get_groups_by_alias
Retrieve MITRE ATT&CK threat groups (intrusion sets) that match a given alias, such as 'Cozy Bear' or 'NOBELIUM', with optional descriptions and domain filtering.
Instructions
Get APT groups (intrusion sets) matching a given alias.
Many groups have multiple aliases—e.g., APT29 is also known as:
"Cozy Bear", "NOBELIUM", "Midnight Blizzard", etc.
This tool returns all groups whose alias list contains the given alias
(case-insensitive exact match, per MITRE's own alias indexing).
Args:
alias: Alias to search for (e.g., "Cozy Bear", "NOBELIUM").
domain: ATT&CK domain ("enterprise", "mobile", "ics").
include_description: Whether to include group descriptions.
Returns:
{
"count": <number>,
"groups": [
{
"attack_id": "GXXXX",
"name": "<group name>",
"aliases": [...],
"stix_id": "<intrusion-set--UUID>",
"description": "<text or null>"
},
...
],
"formatted": "<formatted list>",
"message": "<status summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| alias | Yes | ||
| domain | No | enterprise | |
| include_description | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |