generate_atomic
Generate a validated atomic test for a MITRE ATT&CK technique using AI assistance, with automatic error fixing.
Instructions
Generate an atomic test for a MITRE ATT&CK technique using AI assistance.
Uses the MCP client's LLM to draft an atomic test YAML for the given technique and platform, then validates it automatically. If the generated test has errors or warnings, re-samples up to 3 times to fix them before returning.
Args: technique_id: MITRE ATT&CK technique ID (e.g., "T1059.001"). Used to focus the generated test on the correct technique.
platform: Target platform for the test. Valid values: windows, linux, macos.
Defaults to "linux".
description: Optional free-text description of what the test should do or
demonstrate. Leave blank to let the AI determine the best approach
for the technique.Returns: GenerateAtomicOutput: Result containing: - valid (bool): Whether the final test passes schema validation - message (str): Success or error message - atomic_name (str): Name of the generated test (if valid) - supported_platforms (list): Platforms declared in the test (if valid) - yaml (str): Generated YAML content (if valid) - warnings (list): Best-practice warnings to address (if any) - error (str): Validation error details (if invalid)
Notes:
- Requires the MCP client to support server-side sampling
- If the client doesn't support sampling, returns an error
- The generated YAML is validated but NOT saved automatically
- Use server_info to find where to save validated tests
- Always review generated tests before use in production environments
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| platform | No | linux | |
| description | No | ||
| technique_id | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| yaml | No | Generated YAML content (only if valid) | |
| error | No | Detailed error message (only if invalid) | |
| valid | Yes | Whether the generated test passed structural validation | |
| message | Yes | Human-readable validation message | |
| warnings | No | List of best practice warnings that should be addressed | |
| atomic_name | No | Name of the generated test (only if valid) | |
| supported_platforms | No | Platforms the test supports (only if valid) |