get_stix_type
Identify the STIX object type (technique, malware, etc.) from any STIX ID in a specified ATT&CK domain.
Instructions
Determine the STIX object type for a given STIX ID.
This is useful when you have a raw STIX UUID (e.g.,
"attack-pattern--xxxx") but need to know whether it corresponds to a
technique, intrusion set, malware, tool, mitigation, data source, etc.
Args:
stix_id: The STIX UUID identifier to look up.
domain: ATT&CK domain ("enterprise", "mobile", "ics").
Returns:
{
"found": bool,
"stix_type": "<type string or null>",
"message": "<status message>"
}
Examples:
get_stix_type("attack-pattern--a62a8db3-f23a-4d8f-afd6-9dbc77e7813b")
→ "attack-pattern"
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"stix_id": "<stix_id>"
},
"name": "get_stix_type"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| stix_id | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |