get_procedure_examples_by_tactic
Retrieve real-world procedure examples of threat actors using techniques under a specific MITRE ATT&CK tactic. Shows how groups execute tactics like Initial Access or Persistence.
Instructions
Get all procedure examples for techniques in a specific tactic.
Shows real-world examples of how threat groups use techniques that fall
under a given tactic (e.g., Initial Access, Persistence).
Args:
tactic: Tactic name (e.g., "Initial Access", "Persistence").
Case-insensitive; should match ATT&CK tactic names.
domain: ATT&CK domain ('enterprise', 'mobile', 'ics').
include_description: Include example descriptions when available.
Returns:
{
"tactic": {
"name": "<tactic name>",
"attack_id": "TAxxxx" | null,
"stix_id": "x-mitre-tactic--UUID" | null,
},
"count": int,
"examples": [
{
"relationship_id": "relationship--UUID",
"description": "<procedure text or null>",
"group": {
"attack_id": "Gxxxx" | null,
"name": "<group name or null>",
"stix_id": "intrusion-set--UUID" | null,
},
"technique": {
"attack_id": "Txxxx or Txxxx.xxx" | null,
"name": "<technique name or null>",
"stix_id": "attack-pattern--UUID" | null,
},
},
...
],
"formatted": "<multi-line human-readable text>",
"message": "<summary>"
}
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"tactic": "<tactic>"
},
"name": "get_procedure_examples_by_tactic"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| tactic | Yes | ||
| include_description | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |