techniques_for_actor
List an ATT&CK actor's techniques, optionally expanded with defenses for given systems. actor is an ATT&CK group id, name or alias; case, spacing, punctuation and a trailing "Group" or "Team" are ignored, and actor.matched_as then names…
Instructions
List an ATT&CK actor's techniques, optionally expanded with defenses for given systems. actor is an ATT&CK group id, name or alias; case, spacing, punctuation and a trailing "Group" or "Team" are ignored, and actor.matched_as then names what matched. actor.also_matches, when present, lists other groups the same label loosely names. A misspelling is not corrected: the error names the closest groups, so call again with the group id of the one meant. The answer opens with summary, which counts the techniques; with include_defenses it adds the same counts defenses_for_technique gives, across every technique. Use those counts rather than counting lists yourself. controls lists each control once with its rule ids, including rules DISA tags to its enhancements, which via names, and findings lists each finding once, without check or fix text (call finding_details for those), each naming its benchmark, V- id and CAT, with titles for CAT I or for the CATs named in severity; summary.titles reads "CAT I only" when the rest are missing, so fetch a title before naming an untitled finding. Each technique lists its control ids grouped by where the mapping came from ("ctid" or "override"). benchmark_ids accepts at most 200; it, severity (CAT levels, e.g. ["I"]), platforms and log_sources are validated always but only take effect with include_defenses. To scope a system you cannot name, pass system_description instead. With include_defenses each technique also lists its ATT&CK mitigations (M-ids), its detection strategy (DET-id), analytics (a map of AN-id to platforms, with applicable and detectable id lists as in defenses_for_technique), and gaps, the coverage classes the call can judge that count that technique as a gap (mitigated_without_rules needs a scoped system, without_applicable_analytic platforms, undetectable log_sources), so read gaps rather than deriving them. mitigations maps each M-id to its name once, while summary.mitigations counts mitigation references across techniques (one on two techniques counts twice). summary.coverage, which comes right after control_counts, counts techniques: without_mitigation, mitigated_without_rules (only when a system was scoped; with severity, no rules at the requested CAT levels), without_applicable_analytic (only with platforms), detectable and undetectable (only with log_sources); summary.detection counts analytics instead. Detection is judged applicability first when platforms is given, then detectability over the applicable analytics. Each technique's applicable and detectable id lists are judged as in defenses_for_technique, so with platforms detectable is always a subset of applicable; log_sources takes up to 100 names. Call defense_details with M-, DET- or AN- ids for MITRE's text. If the knowledge base is not built yet this returns {"status": "not_ready"} with the commands to run, rather than an error.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| actor | Yes | ||
| severity | No | ||
| platforms | No | ||
| log_sources | No | ||
| benchmark_ids | No | ||
| include_defenses | No | ||
| system_description | No |