API Reference

Get an ATT&CK Group

Fetch the full record for a single MITRE ATT&CK group (intrusion set) by its ATT&CK identifier, including its aliases, description, domains, and the STIX identifier MITRE assigns it.

GET

/v1/mitre/groups/{attack-id}

Cost: 1 credit per successful call

Path parameters

attack-idstringrequired

An ATT&CK group identifier matching the pattern ^G\d{4}$ (e.g. G0016). Input is case-insensitive and normalised to upper case server-side.

Request

curl https://api.edgeprotect.io/functions/v1/mitre/groups/G0016 \
  -H "Authorization: Bearer $EDGEPROTECT_API_KEY"

Response

{
  "data": {
    "attack_id": "G0016",
    "stix_id": "intrusion-set--899ce53f-13a0-479b-a0e4-67d46e241542",
    "name": "APT29",
    "aliases": ["APT29", "IRON RITUAL", "NOBELIUM", "UNC2452", "Cozy Bear", "Midnight Blizzard"],
    "description": "APT29 is a threat group that has been attributed to Russia's Foreign Intelligence Service (SVR). It has operated since at least 2008 and is known for the SolarWinds supply chain compromise.",
    "domains": ["enterprise-attack"],
    "url": "https://attack.mitre.org/groups/G0016",
    "created": "2017-05-31T21:31:52.748Z",
    "modified": "2026-01-20T16:22:04.140Z"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.attack_idstringoptional

The canonical ATT&CK group identifier (e.g. G0016).

data.stix_idstringoptional

The STIX identifier MITRE assigns to this intrusion set (e.g. intrusion-set--899ce53f-...).

data.namestringoptional

The primary group name (e.g. APT29).

data.aliasesarrayoptional

Known aliases for the group (e.g. ["Cozy Bear", "NOBELIUM"]). May be empty.

data.descriptionstringoptional

The group's ATT&CK description, as published by MITRE.

data.domainsarrayoptional

ATT&CK domains the group appears in (e.g. ["enterprise-attack"]).

data.urlstringoptional

The canonical MITRE ATT&CK URL for the group.

data.createdstringoptional

ISO 8601 timestamp when MITRE created this group entry.

data.modifiedstringoptional

ISO 8601 timestamp when MITRE last modified this group entry.

Errors

Status	`error`	When
400	`invalid_attack_id`	The path segment did not match the `^G\d{4}$` pattern.
401	`invalid_authorization`	The `Authorization` header is missing or malformed.
401	`unauthorized`	The key is invalid, revoked, or the request IP is not on the allowlist.
402	`insufficient_credits`	The organisation's credit balance is below 1.
404	`not_found`	The group identifier is valid but is not in the dataset.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	An unexpected server error occurred.

See Errors for the full error reference.