Pentest Lookup Technique
pentest_lookup_techniqueRead-onlyIdempotent
Look up a MITRE ATT&CK technique by exact ID or keyword. Results include tactics, platforms, description, detection data, public procedure examples, mitigations, related sub-techniques, and dataset version.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | ATT&CK technique ID (e.g., "T1190", "T1059.001") or keyword describing the technique (e.g., "sql injection", "pass the hash", "web shell upload"). ID lookup is exact; keyword lookup returns the best match plus related techniques. | |
| include_subtechniques | No | Include sub-techniques in the result. Set to false when only the parent technique summary is needed. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Technique name. | |
| error | No | Present when the call failed. Absent on success. | |
| tactics | No | ATT&CK tactics this technique belongs to (e.g., "Initial Access", "Execution"). | |
| detection | No | ATT&CK detection context for the technique. | |
| platforms | No | Target platforms (e.g., "Windows", "Linux", "Web Application"). | |
| description | No | ATT&CK description of the technique. | |
| mitigations | No | Recommended mitigations from ATT&CK. | |
| technique_id | No | ATT&CK technique ID (e.g., "T1190"). | |
| attack_version | No | ATT&CK dataset version used (e.g., "Enterprise v19.1"). | |
| sub_techniques | No | Sub-techniques of this parent technique. Empty when querying a sub-technique itself, or when include_subtechniques is false. | |
| procedure_examples | No | Real-world usage examples from ATT&CK public reporting. | |
| authorized_use_reminder | No | Reminder that technique data is for authorized testing and research only. Rendered first. |