get_attack_id
Resolve a STIX UUID identifier into its corresponding ATT&CK ID (e.g., T1566, G0016) for a given domain (enterprise, mobile, or ICS).
Instructions
Convert a STIX UUID into its human-readable ATT&CK ID.
This tool resolves internal STIX identifiers such as:
attack-pattern--UUID
malware--UUID
intrusion-set--UUID
tool--UUID
course-of-action--UUID
into ATT&CK IDs such as:
T1566 (Technique)
T1055.002 (Sub-technique)
G0016 (Group)
S0154 (Software)
M1013 (Mitigation)
Args:
stix_id: Full STIX UUID identifier.
domain: ATT&CK domain ("enterprise", "mobile", "ics").
Returns:
{
"found": bool,
"attack_id": "<ATT&CK ID or null>",
"message": "<status message>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| stix_id | Yes |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |