get_techniques_by_platform
Retrieve all MITRE ATT&CK techniques that apply to a specific platform and domain. Optionally include technique descriptions.
Instructions
Get all ATT&CK techniques that apply to a specific platform.
Args:
platform: Platform name (e.g., 'Windows', 'Linux', 'macOS',
'Cloud', 'Azure AD', 'Network', etc.)
domain: ATT&CK domain ('enterprise', 'mobile', 'ics').
include_description: Whether to include technique descriptions.
Returns:
{
"platform": "<platform>",
"count": <number>,
"techniques": [
{
"attack_id": "Txxxx" or "Txxxx.xxx" or null,
"name": "<technique name>",
"stix_id": "<attack-pattern--UUID>",
"description": "<text or null>"
},
...
],
"formatted": "<optional formatted string>",
"message": "<summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| platform | Yes | ||
| include_description | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |