get_techniques_used_by_group
Retrieve all ATT&CK techniques used by a specific APT group using its STIX ID. Returns technique details and relationships for threat intelligence analysis.
Instructions
Get all techniques used by a specific APT group, identified by its STIX ID.
This is similar to `get_group_techniques`, but instead of a group name or
alias it takes the group's STIX UUID (e.g. "intrusion-set--..."), which is
useful when you already have the STIX ID from another query or relationship.
Args:
group_stix_id: STIX ID of the group (intrusion-set--UUID).
domain: ATT&CK domain ("enterprise", "mobile", "ics").
include_description: Whether to include technique descriptions.
Returns:
{
"group": {
"attack_id": "GXXXX" | null,
"name": "<group name or null>",
"stix_id": "<intrusion-set--UUID>",
"description": "<text or null>"
} | null,
"count": <number of techniques>,
"techniques": [
{
"attack_id": "TXXXX or TXXXX.YYY" | null,
"name": "<technique name>",
"stix_id": "<attack-pattern--UUID>",
"description": "<text or null>",
"relationships": [
{
"stix_id": "<relationship--UUID>",
"relationship_type": "uses",
"description": "<relationship description or null>",
"source_ref": "<source STIX ID>",
"target_ref": "<target STIX ID>"
},
...
]
},
...
],
"formatted": "<human-readable technique list>",
"message": "<status summary>"
}
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"group_stix_id": "<group_stix_id>"
},
"name": "get_techniques_used_by_group"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No | enterprise | |
| group_stix_id | Yes | ||
| include_description | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |