Skip to content

Get summary of MITRE

GET/cases/{caseId}/mitre-attack-summary

Cases API · Cases

Get summary of MITRE ATT&CK Tactics and Techniques.

Required permissionxdr-cases.case.mitre-attack-summary:read

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.
caseId path string Yes Case ID. The ID follows the pattern ^[A-Za-z0-9]+-[A-Za-z0-9]+$.

Request samples

curl -X GET "https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>/mitre-attack-summary" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>"


import requests

response = requests.get(
    "https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>/mitre-attack-summary",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>/mitre-attack-summary" -Headers $headers


package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>/mitre-attack-summary", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/cases/v1/cases/<caseId>/mitre-attack-summary", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses

200 — MITRE ATT&CK summary for case.

Response fields

tacticsarray of object
List of tactics.
Tactic used in the MITRE ATT&CK.
Show child attributesHide child attributes
idstring
ID of the tactic.
namestring
MITRE ATT&CK name.
techniquesarray of object
MITRE ATT&CK techniques.
Technique used in the MITRE ATT&CK.
Show child attributesHide child attributes
idstring
ID of the technique.
namestring
Name of the technique.

Errors

Status Meaning
400 Bad request.
401 Unauthorized.
403 Forbidden.
404 Not found.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "tactics": [
    {
      "id": "TA0002",
      "name": "Execution",
      "techniques": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter"
        }
      ]
    }
  ]
}

See the guide for a narrative walkthrough of this API.