id

string

Technique identifier.

name

string

Technique name.

url

string

Web page at https://attack.mitre.org with the technique description and other relevant information.

rules

object/null

List of triggered rules.

malicious

string[]

List of rules that have been triggered due to malicious activity of the sample.

neutral

string[]

List of rules that have been triggered due to neutral activity of the sample.

suspicious

string[]

List of rules that have been triggered due to suspicious activity of the sample.

subtechniques

array [Subtechnique]

List of sub-techniques.