Get MITRE ATT&CK Techniques

Retrieves a list of MITRE ATT&CK techniques.

Required Permissions

Requires the MEMBER role or higher.

HTTP Request

GET /api/sonar/mitre-attack/techniques

cURL Example

curl -H "Authorization: Bearer <API_KEY>" \
     "https://HOSTNAME/api/sonar/mitre-attack/techniques?offset=0&limit=10"

Request Parameters

Key	Required	Type	Description	Note
mitre_ids	X	String list	MITRE ATT&CK ID list	Comma-separated
offset	X	32-bit integer	Number of items to skip	Default: `0`
limit	X	32-bit integer	Maximum number of items	Max 2000, no limit if unspecified
keywords	X	String	Search keyword

Success Response

{
  "total_count": 193,
  "techniques": [
    {
      "mitre_id": "T1190",
      "name": "Exploit Public-Facing Application",
      "display_name": "Exploit Public-Facing Application",
      "url": "https://attack.mitre.org/techniques/T1190",
      "tactics": [
        {
          "mitre_id": "TA0001",
          "name": "Initial Access"
        }
      ]
    },
    {
      "mitre_id": "T1059",
      "name": "Command and Scripting Interpreter",
      "display_name": "Command and Scripting Interpreter",
      "url": "https://attack.mitre.org/techniques/T1059",
      "sub_techniques_count": 1,
      "sub_techniques": [
        {
          "mitre_id": "T1059.001",
          "name": "PowerShell",
          "display_name": "Command and Scripting Interpreter: PowerShell",
          "url": "https://attack.mitre.org/techniques/T1059/001",
          "tactics": [
            {
              "mitre_id": "TA0002",
              "name": "Execution"
            }
          ]
        }
      ],
      "tactics": [
        {
          "mitre_id": "TA0002",
          "name": "Execution"
        }
      ]
    }
  ]
}

total_count (32-bit integer): Total number of techniques
techniques (Array): Technique list
- mitre_id (String): MITRE ATT&CK technique ID
- name (String): Technique name
- display_name (String): Technique display name. If a parent technique exists, in the format "parent technique name: name".
- url (String): MITRE ATT&CK official documentation URL
- sub_techniques_count (32-bit integer): Number of sub-techniques. Returned only when sub-techniques exist.
- sub_techniques (Array): List of sub-techniques. Returned only when sub-techniques exist, and each element has the same structure as the parent technique.
- tactics (Array): Associated tactic list
  - mitre_id (String): MITRE ATT&CK tactic ID
  - name (String): Tactic name

Error Responses

offset or limit is not an integer

HTTP status code 400

{
  "error_code": "invalid-argument",
  "error_msg": "'offset' parameter should be int type"
}

offset or limit is negative

HTTP status code 400

{
  "error_code": "invalid-argument",
  "error_msg": "'offset' must be greater than or equal to 0."
}

limit exceeds 2000

HTTP status code 400

{
  "error_code": "invalid-argument",
  "error_msg": "'limit' must be less than or equal to 2000."
}