get_procedure_examples_by_technique
Provides procedure examples showing how threat groups have used a specific ATT&CK technique, with optional incident descriptions.
Instructions
Get procedure examples showing how threat groups used a specific technique.
Procedure examples describe real incident behavior tied to this technique.
Args:
technique_stix_id: STIX UUID of the technique
domain: ATT&CK domain
include_description: Include descriptions of the examples if available
Returns:
{
"technique": {
"attack_id": "Txxxx",
"name": "...",
"stix_id": "attack-pattern--UUID"
},
"count": N,
"examples": [
{
"relationship_id": "relationship--UUID",
"source_group_attack_id": "Gxxxx",
"source_group_name": "...",
"description": "...",
"stix_id": "relationship--UUID"
},
...
],
"formatted": "<multi-line readable text>",
"message": "<summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| technique_stix_id | Yes | ||
| include_description | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |