get_datacomponents_detecting_technique
Get data components that can detect a specific MITRE ATT&CK technique by traversing relationships or resolving data sources.
Instructions
Get all data components that can detect a specific technique.
Primary mode:
- Use mitreattack-python relationship traversal (if present)
Fallback mode (when relationship traversal yields 0):
- Read technique.x_mitre_data_sources (strings)
- Resolve data source objects by name
- Return data components whose x_mitre_data_source_ref points to those data sources
- If the string includes a component name (e.g., "Process: Process Creation"),
filter to that component when possible.
Returns the same structure as before, plus a debug block.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| technique_stix_id | Yes | ||
| include_description | No |