get_groups_attributing_to_campaign
Retrieve all APT groups attributed to a given campaign. Input a campaign STIX ID to get group names, aliases, and relationships.
Instructions
Get all APT groups (intrusion sets) attributed to a specific campaign.
This is a reverse lookup: Campaign → Groups.
It follows attribution relationships from a campaign STIX ID to
intrusion sets (groups).
Args:
campaign_stix_id: STIX ID of the campaign (e.g., "campaign--UUID").
domain: ATT&CK domain ("enterprise", "mobile", "ics").
include_description: Whether to include group descriptions.
Returns:
{
"campaign": {
"attack_id": "CXXXX" | null,
"name": "<campaign name or null>",
"stix_id": "<campaign--UUID>",
"description": "<text or null>"
} | null,
"count": <number of groups>,
"groups": [
{
"attack_id": "GXXXX" | null,
"name": "<group name>",
"aliases": [...],
"stix_id": "<intrusion-set--UUID>",
"description": "<text or null>",
"relationships": [
{
"stix_id": "<relationship--UUID>",
"relationship_type": "<type>",
"description": "<relationship description or null>",
"source_ref": "<source STIX ID>",
"target_ref": "<target STIX ID>",
},
...
]
},
...
],
"formatted": "<human-readable list of groups>",
"message": "<status summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| campaign_stix_id | Yes | ||
| include_description | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |