mitre
How to get Tactics by Platform?
I am looking for the proper way to return the Tactics of the PRE Platform within the Enterprise domain.
https://attack.mitre.org/matrices/enterprise/pre/
In this case I need to return only Reconnaissance and Resource Development.
The only way I'm able to think about this is by first getting all the techniques by platform, and then returning the corresponding platforms. https://github.com/mitre/cti/blob/master/USAGE.md#techniques-by-platform
Needless to say that it seems a lot of work for getting just two objects. Is this the only approach?
Unfortunately yes, that's the only reliable, extensible answer. I believe PRE is the only platform which has its own tactics, the other tactics are a mix of the other platforms.
However, because the PRE tactics come first in the matrix, in this case specifically you can retrieve those tactics' IDs from the matrix object, and then use that ID to get the tactic objects themselves. Again, that won't really work for other platforms/tactics, but in the case of PRE it works fine.
I'll leave this open so that we can later create a code snippet in the USAGE document for this use case.
