Search CAPEC attack patterns
cwe_search_attack_patternsSearch CAPEC attack patterns by every whitespace-separated text token, recorded CWE or ATT&CK mapping, abstraction, severity, or likelihood. A text token matches at a word start, never inside a word, so search a compound or negated form such as deserialization or untrusted as written. Parent ATT&CK techniques include recorded subtechniques; CWE mappings are exact without hierarchy expansion. Omit filters to browse. Deprecated and Obsolete patterns are excluded by default. Mappings are incomplete and do not validate current ATT&CK coverage. Results order by all tokens in the name or in one recorded alternate term such as MITM, then all in the description, then any other match, then numeric ID; use cwe_get_attack_pattern for complete sections and follow nextCursor for remaining matches.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| cweId | No | Exact recorded CWE mapping, a CWE ID such as CWE-79 or 79 from cwe_search_weaknesses; blank means unset. | |
| limit | No | Maximum page size; capped at 100 and a 24,000-byte response budget with disclosure. | |
| cursor | No | Opaque continuation returned by this tool. | |
| filter | No | All-token case-insensitive filter over the name, recorded alternate terms, and description; each token matches at a word start or camelCase hump (path finds XPath), never inside a word. Blank means unset. | |
| severity | No | Exact source severity; discover with cwe_list_reference topic filter_values. | |
| likelihood | No | Exact source likelihood; discover with cwe_list_reference topic filter_values. | |
| abstraction | No | Exact CAPEC abstraction; blank means unset. | |
| includeInactive | No | Include Deprecated and Obsolete patterns; default false. | |
| attackTechniqueId | No | Recorded Tdddd or Tdddd.ddd mapping from cwe_get_attack_pattern mappings, also accepting bare numeric form; blank means unset. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| cap | No | Effective limit. | |
| error | No | Present when the call failed. Absent on success. | |
| shown | No | Page item count. | |
| notice | No | Empty-result or cap guidance. | |
| results | No | Matching pattern page. | |
| truncated | No | Whether more matches remain. | |
| pagination | No | Local result pagination. | |
| provenance | No | Loaded catalog provenance. | |
| totalCount | No | Matching count before paging. | |
| appliedFilters | No | Applied filters and defaults. |