get_all_campaigns
Retrieve all ATT&CK campaigns for a specified domain, with options to exclude revoked or deprecated entries and include descriptions.
Instructions
Get all ATT&CK campaigns in a domain.
Campaigns represent specific intrusion events or long-running operations
attributed to threat actors (e.g., SolarWinds, Operation Ghost).
Args:
domain: ATT&CK domain ("enterprise", "mobile", "ics")
remove_revoked_deprecated: Whether to exclude revoked/deprecated entries
include_description: Include campaign descriptions in the output
Returns:
{
"domain": "<domain>",
"count": <int>,
"campaigns": [
{
"attack_id": "<Cxxxx or None>",
"name": "<campaign name>",
"stix_id": "campaign--UUID",
"description": "<text or null>"
},
...
],
"formatted": "<nicely formatted output>",
"message": "<summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| include_description | No | ||
| remove_revoked_deprecated | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |