get_objects_by_content
Search MITRE ATT&CK objects by matching text in their descriptions. Find techniques, groups, malware, and mitigations using keywords.
Instructions
Search MITRE ATT&CK objects by matching text inside their description field.
This performs a full-text search over object descriptions. It is useful for:
• Finding techniques related to specific technologies (e.g., “PowerShell”)
• Finding groups mentioning a region or country (e.g., “Russia”)
• Finding mitigations referencing specific defenses (e.g., “multi-factor”)
• Searching malware or tool descriptions for keywords
Args:
content: The text to search for (case-insensitive, partial match).
object_type: STIX object type, such as:
- "attack-pattern" (techniques)
- "intrusion-set" (APT groups)
- "malware"
- "tool"
- "course-of-action" (mitigations)
- "campaign"
- "x-mitre-data-source"
- "x-mitre-data-component"
- etc.
domain: ATT&CK domain ("enterprise", "mobile", "ics").
include_description: Whether to return descriptions in the structured output.
Returns:
{
"count": <number of matches>,
"objects": [
{
"attack_id": "<ATT&CK ID or null>",
"name": "<object name>",
"stix_id": "<STIX ID>",
"type": "<object_type>",
"description": "<description or null>"
},
...
],
"formatted": "<human-readable formatted list>",
"message": "<status message>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| content | Yes | ||
| object_type | Yes | ||
| include_description | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |