ...
      ],
      "formatted": "<human-readable formatted list>",
      "message": "<status summary>"
    }