get_group_techniques
Retrieve all MITRE ATT&CK techniques used by a specified threat group by name or alias, including relationships and descriptions. Supports enterprise, mobile, and ICS domains.
Instructions
Get all techniques used by a specific APT group (intrusion set).
This tool:
1) Locates a group by name or alias (case-insensitive, partial match).
2) Uses MITRE's get_techniques_used_by_group() to retrieve techniques
related to that group (via 'uses' relationships).
Args:
group_name: Group name or alias (e.g., "APT29", "Lazarus Group").
domain: ATT&CK domain ("enterprise", "mobile", or "ics").
include_description: Whether to include descriptions in the output.
Returns:
{
"found": bool, # whether the group was found
"group": {
"attack_id": "GXXXX",
"name": "...",
"aliases": [...],
"stix_id": "intrusion-set--...",
"description": "..." | null
} | null,
"count": <number of techniques>,
"techniques": [
{
"attack_id": "TXXXX or TXXXX.YYY",
"name": "...",
"stix_id": "attack-pattern--...",
"description": "..." | null,
"relationships": [
{
"stix_id": "relationship--...",
"relationship_type": "uses",
"description": "..." | null,
"source_ref": "...",
"target_ref": "..."
},
...
]
},
...
],
"formatted": "<human-readable technique list>",
"message": "<status summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| group_name | Yes | ||
| include_description | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |