mitre_get_datasource

Generate possible attack paths through the kill chain

Build a technique profile with group/software/campaign matching

Map Cortex analyzers to ATT&CK data sources

Run analyzers on observables with ATT&CK context (write-gated)

Search for techniques across Wazuh, TheHive, and MISP simultaneously

Get current data version and object counts

Analyze detection coverage based on available data sources

Get campaign details with techniques, software, and groups

Get group details including techniques and software used

Get mitigation details with addressed techniques

Get software details with techniques and associated groups

Get tactic details with all associated techniques

Get full details of a technique by ID (T1059, T1059.001)

List all known ATT&CK campaigns

List all known threat groups

List all tactics in kill-chain order

Map security alerts to likely ATT&CK techniques

Map Wazuh alerts to ATT&CK techniques by rule ID/description/groups

Create events pre-tagged with ATT&CK techniques (write-gated)

Map MISP event attributes/galaxies to ATT&CK

List events with ATT&CK enrichment

Search MISP IOCs by technique or group

Get all mitigations for a specific technique

Generate ATT&CK Navigator JSON layers (coverage, group, campaign, diff)

Search campaigns by keyword or technique

Search groups by keyword or technique usage

Search mitigations by keyword

Search software by name, technique, or type (malware/tool)

Search techniques by keyword, tactic, platform, data source

Connection status for all SOC integrations

Find technique overlap between groups for attribution

Create a case pre-populated with ATT&CK context (write-gated)

Enrich a TheHive case with ATT&CK techniques and mitigations

List cases with ATT&CK technique filtering

Force update of the local ATT&CK data cache

Fetch recent alerts enriched with ATT&CK context

Analyze Wazuh rules mapped to ATT&CK techniques

Wazuh manager status, agents, and rule stats