get_stix_type
Identify the STIX object type (technique, malware, etc.) from any STIX ID in a specified ATT&CK domain.
Instructions
Determine the STIX object type for a given STIX ID.
This is useful when you have a raw STIX UUID (e.g.,
"attack-pattern--xxxx") but need to know whether it corresponds to a
technique, intrusion set, malware, tool, mitigation, data source, etc.
Args:
stix_id: The STIX UUID identifier to look up.
domain: ATT&CK domain ("enterprise", "mobile", "ics").
Returns:
{
"found": bool,
"stix_type": "<type string or null>",
"message": "<status message>"
}
Examples:
get_stix_type("attack-pattern--a62a8db3-f23a-4d8f-afd6-9dbc77e7813b")
→ "attack-pattern"
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| stix_id | Yes |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |