get_campaigns_by_alias
Resolve campaign aliases to find official MITRE ATT&CK campaigns using alternate names from different vendors.
Instructions
Get campaigns by their alias.
Campaigns frequently have multiple names assigned by different vendors
or research teams. This function resolves those aliases.
Args:
alias: Campaign alias or alternate name (case-insensitive)
domain: ATT&CK domain ("enterprise", "ics", etc.)
include_description: Include campaign descriptions in output
Returns:
{
"alias": "<requested name>",
"count": int,
"campaigns": [
{
"name": "...",
"stix_id": "<campaign--UUID>",
"attack_id": "Cxxxx" | null,
"description": "..." | null
},
...
],
"formatted": "<multi-line readable text>",
"message": "<summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| alias | Yes | ||
| domain | No | enterprise | |
| include_description | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |