Get MITRE ATT&CK Tactics

Retrieves a list of MITRE ATT&CK tactics.

Required Permissions

Requires the MEMBER role or higher.

HTTP Request

cURL Example

curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/mitre-attack/tactics

Request Parameters

Success Response

{
  "total_count": 14,
  "tactics": [
    {
      "mitre_id": "TA0001",
      "stix_id": "x-mitre-tactic--ffd5bcee-6e16-4dd2-8eca-7b3beedf33ca",
      "name": "Initial Access",
      "description": "The adversary is trying to get into your network.",
      "url": "https://attack.mitre.org/tactics/TA0001",
      "domain": "enterprise-attack",
      "version": "1.0",
      "order": 1,
      "created": "2018-10-17 09:00:00+0900",
      "updated": "2019-07-19 09:00:00+0900"
    },
    {
      "mitre_id": "TA0002",
      "stix_id": "x-mitre-tactic--4ca45d45-df4d-4613-8980-bac22d278fa5",
      "name": "Execution",
      "description": "The adversary is trying to run malicious code.",
      "url": "https://attack.mitre.org/tactics/TA0002",
      "domain": "enterprise-attack",
      "version": "1.0",
      "order": 2,
      "created": "2018-10-17 09:00:00+0900",
      "updated": "2019-07-19 09:00:00+0900"
    }
  ]
}

• total_count (32-bit integer): Total number of tactics
• tactics (Array): Tactic list
  • mitre_id (String): MITRE ATT&CK tactic ID
  • stix_id (String): STIX identifier
  • name (String): Tactic name
  • description (String): Tactic description
  • url (String): MITRE ATT&CK official documentation URL
  • domain (String): ATT&CK domain
  • version (String): Tactic version
  • order (32-bit integer): Tactic sort order
  • created (String): Creation time in yyyy-MM-dd HH:mm:ssZ format
  • updated (String): Update time in yyyy-MM-dd HH:mm:ssZ format

Error Responses

If no tactics match the search criteria, a success response is returned with total_count of 0 and tactics as an empty array.