get_group_by_name
Find an APT group by searching its name or alias with case-insensitive partial matching, returning group details and optional description.
Instructions
Retrieve an intrusion set (APT group) by name or alias (case-insensitive match).
This tool searches ATT&CK intrusion sets by name or alias and returns the first
matching group. Matching is case-insensitive and supports partial matches.
Examples:
- get_group_by_name("APT29")
- get_group_by_name("Lazarus")
- get_group_by_name("Fancy Bear")
Args:
group_name: The group name or alias to search for (case-insensitive).
domain: ATT&CK domain ("enterprise", "mobile", "ics").
include_description: Whether to include descriptions in the output.
Returns:
{
"found": bool,
"group": {
"attack_id": "<GXXXX>",
"name": "<group name>",
"aliases": [...],
"stix_id": "<intrusion-set--...>",
"description": "<description or null>"
},
"formatted": "<human-readable text>",
"message": "<status>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| group_name | Yes | ||
| include_description | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |