get_assets_targeted_by_technique
Retrieve all ICS assets targeted by a specific MITRE ATT&CK technique using its STIX ID. Identify affected components like PLCs, RTUs, and HMIs for threat analysis.
Instructions
Get all ICS assets targeted by a specific technique.
Assets represent industrial control system components such as
PLCs, RTUs, Engineering Workstations, HMIs, Control Servers, etc.
Args:
technique_stix_id: Technique STIX UUID identifier
domain: ATT&CK domain ('ics' strongly recommended)
include_description: Include asset descriptions, if available
Returns:
{
"technique": {
"attack_id": "Txxxx",
"name": "...",
"stix_id": "<attack-pattern--UUID>"
},
"count": int,
"assets": [
{
"name": "...",
"stix_id": "<x-mitre-asset--UUID>",
"description": "<optional text>",
"asset_type": "<ICS component type>",
},
...
],
"formatted": "<multi-line readable text>",
"message": "<summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | ics | |
| technique_stix_id | Yes | ||
| include_description | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |