ATT&CK API about cti

[johnwunder]

Hm, I end up making a similar query, the whole thing looks like this:

https://attack.mitre.org/api.php?action=ask&format=json&query=[[Category:Group]]|[[Has%20ID::G0018]]|?Has%20display%20name|?Has%20technique|?Has%20ID|?Has%20alias|?Has%20description|?Uses%20software|?Categories|?Citation%20reference|?Has%20contributor|limit=9999

Notice the key in there is "|?Uses software" (the space is encoded as %20). If you try that URL it should pull back what you're looking for.

The other thing you could do is use the JSON in this repository directly (mitre-attack.json file). The groups are intrusion sets, software is either malware or tool, and relationships will link them together (it's modeled as a node/link graph).

[johnwunder]

This issue has been open awhile, I'm going to close it. Please re-open or contact [email protected] if you're still having issues.