Bug Report
Description:
When calling get_techniques(include_subtechniques=True) and filtering by external ID T1548.002,
the technique is not returned despite being present in the official MITRE ATT&CK database.
Steps to Reproduce:
from attackcti import attack_client
c = attack_client()
all_tech = c.get_techniques(include_subtechniques=True)
found = [t for t in all_tech if any(
r.get('external_id') == 'T1548.002'
for r in t.get('external_references', [])
)]
print(f'Found: {len(found)}') # Returns 0
Expected Behavior:
T1548.002 should be returned as it exists on the official MITRE ATT&CK site:
https://attack.mitre.org/techniques/T1548/002/
Environment:
- attackcti version: 0.6.4
- Python version: 3.14
- Last Modified on MITRE site: April 15, 2026
Additional Context:
Discovered while building an automated detection pipeline that cross-references
Sysmon telemetry with MITRE ATT&CK and D3FEND. The technique was identified by
AI triage but could not be enriched due to this lookup gap.
Observed behavior in context:
- MITRE ATT&CK official site: T1548.002 exists, last modified April 15, 2026
- AI triage (Gemini): correctly identified T1548.002 from Sysmon telemetry
- D3FEND API: returned 35 countermeasures for T1548
- attackcti get_techniques(): returns 0 results for T1548.002
This suggests the library may not be pulling the most recent ATT&CK content,
or T1548.002 may be missing from the STIX/TAXII data that attackcti queries.

Bug Report
Description:
When calling
get_techniques(include_subtechniques=True)and filtering by external IDT1548.002,the technique is not returned despite being present in the official MITRE ATT&CK database.
Steps to Reproduce:
Expected Behavior:
T1548.002 should be returned as it exists on the official MITRE ATT&CK site:
https://attack.mitre.org/techniques/T1548/002/
Environment:
Additional Context:
Discovered while building an automated detection pipeline that cross-references
Sysmon telemetry with MITRE ATT&CK and D3FEND. The technique was identified by
AI triage but could not be enriched due to this lookup gap.
Observed behavior in context:
This suggests the library may not be pulling the most recent ATT&CK content,
or T1548.002 may be missing from the STIX/TAXII data that attackcti queries.