get_all_mitigations
Retrieve all defensive mitigations from MITRE ATT&CK for enterprise, mobile, or ICS domains. Filter out revoked or deprecated entries and include descriptions.
Instructions
Get all mitigations (defensive countermeasures) in a domain.
Mitigations are security controls or practices that can reduce the
effectiveness of adversary techniques (e.g., M1013, M1017).
Args:
domain: ATT&CK domain ("enterprise", "mobile", "ics").
remove_revoked_deprecated: Whether to exclude revoked/deprecated mitigations.
include_description: Whether to include descriptions.
Returns:
{
"domain": "<domain>",
"count": <number of mitigations>,
"mitigations": [
{
"attack_id": "MXXXX" | null,
"name": "<mitigation name>",
"stix_id": "<course-of-action--UUID>",
"description": "<text or null>"
},
...
],
"formatted": "<optional human-readable output>",
"message": "<summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| include_description | No | ||
| remove_revoked_deprecated | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |