get_campaigns_attributed_to_group
Retrieve all campaigns attributed to a specific APT group by its STIX ID, with optional domain filtering and descriptions for enterprise, mobile, or ICS.
Instructions
Get all campaigns attributed to a specific intrusion set (APT group),
identified by its STIX ID.
Campaigns represent specific operations or intrusion events attributed
to a threat group.
Args:
group_stix_id: STIX UUID of the group (e.g., "intrusion-set--UUID").
domain: ATT&CK domain ("enterprise", "mobile", "ics").
include_description: Whether to include campaign descriptions.
Returns:
{
"group": {
"attack_id": "GXXXX" | null,
"name": "<group name or null>",
"stix_id": "<intrusion-set--UUID>",
"description": "<text or null>"
} | null,
"count": <number of campaigns>,
"campaigns": [
{
"attack_id": "CXXXX" | null,
"name": "<campaign name>",
"stix_id": "<campaign--UUID>",
"description": "<text or null>"
},
...
],
"formatted": "<formatted human-readable block>",
"message": "<status summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| group_stix_id | Yes | ||
| include_description | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |