Skip to main content
Retrieve the MITRE ATT&CK TTPs associated with the threat actor. Notes:
  • Enrichment allows access to actor data for 8 hours without consuming tokens.
  • Maximum 1 request per second is allowed.
Response fields:
  • tokenCharged: If false, the request does not consume tokens.
  • tokensLeft: Shows the remaining token balance.

​
Parameters

ParameterDescription
Include ReferencesSelect to include references in the response.
OffsetThe offset to start returning results from.
SizeThe maximum number of results to return.

Note: Maximum 1000 results are allowed.
Threat Actor IDThe ID of the threat actor. Can be obtained by the List Threat Actors action.

​
Example Output

{
	"total": "Number",
	"results": [
		{
			"id": "String",
			"label": "String",
			"domain": "String",
			"references": [
				{
					"value": "String",
					"type": "String",
					"label": "String",
					"description": "String"
				}
			]
		}
	],
	"tokenCharged": "Boolean",
	"tokensLeft": "Number"
}

​
Workflow Library Example

Get Actor Mitre Ttps with Kela and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop