Pentest Lookup Group
pentest_lookup_groupRead-onlyIdempotent
Look up a MITRE ATT&CK threat group or software entry by ID, name, or keyword. Results include ATT&CK identity, aliases, type, description, and associated techniques with procedure-level context from public ATT&CK reporting.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"query": "<query>"
},
"name": "pentest_lookup_group"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | ATT&CK threat group ID (e.g., "G0007"), software ID (e.g., "S0002"), or name/keyword (e.g., "APT28", "Mimikatz", "Lazarus Group"). ID lookup is exact and case-insensitive; name/keyword search returns the best match. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| id | No | ATT&CK ID (e.g., "G0007" for a group, "S0002" for software). | |
| name | No | Primary display name (e.g., "APT28", "Mimikatz"). | |
| type | No | "group" for intrusion sets (threat actors), "software" for malware and tools. | |
| error | No | Present when the call failed. Absent on success. | |
| aliases | No | Known alternate names from ATT&CK. | |
| description | No | ATT&CK description (truncated to 800 characters). | |
| attack_version | No | ATT&CK dataset version used (e.g., "Enterprise v19.1"). | |
| techniques_used | No | Up to 20 techniques associated with the group or software, including procedure-level context and technique IDs. | |
| authorized_use_reminder | No | Reminder that threat group data is for authorized testing and research only. Rendered first. |