search_groups
Search MITRE ATT&CK intrusion sets (APT groups) by name, alias, or description across enterprise, mobile, or ICS domains.
Instructions
Search MITRE ATT&CK intrusion sets (APT groups) by name, alias, or
description (case-insensitive).
If the query is empty, all groups in the domain are returned.
Args:
query: Search keyword (name, alias, or any text in the description).
domain: ATT&CK domain ("enterprise", "mobile", "ics").
include_description: Whether to include descriptions in the output.
Returns:
{
"count": <number of matches>,
"groups": [
{
"attack_id": "GXXXX",
"name": "...",
"aliases": [...],
"stix_id": "...",
"description": "..." | null
},
...
],
"formatted": "<LLM-friendly block>",
"message": "<summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | ||
| domain | No | enterprise | |
| include_description | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |