Mitre Attack MCP Server

Get all campaigns attributed to a specific intrusion set (APT group), identified by its STIX ID. Campaigns represent specific operations or intrusion events attributed to a threat group. Args: group_stix_id: STIX UUID of the group (e.g., "intrusion-set--UUID"). domain: ATT&CK domain ("enterprise", "mobile", "ics"). include_description: Whether to include campaign descriptions. Returns: { "group": { "attack_id": "GXXXX" | null, "name": "<group name or null>", "stix_id": "<intrusion-set--UUID>", "description": "<text or null>" …

Get campaigns by their alias. Campaigns frequently have multiple names assigned by different vendors or research teams. This function resolves those aliases. Args: alias: Campaign alias or alternate name (case-insensitive) domain: ATT&CK domain ("enterprise", "ics", etc.) include_description: Include campaign descriptions in output Returns: { "alias": "<requested name>", "count": int, "campaigns": [ { "name": "...", "stix_id": "<campaign--UUID>", "attack_id": "Cxxxx" | null, "description": "..." | null …

Get all campaigns that use specific software/malware. This is a reverse lookup: Software → Campaigns. Args: software_stix_id: Software STIX UUID identifier (e.g., 'malware--UUID', 'tool--UUID'). domain: ATT&CK domain ('enterprise', 'mobile', 'ics'). include_description: Whether to include campaign descriptions. Returns: { "software": { "attack_id": "SXXXX or similar" | null, "name": "<software name or null>", "stix_id": "<software STIX ID>", "type": "<malware|tool|...> or null", "description": "<text or null>", } …

Get all campaigns that use a specific technique. This is a reverse lookup: Technique → Campaigns. Args: technique_stix_id: Technique STIX UUID identifier (e.g., 'attack-pattern--UUID'). domain: ATT&CK domain ('enterprise', 'mobile', 'ics'). include_description: Whether to include campaign descriptions. Returns: { "technique": { "attack_id": "TXXXX or TXXXX.YYY" | null, "name": "<technique name or null>", "stix_id": "<attack-pattern--UUID>", "description": "<text or null>", } | null, "count": <n…

Return statistics about downloaded MITRE ATT&CK STIX data. This confirms which domains are present on disk, their file paths, sizes, and ATT&CK release version. It assumes that downloads have already been attempted at server startup.

Get all data components that can detect a specific technique. Primary mode: - Use mitreattack-python relationship traversal (if present) Fallback mode (when relationship traversal yields 0): - Read technique.x_mitre_data_sources (strings) - Resolve data source objects by name - Return data components whose x_mitre_data_source_ref points to those data sources - If the string includes a component name (e.g., "Process: Process Creation"), filter to that component when possible. Returns the same structure as before, plus a debug block.

Retrieve an intrusion set (APT group) by name or alias (case-insensitive match). This tool searches ATT&CK intrusion sets by name or alias and returns the first matching group. Matching is case-insensitive and supports partial matches. Examples: - get_group_by_name("APT29") - get_group_by_name("Lazarus") - get_group_by_name("Fancy Bear") Args: group_name: The group name or alias to search for (case-insensitive). domain: ATT&CK domain ("enterprise", "mobile", "ics"). include_description: Whether to include descriptions in the output. Returns: { "found": boo…

Get all techniques used by a specific APT group (intrusion set). This tool: 1) Locates a group by name or alias (case-insensitive, partial match). 2) Uses MITRE's get_techniques_used_by_group() to retrieve techniques related to that group (via 'uses' relationships). Args: group_name: Group name or alias (e.g., "APT29", "Lazarus Group"). domain: ATT&CK domain ("enterprise", "mobile", or "ics"). include_description: Whether to include descriptions in the output. Returns: { "found": bool, # whether the group was found "group": { "attack_id": "GXX…

Get all APT groups (intrusion sets) attributed to a specific campaign. This is a reverse lookup: Campaign → Groups. It follows attribution relationships from a campaign STIX ID to intrusion sets (groups). Args: campaign_stix_id: STIX ID of the campaign (e.g., "campaign--UUID"). domain: ATT&CK domain ("enterprise", "mobile", "ics"). include_description: Whether to include group descriptions. Returns: { "campaign": { "attack_id": "CXXXX" | null, "name": "<campaign name or null>", "stix_id": "<campaign--UUID>", "description": "<text…

Get APT groups (intrusion sets) matching a given alias. Many groups have multiple aliases—e.g., APT29 is also known as: "Cozy Bear", "NOBELIUM", "Midnight Blizzard", etc. This tool returns all groups whose alias list contains the given alias (case-insensitive exact match, per MITRE's own alias indexing). Args: alias: Alias to search for (e.g., "Cozy Bear", "NOBELIUM"). domain: ATT&CK domain ("enterprise", "mobile", "ics"). include_description: Whether to include group descriptions. Returns: { "count": <number>, "groups": [ { "attack_id": "GXXXX…

Get all APT groups (intrusion sets) that use a specific software/malware. This is a reverse lookup: Software → Groups. It follows 'uses' relationships from a software STIX ID (tool/malware) to intrusion sets. Args: software_stix_id: STIX ID of the software object (e.g., "malware--UUID", "tool--UUID"). domain: ATT&CK domain ("enterprise", "mobile", "ics"). include_description: Whether to include group descriptions. Returns: { "software": { "attack_id": "SXXXX or similar" | null, "name": "<software name or null>", "stix…

Get all APT groups (intrusion sets) that use a specific technique. This is a reverse lookup: Technique → Groups. It follows 'uses' relationships from a technique STIX ID to intrusion sets. Args: technique_stix_id: STIX ID of the technique (e.g., "attack-pattern--UUID"). domain: ATT&CK domain ("enterprise", "mobile", "ics"). include_description: Whether to include group descriptions. Returns: { "technique": { "attack_id": "TXXXX or TXXXX.YYY" | null, "name": "<technique name or null>", "stix_id": "<attack-pattern--UUI…

Return a standard ATT&CK Navigator layer metadata template. This provides default layer properties (version info, gradient settings, layout, filters, etc.) adapted to a specific ATT&CK domain. Useful for clients that want to build custom layers programmatically without starting from scratch. Args: domain: One of "enterprise", "mobile", "ics". Defaults to "enterprise". Returns: { "success": bool, "domain": "<domain>", "metadata": { ... }, # Navigator layer metadata "message": "<summary>" }

Get all mitigations that address a specific technique. Helper returns: list[RelationshipEntry[Mitigation]] So each item is a wrapper that contains a Mitigation object (usually in `.object`). We must unwrap before extracting fields. Returns (same schema as before): { "found": bool, "technique": {...} | null, "count": int, "mitigations": [...], "formatted": str, "message": str }

Resolve the human-readable object name for a given STIX ID. This converts internal STIX UUIDs such as: attack-pattern--UUID intrusion-set--UUID malware--UUID tool--UUID course-of-action--UUID into ATT&CK object names such as: "Phishing" "APT29" "Cobalt Strike" "Valid Accounts" Args: stix_id: STIX UUID of the object. domain: ATT&CK domain ("enterprise", "mobile", "ics"). Returns: { "found": bool, "name": "<object name or null>", "message": "<status message>" }

Retrieve any MITRE ATT&CK object by its external ATT&CK ID and STIX type. This tool supports techniques, intrusion sets (APT groups), malware, tools, mitigations, campaigns, data sources, data components, and tactics. Args: attack_id: The external ATT&CK ID (e.g., "T1055", "G0016", "S0154", "M1013"). stix_type: The STIX object type (e.g., "attack-pattern", "intrusion-set"). domain: ATT&CK domain ("enterprise", "mobile", or "ics"). include_description: Whether to include the object's description field. Returns: { "found": bool, "object": { "id": "<AT…

Retrieve any MITRE ATT&CK object by its STIX ID (UUID). STIX IDs are internal identifiers like: - attack-pattern--a62a8db3-f23a-4d8f-afd6-9dbc77e7813b This tool is useful when you already have a STIX ID from another query or relationship and want to resolve it to the full object. Args: stix_id: STIX object ID (e.g., "attack-pattern--..."). domain: ATT&CK domain to search in ("enterprise", "mobile", "ics"). include_description: Whether to include the object's description. Returns: { "found": bool, "object": { "attack_id": "<ATT&CK external ID or null>…

Search MITRE ATT&CK objects by matching text inside their description field. This performs a full-text search over object descriptions. It is useful for: • Finding techniques related to specific technologies (e.g., “PowerShell”) • Finding groups mentioning a region or country (e.g., “Russia”) • Finding mitigations referencing specific defenses (e.g., “multi-factor”) • Searching malware or tool descriptions for keywords Args: content: The text to search for (case-insensitive, partial match). object_type: STIX object type, such as: - "attack-pattern" (techniques) …

Retrieve MITRE ATT&CK objects by exact name match (case-sensitive). This tool performs an exact name match for a specific STIX type within a given ATT&CK domain. It is more strict than generic search methods, which typically perform partial or keyword matching. Examples: - Technique: get_objects_by_name("Phishing", "attack-pattern") - Group: get_objects_by_name("APT29", "intrusion-set") - Malware: get_objects_by_name("Cobalt Strike", "malware") Args: name: Exact object name to search for (case-sensitive). stix_type: STIX object type (same values as get_object_by_attack_i…

Get all objects of a specific STIX type. This is a generic method to retrieve ATT&CK/CTI objects by STIX type. It complements more specific tools such as get_all_techniques(), get_all_groups(), etc. Common STIX types include: - 'attack-pattern' (techniques) - 'malware' (malware) - 'tool' (tools) - 'intrusion-set' (APT groups) - 'campaign' (campaigns) - 'course-of-action' (mitigations) - 'x-mitre-matrix' (matrices) - 'x-mitre-tactic' (tactics) - 'x-mitre-data-source' (data sourc…

Get all ATT&CK objects created after a specific timestamp. Useful for detecting new additions to the framework. Timestamp must be ISO8601 format, e.g., '2024-01-01T00:00:00Z'. Returns: { "found": bool, "count": int, "objects": [ { "id": "<ATT&CK ID or None>", "name": "...", "stix_id": "...", "type": "<stix-type>", "description": "..." | None }, ... ], "formatted": "<pretty text>", "message": "..." }

Get all ATT&CK objects modified after a specific timestamp. Useful for tracking updates and changes to the ATT&CK framework. Timestamp must be ISO8601 format, e.g., '2024-01-01T00:00:00Z'. Returns: { "found": bool, "count": int, "objects": [ { "id": "<ATT&CK ID or None>", "name": "...", "stix_id": "...", "type": "<stix-type>", "description": "..." | None }, ... ], "formatted": "<pretty text>", "message": "..." }

Get the parent technique of a subtechnique. Args: technique_stix_id: STIX UUID of the subtechnique. domain: ATT&CK domain ('enterprise', 'mobile', 'ics'). include_description: Whether to include the parent's description. Returns: { "subtechnique_stix_id": "...", "subtechnique_attack_id": "Txxxx.xxx" or null, "parent": { "attack_id": "Txxxx", "name": "...", "stix_id": "attack-pattern--UUID", "description": "..." | null } or null, "formatted": "<human readable description>", "message": "<summary>" }

Get all procedure examples for techniques in a specific tactic. Shows real-world examples of how threat groups use techniques that fall under a given tactic (e.g., Initial Access, Persistence). Args: tactic: Tactic name (e.g., "Initial Access", "Persistence"). Case-insensitive; should match ATT&CK tactic names. domain: ATT&CK domain ('enterprise', 'mobile', 'ics'). include_description: Include example descriptions when available. Returns: { "tactic": { "name": "<tactic name>", "attack_id": "TAxxxx" | null, "stix_id": "x-mitre-t…

Get procedure examples showing how threat groups used a specific technique. Procedure examples describe real incident behavior tied to this technique. Args: technique_stix_id: STIX UUID of the technique domain: ATT&CK domain include_description: Include descriptions of the examples if available Returns: { "technique": { "attack_id": "Txxxx", "name": "...", "stix_id": "attack-pattern--UUID" }, "count": N, "examples": [ { "relationship_id": "relationship--UUID", "source_group_attack_id": "G…

Get all revoked techniques for a domain. Revoked techniques are no longer valid in the framework, often because they were merged or replaced. Returns: { "found": bool, "count": int, "techniques": [...], "formatted": "<pretty output>", "message": "..." }

Get all software (malware and tools) in a given ATT&CK domain. This returns non-revoked, non-deprecated software objects, including both malware and tools, as defined by the MITRE ATT&CK dataset. Args: domain: ATT&CK domain to search ("enterprise", "mobile", or "ics"). include_description: Whether to include descriptions in the output and formatted text. Returns: { "count": <number of software objects>, "software": [ { "attack_id": "<SXXXX or similar, if present>", "name": "<software name>", "stix_id": "<…

Find software/malware by alias (e.g., 'Beacon', 'Mimilib'). Many malware/tools have multiple alternative names. This tool searches the software catalog for alias matches. Args: alias: Alias to search for. domain: ATT&CK domain ("enterprise", "mobile", "ics"). include_description: Whether to include description fields. Returns: { "alias": "<alias>", "count": <number of matches>, "software": [ { "attack_id": "<SXXXX or MXXXX or None>", "name": "<software name>", "aliases": [...], "stix_id": "<malware--UUID or to…

Get all software/malware used in a specific campaign. Args: campaign_stix_id: Campaign STIX UUID identifier (e.g., 'campaign--UUID'). domain: ATT&CK domain ('enterprise', 'mobile', 'ics'). include_description: Whether to include software descriptions. Returns: { "campaign": { "attack_id": "CXXXX" | null, "name": "<campaign name or null>", "stix_id": "<campaign--UUID>", "description": "<text or null>", } | null, "count": <number of software objects>, "software": [ { "attack_id": "SXXXX or simil…

Get all software (malware and tools) used by a specific APT group, identified by its STIX ID. This uses MITRE's `get_software_used_by_group` to follow 'uses' relationships from an intrusion set (group) to software objects. Args: group_stix_id: STIX ID of the group (e.g., "intrusion-set--UUID"). domain: ATT&CK domain ("enterprise", "mobile", "ics"). include_description: Whether to include software descriptions. Returns: { "group": { "attack_id": "GXXXX" | null, "name": "<group name or null>", "stix_id": "<intrusion-set--UUID>", "d…

Get all software (malware/tools) that use a specific technique. This is a reverse lookup: Technique → Software. It follows 'uses' relationships from a technique STIX ID to software (malware and tools) that implement or leverage that technique. Args: technique_stix_id: STIX ID of the technique (e.g., "attack-pattern--UUID"). domain: ATT&CK domain ("enterprise", "mobile", "ics"). include_description: Whether to include software descriptions. Returns: { "technique": { "attack_id": "TXXXX or TXXXX.YYY" | null, "name": "<technique …

Get basic statistics about the loaded ATT&CK data for a given domain. This returns counts of key object types (techniques, groups, software, tactics, mitigations), excluding revoked/deprecated entries. Args: domain: ATT&CK domain ("enterprise", "mobile", "ics"). Returns: { "domain": "<domain>", "stats": { "techniques": <int>, "groups": <int>, "software": <int>, "tactics": <int>, "mitigations": <int> }, "message": "<status message>" }

Determine the STIX object type for a given STIX ID. This is useful when you have a raw STIX UUID (e.g., "attack-pattern--xxxx") but need to know whether it corresponds to a technique, intrusion set, malware, tool, mitigation, data source, etc. Args: stix_id: The STIX UUID identifier to look up. domain: ATT&CK domain ("enterprise", "mobile", "ics"). Returns: { "found": bool, "stix_type": "<type string or null>", "message": "<status message>" } Examples: get_stix_type("attack-pattern--a62a8db3-f23a-4d8f-afd6-9dbc77e7813b") → "attack-pattern"

Get all subtechniques of a parent technique. Args: technique_stix_id: STIX UUID of the parent technique. domain: ATT&CK domain. include_description: Whether to include subtechnique descriptions. Returns: { "parent": { "stix_id": "...", "attack_id": "...", "name": "..." }, "count": int, "subtechniques": [ { "attack_id": "...", "name": "...", "stix_id": "...", "description": "..." | null }, ... ], "formatted": "<multi-line strin…

Get all ATT&CK tactics belonging to a specific matrix. Args: matrix_stix_id: STIX ID of the matrix (e.g., x-mitre-matrix--UUID) domain: ATT&CK domain ('enterprise', 'mobile', 'ics') include_description: Whether to include tactic descriptions Returns: { "found": bool, "count": int, "tactics": [ { "name": "...", "stix_id": "...", "description": "...", "attack_id": "TAxxxx" or null } ], "formatted": "<multiline string>", "message": "..." }

Get all tactics associated with a specific ATT&CK technique. Techniques can belong to one or more tactics (kill chain phases). Args: technique_stix_id: Technique STIX UUID identifier (attack-pattern--UUID) domain: ATT&CK domain ('enterprise', 'mobile', 'ics') include_description: Whether to include tactic descriptions Returns: { "found": bool, "count": int, "tactics": [ { "name": "...", "stix_id": "...", "attack_id": "TAxxxx" or null, "description": "...", } ], "formatted": "<multiline form…

" Retrieve a MITRE ATT&CK technique by its external ATT&CK ID (e.g., "T1055", "T1053.005"). This tool searches the specified ATT&CK domain (enterprise, mobile, or ics) and returns both structured machine-readable data and an optional formatted human-readable text block. It is useful for user-facing responses as well as downstream programmatic reasoning. Args: technique_id: The external ATT&CK technique ID (e.g., "T1055"). domain: ATT&CK domain to search in ("enterprise", "mobile", "ics"). include_description: If True, returns the full ATT&CK description text. Returns: { …

Get the ATT&CK tactic names associated with a given technique. This tool: 1) Looks up a technique by its external ATT&CK ID (e.g., "T1055"). 2) Extracts its kill chain phases (tactics) from the STIX object. 3) Returns human-readable tactic names (e.g., "Initial Access"), along with the raw phase names and kill chain names. Args: technique_id: External ATT&CK technique ID (e.g., "T1055", "T1055.002"). domain: ATT&CK domain ("enterprise", "mobile", "ics"). Returns: { "found": bool, "technique": { "id": "<ATT&CK ID>", "name": "<technique n…

Get all ATT&CK techniques that apply to a specific platform. Args: platform: Platform name (e.g., 'Windows', 'Linux', 'macOS', 'Cloud', 'Azure AD', 'Network', etc.) domain: ATT&CK domain ('enterprise', 'mobile', 'ics'). include_description: Whether to include technique descriptions. Returns: { "platform": "<platform>", "count": <number>, "techniques": [ { "attack_id": "Txxxx" or "Txxxx.xxx" or null, "name": "<technique name>", "stix_id": "<attack-pattern--UUID>", "description": "<text or null>" …

Get all techniques associated with a specific ATT&CK tactic. This uses the MITRE ATT&CK Navigator-style mapping between tactics and techniques for a given domain (e.g., "enterprise-attack"). Examples: - get_techniques_by_tactic("Initial Access", "enterprise") - get_techniques_by_tactic("Execution", "enterprise") - get_techniques_by_tactic("Persistence", "enterprise") Args: tactic: Tactic name (e.g., "Initial Access", "Persistence"). domain: ATT&CK domain ("enterprise", "mobile", "ics"). include_description: Whether to include technique descriptions …

Get all techniques that can be detected by a specific data component. Shows which adversary techniques can be identified by monitoring this specific aspect of telemetry. Args: datacomponent_stix_id: Data component STIX UUID identifier (e.g., 'x-mitre-data-component--UUID'). domain: ATT&CK domain ('enterprise', 'mobile', 'ics'). include_description: Whether to include technique descriptions. Returns: { "datacomponent": { "name": "<data component name or null>", "stix_id": "<x-mitre-data-component--UUID>", "descrip…

Get all techniques mitigated by a specific mitigation (by STIX ID). Args: mitigation_stix_id: STIX UUID of the mitigation (e.g., course-of-action--UUID). domain: ATT&CK domain ('enterprise', 'mobile', 'ics'). include_description: Include technique descriptions in the output. Returns: { "found": bool, "mitigation": { "attack_id": "...", "name": "...", "stix_id": "course-of-action--..." } | null, "count": int, "techniques": [ { "attack_id": "Txxxx", "name": "...", "st…

Get all techniques that target a specific ICS asset. Shows which adversary techniques can affect a given industrial control system component. Args: asset_stix_id: STIX ID of the ICS asset domain: Domain (default: 'ics') include_description: Whether to include descriptions in formatted output Returns: { "found": bool, "count": int, "techniques": [ { "id": "<ATT&CK ID>", "name": "...", "stix_id": "...", "description": "..." | None }, ... ], …

Get all techniques used in a specific campaign. Args: campaign_stix_id: Campaign STIX UUID identifier (e.g., 'campaign--UUID'). domain: ATT&CK domain ('enterprise', 'mobile', 'ics'). include_description: Whether to include technique descriptions. Returns: { "campaign": { "attack_id": "CXXXX" | null, "name": "<campaign name or null>", "stix_id": "<campaign--UUID>", "description": "<text or null>", } | null, "count": <number of techniques>, "techniques": [ { "attack_id": "T…

Get all techniques used by a specific APT group, identified by its STIX ID. This is similar to `get_group_techniques`, but instead of a group name or alias it takes the group's STIX UUID (e.g. "intrusion-set--..."), which is useful when you already have the STIX ID from another query or relationship. Args: group_stix_id: STIX ID of the group (intrusion-set--UUID). domain: ATT&CK domain ("enterprise", "mobile", "ics"). include_description: Whether to include technique descriptions. Returns: { "group": { "attack_id": "GXXXX" | null, "name": "<group na…

Get techniques used by the software that a group uses (Group → Software → Techniques). This provides an indirect view of a group's capabilities by following: Group (intrusion set) → Software (malware/tools) → Techniques Args: group_stix_id: STIX ID of the group (e.g., "intrusion-set--UUID"). domain: ATT&CK domain ("enterprise", "mobile", "ics"). include_description: Whether to include technique descriptions. Returns: { "group": { "attack_id": "GXXXX" | null, "name": "<group name or null>", "stix_id": "<intrusion-set--UUID>", …

Get all techniques used by specific software/malware. This shows what ATT&CK techniques a given software (tool/malware) is capable of performing. Args: software_stix_id: STIX ID of the software object (e.g., "malware--UUID", "tool--UUID"). domain: ATT&CK domain ("enterprise", "mobile", "ics"). include_description: Whether to include technique descriptions. Returns: { "software": { "attack_id": "SXXXX or similar" | null, "name": "<software name or null>", "stix_id": "<software STIX ID>", "type": "<malware|too…

Search MITRE ATT&CK intrusion sets (APT groups) by name, alias, or description (case-insensitive). If the query is empty, all groups in the domain are returned. Args: query: Search keyword (name, alias, or any text in the description). domain: ATT&CK domain ("enterprise", "mobile", "ics"). include_description: Whether to include descriptions in the output. Returns: { "count": <number of matches>, "groups": [ { "attack_id": "GXXXX", "name": "...", "aliases": [...], "stix_id": "...", "description": "..." | n…

Search MITRE ATT&CK software (malware & tools) by keyword in name or description (case-insensitive). Args: query: Keyword to search for in software names and descriptions. domain: ATT&CK domain ("enterprise", "mobile", "ics"). include_description: Whether to include descriptions in the response. Returns: { "count": <number of matches>, "software": [ { "attack_id": "<SXXXX or similar>", "name": "...", "stix_id": "...", "type": "<tool|malware|...>", "description": "..." | null }, ... ], …

Search MITRE ATT&CK techniques by keyword in their name or description. This tool performs a case-insensitive search over all non-revoked, non-deprecated techniques in the given domain. A technique is matched if the query string appears in either: • the technique name, or • the technique description Examples: - search_techniques("PowerShell") - search_techniques("credential dumping") - search_techniques("initial access", domain="enterprise") Args: query: Text to search for in technique names and descriptions. domain: ATT&CK domain ("enterprise", "mobile", or "ics"). …