get_technique_ids
Retrieve a deduplicated list of MITRE technique IDs covered by detection rules. Filter by tactic, severity, or source to narrow the scope.
Instructions
Get a deduplicated flat list of MITRE technique IDs covered by detection rules (~200 bytes). No full objects. Filter by source_type, tactic, or severity to narrow scope.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tactic | No | Filter by MITRE tactic (e.g., execution, persistence, defense-evasion) | |
| severity | No | Filter by severity: critical, high, medium, low | |
| source_type | No | Filter by source: sigma, splunk_escu, elastic, kql |