get_all_groups
Retrieve all APT threat groups (intrusion sets) from MITRE ATT&CK by domain. Filter revoked groups and optionally include descriptions for security analysis.
Instructions
Get all APT groups (intrusion sets) in a domain.
Args:
domain: ATT&CK domain ("enterprise", "mobile", "ics").
remove_revoked_deprecated: Whether to exclude revoked/deprecated groups.
include_description: Whether to include descriptions.
Returns:
{
"domain": "<domain>",
"count": <number of groups>,
"groups": [
{
"attack_id": "GXXXX",
"name": "<group name>",
"aliases": [...],
"stix_id": "<intrusion-set--UUID>",
"description": "<text or null>"
},
...
],
"formatted": "<optional human-readable listing>",
"message": "<summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| include_description | No | ||
| remove_revoked_deprecated | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |