# MITRE ATT\&CK Scraper API - Techniques, Groups & Software (`pink_comic/mitre-attack-techniques-groups-software-intelligence`) Actor

Search and normalize MITRE Enterprise ATT\&CK techniques, sub-techniques, groups, software, mitigations, data components, tactics, platforms, versions and bounded source-linked relationships from MITRE's public STIX bundle.

- **URL**: https://apify.com/pink_comic/mitre-attack-techniques-groups-software-intelligence.md
- **Developed by:** [Ava Torres](https://apify.com/pink_comic) (community)
- **Categories:** Developer tools, Automation, AI
- **Features:** Limited permissions
- **Stats:** 1 total users, 0 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.60 / 1,000 mitre att\&ck scraper api - techniques, groups & so evidence items

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## MITRE ATT\&CK Techniques Scraper API

Search MITRE Enterprise ATT\&CK techniques, sub-techniques, groups, software, mitigations and data components from the authoritative public STIX bundle. Outputs preserve MITRE IDs, versions, references, tactics, platforms, source links and bounded related objects.

The default `T1059` query returns one source-linked **Command and Scripting Interpreter** record with tactics and up to 20 related groups/software/mitigations/data components for at most **$0.0021** ($0.0001 start + $0.002/item).

```json
{"query":"T1059","objectTypes":["technique"],"maxResults":1,"maxCandidates":25000,"maxRelationships":20}
```

Filters include object types, tactics, platforms, revoked/deprecated state and modified date. The roughly 53 MB source is streamed and size-bounded; candidates, outputs and relationships are capped, and nested graphs are never recursively expanded.

**Important:** ATT\&CK is a curated knowledge base, not evidence of compromise, attribution, software presence, control effectiveness, or a complete/live incident record. Results reflect the repository snapshot retrieved at the reported timestamp and may be revised by MITRE.

See the full README for examples and field semantics.

### How to use

1. Open [MITRE ATT\&CK Scraper API - Techniques, Groups & Software](https://apify.com/pink_comic/mitre-attack-techniques-groups-software-intelligence) in Apify Console and click **Start** (or **Try for free**).
2. Fill in the input form - start with **MITRE ID, Name, or Keyword**, **Object Types**, **Maximum Results**. Every field is optional unless marked required, and the form is prefilled with a working example.
3. Set **Maximum results** to cap your cost, then run the Actor.
4. Download the results as JSON, CSV, Excel, XML or HTML, or pull them with the Apify API.

### Input

| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| `query` | string | no | "T1059" | Case-insensitive MITRE ID, object name, or description substring. Default T1059 returns Command and Scripting Interpreter. |
| `objectTypes` | array | no | \["technique"] | Choose techniques, sub-techniques, groups, software, mitigations, or data components. Allowed values: technique, sub-technique, group, so... |
| `tactics` | array | no |  | Exact ATT\&CK tactic phase names such as execution, persistence, or credential-access. |
| `platforms` | array | no |  | Exact platform names such as Windows, Linux, macOS, Azure AD, or Containers. |
| `includeRevoked` | boolean | no | false | Optional include revoked objects filter or result-control setting. See the README for exact source semantics, bounds, and examples. |
| `includeDeprecated` | boolean | no | false | Optional include deprecated objects filter or result-control setting. See the README for exact source semantics, bounds, and examples. |
| `modifiedSince` | string | no |  | Optional inclusive YYYY-MM-DD object modification filter. |
| `maxResults` | integer | no | 1 | Total paid dataset-item cap. |
| `maxCandidates` | integer | no | 25000 | Bounds normalized objects inspected after streaming the bundle. |
| `maxRelationships` | integer | no | 20 | Bounds related groups, software, mitigations and data components combined. Never emits an unbounded graph. |

#### Example input

```json
{
  "query": "T1059",
  "objectTypes": [
    "technique"
  ],
  "includeRevoked": false,
  "includeDeprecated": false,
  "maxResults": 1,
  "maxCandidates": 25000,
  "maxRelationships": 20
}
```

### Output example

One record from a real run (long values shortened, contact details partly masked):

```json
{
  "outcome": "FOUND",
  "stixId": "attack-pattern--7385dfaf-6886-4229-9ecd-6fd678040830",
  "mitreId": "T1059",
  "name": "Command and Scripting Interpreter",
  "objectType": "technique",
  "description": "Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting w...",
  "created": "2017-05-31T21:30:49.546Z",
  "modified": "2026-05-12T15:12:00.641Z",
  "version": "2.7",
  "revoked": false,
  "deprecated": false,
  "isSubTechnique": false,
  "tactics": [
    "execution"
  ],
  "platforms": [
    "Containers",
    "ESXi",
    "IaaS"
  ],
  "externalReferences": [
    {
      "sourceName": "mitre-attack",
      "externalId": "T1059",
      "url": "https://attack.mitre.org/techniques/T1059"
    },
    {
      "sourceName": "Remote Shell Execution in Python",
      "url": "https://www.thepythoncode.com/article/executing-bash-commands-remotely-in-python",
      "description": "Abdou Rockikz. (2020, July). How to Execute Shell Commands in a Remote Machine in Python. Retrieved July 26, 2021."
    },
    {
      "sourceName": "Cisco IOS Software Integrity Assurance - Command History",
      "url": "https://tools.cisco.com/security/center/resources/integrity_assurance.html#23",
      "description": "Cisco. (n.d.). Cisco IOS Software Integrity Assurance - Command History. Retrieved October 21, 2020."
    }
  ],
  "sourceRecordUrl": "https://attack.mitre.org/techniques/T1059",
  "relatedGroups": [
    {
      "stixId": "intrusion-set--c21dd6f1-1364-4a70-a1f7-783080ec34ee",
      "mitreId": "G0117",
      "name": "Fox Kitten",
      "type": "group",
      "relation": "uses",
      "sourceUrl": "https://attack.mitre.org/groups/G0117"
    },
    {
      "stixId": "intrusion-set--894aab42-3371-47b1-8859-a4a074c804c8",
      "mitreId": "G0038",
      "name": "Stealth Falcon",
      "type": "group",
      "relation": "uses",
      "sourceUrl": "https://attack.mitre.org/groups/G0038"
    },
    {
      "stixId": "intrusion-set--75a07184-a7e5-4222-95a1-a04dbc96a29c",
      "mitreId": "G1035",
      "name": "Winter Vivern",
      "type": "group",
      "relation": "uses",
      "sourceUrl": "https://attack.mitre.org/groups/G1035"
    }
  ],
  "relatedSoftware": [
    {
      "stixId": "malware--53ab35c2-d00e-491a-8753-41d35ae7e547",
      "mitreId": "S0334",
      "name": "DarkComet",
      "type": "software",
      "relation": "uses",
      "sourceUrl": "https://attack.mitre.org/software/S0334"
    },
    {
      "stixId": "malware--e91d3543-ca5d-474b-8b20-5a753ebc6e49",
      "mitreId": "S1227",
      "name": "StarProxy",
      "type": "software",
      "relation": "uses",
      "sourceUrl": "https://attack.mitre.org/software/S1227"
    },
    {
      "stixId": "malware--ccd61dfc-b03f-4689-8c18-7c97eab08472",
      "mitreId": "S0023",
      "name": "CHOPSTICK",
      "type": "software",
      "relation": "uses",
      "sourceUrl": "https://attack.mitre.org/software/S0023"
    }
  ],
  "relatedMitigations": [
    {
      "stixId": "course-of-action--23843cff-f7b9-4659-a7b7-713ef347f547",
      "mitreId": "M1033",
      "name": "Limit Software Installation",
      "type": "mitigation",
      "relation": "mitigates",
      "sourceUrl": "https://attack.mitre.org/mitigations/M1033"
    },
    {
      "stixId": "course-of-action--590777b3-b475-4c7c-aaf8-f4a73b140312",
      "mitreId": "M1045",
      "name": "Code Signing",
      "type": "mitigation",
      "rela
```

### Pricing

Pay per event: **$0.002 per mitre att\&ck scraper api - techniques, groups & so evidence item** plus **$0.0001 per run start**. No subscription to this Actor is needed. Apify Store discounts apply, so the price per result is lower on Silver, Gold and higher Apify plans. Use **Maximum results** to cap the cost of each run.

### FAQ

#### How much does MITRE ATT\&CK Scraper API - Techniques, Groups & Software cost?

$0.002 per mitre att\&ck scraper api - techniques, groups & so evidence item plus $0.0001 per run. For example, 1,000 results cost about $2.00. Higher Apify plans get a Store discount.

#### Do I need an API key or login?

No. Just configure the input and run it.

#### Can I run it on a schedule or from code?

Yes. Use Apify Schedules for recurring runs, or call it from the Apify API, the JavaScript or Python client, Make, Zapier, n8n, or any MCP-compatible AI agent.

#### Why did my run return no results?

Your filters are probably too narrow. Remove a filter or broaden the search, then run again. You only pay the result price for records that are actually saved.

#### Is the data accurate and up to date?

Each run fetches live data from the source described above, so results are as current as that source. Verify critical records with the original source before acting on them.

# Actor input Schema

## `query` (type: `string`):

Case-insensitive MITRE ID, object name, or description substring. Default T1059 returns Command and Scripting Interpreter.

## `objectTypes` (type: `array`):

Choose techniques, sub-techniques, groups, software, mitigations, or data components. Allowed values: technique, sub-technique, group, software, mitigation, data-component.

## `tactics` (type: `array`):

Exact ATT\&CK tactic phase names such as execution, persistence, or credential-access.

## `platforms` (type: `array`):

Exact platform names such as Windows, Linux, macOS, Azure AD, or Containers.

## `includeRevoked` (type: `boolean`):

Optional include revoked objects filter or result-control setting. See the README for exact source semantics, bounds, and examples.

## `includeDeprecated` (type: `boolean`):

Optional include deprecated objects filter or result-control setting. See the README for exact source semantics, bounds, and examples.

## `modifiedSince` (type: `string`):

Optional inclusive YYYY-MM-DD object modification filter.

## `maxResults` (type: `integer`):

Total paid dataset-item cap.

## `maxCandidates` (type: `integer`):

Bounds normalized objects inspected after streaming the bundle.

## `maxRelationships` (type: `integer`):

Bounds related groups, software, mitigations and data components combined. Never emits an unbounded graph.

## Actor input object example

```json
{
  "query": "T1059",
  "objectTypes": [
    "technique"
  ],
  "tactics": [],
  "platforms": [],
  "includeRevoked": false,
  "includeDeprecated": false,
  "maxResults": 1,
  "maxCandidates": 25000,
  "maxRelationships": 20
}
```

# Actor output Schema

## `results` (type: `string`):

All records from this run in the default dataset, shown with the Overview table view.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "query": "T1059",
    "maxResults": 1
};

// Run the Actor and wait for it to finish
const run = await client.actor("pink_comic/mitre-attack-techniques-groups-software-intelligence").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "query": "T1059",
    "maxResults": 1,
}

# Run the Actor and wait for it to finish
run = client.actor("pink_comic/mitre-attack-techniques-groups-software-intelligence").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "query": "T1059",
  "maxResults": 1
}' |
apify call pink_comic/mitre-attack-techniques-groups-software-intelligence --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,pink_comic/mitre-attack-techniques-groups-software-intelligence"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/ad6BIqclYGb0BLB9E/builds/639Z35fi0zZGNcJfR/openapi.json