query_atomics
Search and filter Atomic Red Team tests by free text, technique ID, name, or platform to locate specific attack simulations.
Instructions
Search and filter atomic tests across the repository.
This tool searches through all atomic tests and returns matches based on your
criteria. You can search by free-text query, or filter by specific attributes like
technique ID, GUID, or platform. Results are paginated — use the returned
next_cursor to fetch subsequent pages.
Args: query: Free-text search term to match against all atomic test fields including name, description, commands, and input arguments. Supports multi-word queries where all words must match (AND logic). Examples: "powershell registry", "credential access", "T1059"
guid: Filter by exact atomic test GUID (UUID format).
Example: "a8c41029-8d2a-4661-ab83-e5104c1cb667"
Use this when you know the specific test you want to retrieve.
technique_id: Filter by MITRE ATT&CK technique ID. Must follow the format
T#### or T####.### (e.g., T1059, T1059.001).
Example: "T1059.001" for PowerShell technique
Returns all atomic tests associated with this technique.
technique_name: Filter by technique name (case-insensitive partial match).
Example: "Command and Scripting Interpreter"
Useful when you know the technique name but not the ID.
supported_platforms: Filter by platform (case-insensitive partial match).
Valid platforms: windows, linux, macos, office-365, azure-ad,
google-workspace, saas, iaas, containers, iaas:aws, iaas:azure,
iaas:gcp, esxi
Example: "windows", "linux", "macos"
cursor: Opaque pagination cursor returned by a previous call as `next_cursor`.
Omit or pass null to start from the first page.
limit: Maximum number of results to return per page (1–200, default 50).Returns: QueryAtomicsOutput: Structured output containing: - total_results: Total number of matching atomic tests - atomics: List of matching atomic tests for this page - next_cursor: Opaque cursor for the next page, or null if last page - query_metadata: Information about applied filters
Raises: ValueError: If query is empty without any filters ValueError: If query exceeds 1000 characters ValueError: If technique_id format is invalid (must be T#### or T####.###) ValueError: If limit is outside the range 1–200 ValueError: If cursor is malformed
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| guid | No | ||
| limit | No | ||
| query | Yes | ||
| cursor | No | ||
| technique_id | No | ||
| technique_name | No | ||
| supported_platforms | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| atomics | Yes | List of matching atomic tests | |
| next_cursor | No | Opaque cursor to pass as `cursor` on the next call. Null when this is the last page. | |
| total_results | Yes | Total number of atomic tests matching the query | |
| query_metadata | No | Metadata about the query execution (filters applied, etc.) |