Get MITRE ATT&CK Technique

Retrieves detailed information of a specific MITRE ATT&CK technique.

Required Permissions

Requires the MEMBER role or higher.

HTTP Request

cURL Example

curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/mitre-attack/techniques/T1190

Request Parameters

Success Response

{
  "technique": {
    "mitre_id": "T1190",
    "stix_id": "attack-pattern--3f886f2a-874f-4333-b794-aa6075009b1c",
    "name": "Exploit Public-Facing Application",
    "display_name": "Exploit Public-Facing Application",
    "description": "Adversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability.",
    "url": "https://attack.mitre.org/techniques/T1190",
    "domain": "enterprise-attack",
    "version": "2.4",
    "detection": "Monitor application logs for abnormal behavior that may indicate attempted or successful exploitation.",
    "platforms": "Linux, Windows, macOS, Network",
    "defenses_bypassed": null,
    "contributors": null,
    "permission_required": null,
    "support_remote": null,
    "system_requirements": null,
    "impact_type": null,
    "effective_permissions": null,
    "relationship_citations": null,
    "created": "2018-04-18 09:00:00+0900",
    "updated": "2023-04-15 09:00:00+0900",
    "tactics": [
      {
        "mitre_id": "TA0001",
        "stix_id": "x-mitre-tactic--ffd5bcee-6e16-4dd2-8eca-7b3beedf33ca",
        "name": "Initial Access",
        "description": "The adversary is trying to get into your network.",
        "url": "https://attack.mitre.org/tactics/TA0001",
        "domain": "enterprise-attack",
        "version": "1.0",
        "order": 1,
        "created": "2018-10-17 09:00:00+0900",
        "updated": "2019-07-19 09:00:00+0900"
      }
    ]
  }
}

• technique (Map): Technique information
  • mitre_id (String): MITRE ATT&CK technique ID
  • stix_id (String): STIX identifier
  • name (String): Technique name
  • display_name (String): Technique display name. If a parent technique exists, in the format "parent technique name: name".
  • description (String): Technique description
  • url (String): MITRE ATT&CK official documentation URL
  • domain (String): ATT&CK domain
  • version (String): Technique version
  • detection (String): Detection methods
  • platforms (String): Applicable platforms. A comma-separated string.
  • defenses_bypassed (String): Defenses bypassed
  • contributors (String): Contributors
  • permission_required (String): Permissions required to execute
  • support_remote (Boolean): Whether remote support is available
  • system_requirements (String): System requirements
  • impact_type (String): Impact type
  • effective_permissions (String): Effective permissions
  • relationship_citations (String): Relationship citations
  • created (String): Creation time in yyyy-MM-dd HH:mm:ssZ format
  • updated (String): Update time in yyyy-MM-dd HH:mm:ssZ format
  • super_technique (Map): Parent technique information. Returned only when this technique is a sub-technique, with the same structure as a technique.
  • sub_techniques_count (32-bit integer): Number of sub-techniques. Returned only when sub-techniques exist.
  • sub_techniques (Array): List of sub-techniques. Returned only when sub-techniques exist, and each element has the same structure as a technique.
  • tactics (Array): Associated tactic list
    • mitre_id (String): MITRE ATT&CK tactic ID
    • stix_id (String): STIX identifier
    • name (String): Tactic name
    • description (String): Tactic description
    • url (String): MITRE ATT&CK official documentation URL
    • domain (String): ATT&CK domain
    • version (String): Tactic version
    • order (32-bit integer): Tactic sort order
    • created (String): Creation time in yyyy-MM-dd HH:mm:ssZ format
    • updated (String): Update time in yyyy-MM-dd HH:mm:ssZ format

Error Responses

Technique not found

HTTP status code 200

{
  "technique": null
}