get_objects_by_name
Retrieve MITRE ATT&CK objects by exact name match. Specify a STIX type and domain to get precise results for techniques, groups, or malware.
Instructions
Retrieve MITRE ATT&CK objects by exact name match (case-sensitive).
This tool performs an exact name match for a specific STIX type within
a given ATT&CK domain. It is more strict than generic search methods,
which typically perform partial or keyword matching.
Examples:
- Technique: get_objects_by_name("Phishing", "attack-pattern")
- Group: get_objects_by_name("APT29", "intrusion-set")
- Malware: get_objects_by_name("Cobalt Strike", "malware")
Args:
name: Exact object name to search for (case-sensitive).
stix_type: STIX object type (same values as get_object_by_attack_id),
e.g. "attack-pattern", "intrusion-set", "malware",
"tool", "course-of-action", etc.
domain: ATT&CK domain ("enterprise", "mobile", or "ics").
include_description: Whether to include descriptions in the formatted output
and structured result.
Returns:
{
"count": <number of matching objects>,
"objects": [
{
"attack_id": "<ATT&CK external ID or null>",
"name": "<object name>",
"stix_id": "<STIX ID>",
"type": "<stix_type>",
"description": "<description or null>"
},
...
],
"formatted": "<human-readable multi-object formatted text>",
"message": "<status summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| domain | No | enterprise | |
| stix_type | Yes | ||
| include_description | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |