get_technique_by_id
Retrieve any MITRE ATT&CK technique by its external ID from enterprise, mobile, or ICS domains, returning structured data and a human-readable description for threat intelligence workflows.
Instructions
" Retrieve a MITRE ATT&CK technique by its external ATT&CK ID (e.g., "T1055", "T1053.005").
This tool searches the specified ATT&CK domain (enterprise, mobile, or ics)
and returns both structured machine-readable data and an optional formatted
human-readable text block. It is useful for user-facing responses as well
as downstream programmatic reasoning.
Args:
technique_id: The external ATT&CK technique ID (e.g., "T1055").
domain: ATT&CK domain to search in ("enterprise", "mobile", "ics").
include_description: If True, returns the full ATT&CK description text.
Returns:
{
"found": bool,
"technique": {
"id": "<ATT&CK ID>",
"name": "<technique name>",
"stix_id": "<STIX object ID>",
"description": "<full description or null>"
},
"formatted": "<human-readable formatted block>",
"message": "<status message>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| technique_id | Yes | ||
| include_description | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |