get_all_parent_techniques
Retrieve parent techniques (main ATT&CK IDs without subtechniques) for enterprise, mobile, or ICS domains. Filter out revoked or deprecated entries and optionally include descriptions.
Instructions
Get all parent techniques (exclude subtechniques) in a given domain.
Parent techniques are the main techniques without a dot in their ATT&CK ID,
e.g., T1566, T1055 (not T1566.001).
Args:
domain: ATT&CK domain ("enterprise", "mobile", "ics").
remove_revoked_deprecated: Whether to exclude revoked/deprecated techniques.
include_description: Whether to include descriptions.
Returns:
{
"domain": "<domain>",
"count": <number of parent techniques>,
"parent_techniques": [
{
"attack_id": "<TXXXX>",
"name": "<technique name>",
"stix_id": "<attack-pattern--UUID>",
"description": "<text or null>",
"tactics": ["<Tactic 1>", "<Tactic 2>", ...]
},
...
],
"formatted": "<optional human-readable output>",
"message": "<summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| include_description | No | ||
| remove_revoked_deprecated | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |