get_object_by_attack_id
Retrieve any MITRE ATT&CK technique, group, malware, or other object by its external ID and STIX type.
Instructions
Retrieve any MITRE ATT&CK object by its external ATT&CK ID and STIX type.
This tool supports techniques, intrusion sets (APT groups), malware,
tools, mitigations, campaigns, data sources, data components, and tactics.
Args:
attack_id: The external ATT&CK ID (e.g., "T1055", "G0016", "S0154", "M1013").
stix_type: The STIX object type (e.g., "attack-pattern", "intrusion-set").
domain: ATT&CK domain ("enterprise", "mobile", or "ics").
include_description: Whether to include the object's description field.
Returns:
{
"found": bool,
"object": {
"id": "<ATT&CK ID>",
"name": "<object name>",
"stix_id": "<STIX object ID>",
"type": "<stix_type>",
"description": "<description or null>"
},
"formatted": "<human-readable formatted output>",
"message": "<status>"
}
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"attack_id": "<attack_id>",
"stix_type": "<stix_type>"
},
"name": "get_object_by_attack_id"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| attack_id | Yes | ||
| stix_type | Yes | ||
| include_description | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |