get_all_datacomponents
Get all ATT&CK data components for a specified domain, with options to exclude revoked or deprecated entries and include detailed descriptions.
Instructions
Get all ATT&CK data components in a domain.
Data components are specific aspects of a data source that can be monitored.
For example, the "Process" data source has components like
"Process Creation", "Process Termination", etc.
Args:
domain: ATT&CK domain ("enterprise", "mobile", "ics").
remove_revoked_deprecated: Whether to exclude revoked/deprecated entries.
include_description: Whether to include descriptions.
Returns:
{
"domain": "<domain>",
"count": <number of data components>,
"datacomponents": [
{
"name": "<data component name>",
"stix_id": "<x-mitre-data-component--UUID>",
"description": "<text or null>",
"data_source_stix_id": "<x-mitre-data-source--UUID or null>",
"data_source_name": "<parent data source name or null>",
"data_source_attack_id": "<data source ATT&CK ID or null>"
},
...
],
"formatted": "<optional human-readable output>",
"message": "<summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| include_description | No | ||
| remove_revoked_deprecated | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |