get_software
Retrieve all non-revoked malware and tools from an ATT&CK domain (enterprise, mobile, or ICS). Optionally include descriptions.
Instructions
Get all software (malware and tools) in a given ATT&CK domain.
This returns non-revoked, non-deprecated software objects, including
both malware and tools, as defined by the MITRE ATT&CK dataset.
Args:
domain: ATT&CK domain to search ("enterprise", "mobile", or "ics").
include_description: Whether to include descriptions in the output and
formatted text.
Returns:
{
"count": <number of software objects>,
"software": [
{
"attack_id": "<SXXXX or similar, if present>",
"name": "<software name>",
"stix_id": "<STIX ID>",
"type": "<malware|tool|...>",
"description": "<text or null>"
},
...
],
"formatted": "<human-readable list>",
"message": "<status summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| include_description | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |