get_techniques_by_tactic
Get all MITRE ATT&CK techniques for a specified tactic. Supports enterprise, mobile, and ICS domains with optional technique descriptions.
Instructions
Get all techniques associated with a specific ATT&CK tactic.
This uses the MITRE ATT&CK Navigator-style mapping between tactics and
techniques for a given domain (e.g., "enterprise-attack").
Examples:
- get_techniques_by_tactic("Initial Access", "enterprise")
- get_techniques_by_tactic("Execution", "enterprise")
- get_techniques_by_tactic("Persistence", "enterprise")
Args:
tactic: Tactic name (e.g., "Initial Access", "Persistence").
domain: ATT&CK domain ("enterprise", "mobile", "ics").
include_description: Whether to include technique descriptions
in the structured and formatted output.
Returns:
{
"count": <number of techniques>,
"techniques": [
{
"attack_id": "<TXXXX or TXXXX.YYY>",
"name": "<technique name>",
"stix_id": "<attack-pattern--...>",
"description": "<description or null>",
"tactic": "<tactic name>",
},
...
],
"formatted": "<human-readable technique list>",
"message": "<status summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| tactic | Yes | ||
| include_description | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |