get_all_software
Retrieve all software (malware and tools) from a specified MITRE ATT&CK domain, with options to exclude revoked or deprecated entries and include descriptions.
Instructions
Get all software (malware and tools) in a domain.
This is effectively an alias for the MITRE helper get_software(), but it
returns structured results suitable for LLMs and clients.
Args:
domain: ATT&CK domain ("enterprise", "mobile", "ics").
remove_revoked_deprecated: Whether to exclude revoked/deprecated software.
include_description: Whether to include descriptions.
Returns:
{
"domain": "<domain>",
"count": <number of software objects>,
"software": [
{
"attack_id": "<SXXXX or similar> | null",
"name": "<software name>",
"aliases": [...],
"stix_id": "<malware--UUID or tool--UUID>",
"type": "<malware|tool|...>",
"description": "<text or null>"
},
...
],
"formatted": "<optional human-readable listing>",
"message": "<summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| include_description | No | ||
| remove_revoked_deprecated | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |