Threat Actors

`get_threat_actor_techniques`

Full technique set for a threat actor. Uses MITRE ATT&CK where the actor is one of the ~170 named intrusion sets (returning MITRE's own cited usage text), and falls back to the in-house dataset for the ~800 actors ATT&CK does not name — so ransomware operations like SafePay resolve too. Returns each technique id, name, tactic and sub-technique parent; the source field says which dataset answered. Matches by slug, alias or name. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

namestringrequired

Slug, alias, or display name. 1–120 characters, case-insensitive. Aliases resolve to the canonical actor (e.g. Cozy Bear → APT29). Examples: APT29, Lazarus Group, safepay.

Two sources, tried in order

Why there is a fallback

MITRE ATT&CK names roughly 170 intrusion sets. Precursor tracks 815 actors, so before the fallback existed this tool answered matched: false for most of the actors the platform covers — including every ransomware operation MITRE has not named. ATT&CK is still tried first and still wins when it matches, because its uses relationships carry MITRE's own cited usage text.

`source`	Meaning
`mitre_attack`	Resolved via ATT&CK. `actor.attack_id` and `actor.url` are present; every technique has a MITRE `description` and `url`.
`precursor_threat_intel`	Resolved via the in-house dataset. Techniques carry `is_attack`, `source_url` and a quoted `usage`. Names and tactics are enriched from ATT&CK wherever the technique id resolves.

When source is precursor_threat_intel, techniques[].is_attack is false for observed behaviours that are not ATT&CK techniques — they have no ATT&CK id to pivot on and do not belong in a matrix.

Example invocation

Ask your agent: "What MITRE ATT&CK techniques does APT29 use?"

curl -s https://api.precursorintelligence.com/functions/v1/mcp \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_threat_actor_techniques","arguments":{"name":"APT29"}}}'

Response

result.content[0].text (parsed)

{
  "matched": true,
  "query": "APT29",
  "source": "mitre_attack",
  "actor": {
    "attack_id": "G0016",
    "name": "APT29",
    "aliases": ["Cozy Bear", "NOBELIUM", "The Dukes"],
    "url": "https://attack.mitre.org/groups/G0016"
  },
  "technique_count": 66,
  "tactic_count": 13,
  "techniques": [
    {
      "technique_id": "T1003.002",
      "technique_name": "Security Account Manager",
      "tactic": "Credential Access",
      "tactics": ["credential-access"],
      "is_subtechnique": true,
      "parent_technique_id": "T1003",
      "parent_technique_name": "OS Credential Dumping",
      "usage": "APT29 has used the `reg save` command to save registry hives.",
      "url": "https://attack.mitre.org/techniques/T1003/002"
    },
    {
      "technique_id": "T1059.001",
      "technique_name": "PowerShell",
      "tactic": "Execution",
      "tactics": ["execution"],
      "is_subtechnique": true,
      "parent_technique_id": "T1059",
      "parent_technique_name": "Command and Scripting Interpreter",
      "usage": "APT29 has used PowerShell to execute commands and download payloads.",
      "url": "https://attack.mitre.org/techniques/T1059/001"
    }
  ]
}

Fields

Field	Type	Notes
`matched`	boolean	`false` only when the name matches neither dataset. The other fields are then empty.
`source`	string	`mitre_attack` or `precursor_threat_intel` — which dataset answered.
`actor`	object	ATT&CK path: `attack_id` (e.g. `G0016`), canonical `name`, `aliases[]`, `url`. In-house path: `name`, `slug`, `aliases[]`, and `attack_id` when the actor has one.
`technique_count`	integer	Number of distinct techniques returned.
`tactic_count`	integer	Number of distinct ATT&CK tactics those techniques span.
`techniques[]`	array	One entry per technique, ordered so sub-techniques sit under their parent.
`techniques[].technique_id`	string	ATT&CK ID, e.g. `T1059` or `T1059.001`.
`techniques[].tactic`	string	Primary tactic, human-readable (e.g. `Credential Access`). `tactics[]` holds all raw tactic shortnames.
`techniques[].is_subtechnique`	boolean	When `true`, `parent_technique_id` / `parent_technique_name` identify the parent.
`techniques[].usage`	string	How the actor uses the technique — MITRE's cited usage text on the ATT&CK path, the quoted source sentence on the in-house path (may be null).
`techniques[].is_attack`	boolean	In-house path only. `false` marks a real observed behaviour that is not an ATT&CK technique.
`techniques[].source_url`	string	In-house path only. Where the usage quote was published.

Each technique also carries a description (the ATT&CK technique description) and a url to attack.mitre.org. For the full MCP envelope (including _meta.precursor with request_id, credits, and response_truncated), see Response Format.

Errors

Code	Message	When
`-32602`	`invalid_params: name: required`	`name` is missing or empty
`-32602`	`invalid_params: name: max:120`	`name` exceeds 120 characters
`-32001`	`unauthorized`	API key is invalid or revoked
`-32002`	`insufficient_credits`	Credit balance is zero

A name that matches neither dataset is not an error — it returns a successful response with {"matched": false, "source": null, ...} and an empty technique list. The credit is charged, since the call itself succeeded.

get_threat_actor — full dossier. Its techniques array is capped at 40; this tool is uncapped.
list_threat_actor_cves — what the actor exploits, ordered for a patch queue.

get_threat_actor_techniques