get_all_datasources
Retrieve all MITRE ATT&CK data sources for a specified domain, with options to exclude revoked or deprecated sources and include descriptions.
Instructions
Get all ATT&CK data sources in a domain.
Data sources represent *what* kind of telemetry you collect
(e.g., Process Monitoring, Network Traffic, File Monitoring).
Args:
domain: ATT&CK domain ("enterprise", "mobile", "ics").
remove_revoked_deprecated: Whether to exclude revoked/deprecated data sources.
include_description: Whether to include descriptions.
Returns:
{
"domain": "<domain>",
"count": <number of data sources>,
"datasources": [
{
"name": "<data source name>",
"stix_id": "<x-mitre-data-source--UUID>",
"description": "<text or null>",
"platforms": ["<Windows>", "<Linux>", ...] # if available
},
...
],
"formatted": "<optional human-readable output>",
"message": "<summary>"
}
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "get_all_datasources"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| include_description | No | ||
| remove_revoked_deprecated | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |