get_technique_tactics
Get the tactic names (kill chain phases) for a specified ATT&CK technique ID. Input the technique ID and domain to retrieve human-readable tactics.
Instructions
Get the ATT&CK tactic names associated with a given technique.
This tool:
1) Looks up a technique by its external ATT&CK ID (e.g., "T1055").
2) Extracts its kill chain phases (tactics) from the STIX object.
3) Returns human-readable tactic names (e.g., "Initial Access"),
along with the raw phase names and kill chain names.
Args:
technique_id: External ATT&CK technique ID (e.g., "T1055", "T1055.002").
domain: ATT&CK domain ("enterprise", "mobile", "ics").
Returns:
{
"found": bool,
"technique": {
"id": "<ATT&CK ID>",
"name": "<technique name or null>",
"stix_id": "<attack-pattern--... or null>",
} | null,
"tactics": [
{
"tactic": "<Human readable, e.g., 'Initial Access'>",
"phase_name": "<raw phase name, e.g., 'initial-access'>",
"kill_chain_name": "<kill chain name, e.g., 'mitre-attack'>"
},
...
],
"message": "<status message>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| technique_id | Yes |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |