get_techniques_detected_by_datacomponent
Identify adversary techniques detectable by a specific data component. Maps telemetry aspects to techniques attackers use to aid detection engineering.
Instructions
Get all techniques that can be detected by a specific data component.
Shows which adversary techniques can be identified by monitoring
this specific aspect of telemetry.
Args:
datacomponent_stix_id: Data component STIX UUID identifier
(e.g., 'x-mitre-data-component--UUID').
domain: ATT&CK domain ('enterprise', 'mobile', 'ics').
include_description: Whether to include technique descriptions.
Returns:
{
"datacomponent": {
"name": "<data component name or null>",
"stix_id": "<x-mitre-data-component--UUID>",
"description": "<text or null>",
"data_source_stix_id": "<x-mitre-data-source--UUID or null>",
"data_source_name": "<data source name or null>",
"data_source_attack_id": "<data source ATT&CK ID or null>",
} | null,
"count": <number of techniques>,
"techniques": [
{
"attack_id": "Txxxx or Txxxx.xxx" | null,
"name": "<technique name>",
"stix_id": "<attack-pattern--UUID>",
"description": "<text or null>",
},
...
],
"formatted": "<human-readable list of techniques>",
"message": "<status summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| include_description | No | ||
| datacomponent_stix_id | Yes |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |