get_object_by_stix_id
Retrieve a full MITRE ATT&CK object using its STIX ID to resolve relationships and get complete details.
Instructions
Retrieve any MITRE ATT&CK object by its STIX ID (UUID).
STIX IDs are internal identifiers like:
- attack-pattern--a62a8db3-f23a-4d8f-afd6-9dbc77e7813b
This tool is useful when you already have a STIX ID from another
query or relationship and want to resolve it to the full object.
Args:
stix_id: STIX object ID (e.g., "attack-pattern--...").
domain: ATT&CK domain to search in ("enterprise", "mobile", "ics").
include_description: Whether to include the object's description.
Returns:
{
"found": bool,
"object": {
"attack_id": "<ATT&CK external ID or null>",
"name": "<object name>",
"stix_id": "<STIX ID>",
"type": "<stix type>",
"description": "<description or null>"
},
"formatted": "<human-readable formatted text>",
"message": "<status message>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| stix_id | Yes | ||
| include_description | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |