get_tactics_by_technique
Get all tactics (kill chain phases) linked to an ATT&CK technique by providing its STIX ID and domain. Returns tactic names, IDs, and optional descriptions.
Instructions
Get all tactics associated with a specific ATT&CK technique.
Techniques can belong to one or more tactics (kill chain phases).
Args:
technique_stix_id: Technique STIX UUID identifier (attack-pattern--UUID)
domain: ATT&CK domain ('enterprise', 'mobile', 'ics')
include_description: Whether to include tactic descriptions
Returns:
{
"found": bool,
"count": int,
"tactics": [
{
"name": "...",
"stix_id": "...",
"attack_id": "TAxxxx" or null,
"description": "...",
}
],
"formatted": "<multiline formatted output>",
"message": "..."
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| technique_stix_id | Yes | ||
| include_description | No |