get_techniques_by_tactic
Get all MITRE ATT&CK techniques for a specified tactic. Supports enterprise, mobile, and ICS domains with optional technique descriptions.
Instructions
Get all techniques associated with a specific ATT&CK tactic.
This uses the MITRE ATT&CK Navigator-style mapping between tactics and
techniques for a given domain (e.g., "enterprise-attack").
Examples:
- get_techniques_by_tactic("Initial Access", "enterprise")
- get_techniques_by_tactic("Execution", "enterprise")
- get_techniques_by_tactic("Persistence", "enterprise")
Args:
tactic: Tactic name (e.g., "Initial Access", "Persistence").
domain: ATT&CK domain ("enterprise", "mobile", "ics").
include_description: Whether to include technique descriptions
in the structured and formatted output.
Returns:
{
"count": <number of techniques>,
"techniques": [
{
"attack_id": "<TXXXX or TXXXX.YYY>",
"name": "<technique name>",
"stix_id": "<attack-pattern--...>",
"description": "<description or null>",
"tactic": "<tactic name>",
},
...
],
"formatted": "<human-readable technique list>",
"message": "<status summary>"
}
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"tactic": "<tactic>"
},
"name": "get_techniques_by_tactic"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| tactic | Yes | ||
| include_description | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |