get_all_subtechniques
Retrieve all subtechniques for an ATT&CK domain (enterprise, mobile, ics) with options to exclude revoked entries and include descriptions. Returns subtechnique IDs, names, tactics, and parent technique mapping.
Instructions
Get all subtechniques in a given ATT&CK domain.
Subtechniques are more specific versions of parent techniques,
e.g., T1566.001 and T1566.002 are subtechniques of T1566.
Args:
domain: ATT&CK domain ("enterprise", "mobile", "ics").
remove_revoked_deprecated: Whether to exclude revoked/deprecated subtechniques.
include_description: Whether to include descriptions.
Returns:
{
"domain": "<domain>",
"count": <number of subtechniques>,
"subtechniques": [
{
"attack_id": "<TXXXX.YYY>",
"name": "<subtechnique name>",
"stix_id": "<attack-pattern--UUID>",
"description": "<text or null>",
"tactics": ["<Tactic 1>", "<Tactic 2>", ...],
"parent_attack_id": "<TXXXX>",
"parent_name": "<parent technique name>",
"parent_stix_id": "<attack-pattern--UUID>"
},
...
],
"formatted": "<optional human-readable output>",
"message": "<summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| include_description | No | ||
| remove_revoked_deprecated | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |