search_techniques
Search MITRE ATT&CK techniques by keyword in their name or description. Returns matching techniques with IDs and optional descriptions for enterprise, mobile, or ICS domains.
Instructions
Search MITRE ATT&CK techniques by keyword in their name or description.
This tool performs a case-insensitive search over all non-revoked,
non-deprecated techniques in the given domain. A technique is matched if
the query string appears in either:
• the technique name, or
• the technique description
Examples:
- search_techniques("PowerShell")
- search_techniques("credential dumping")
- search_techniques("initial access", domain="enterprise")
Args:
query: Text to search for in technique names and descriptions.
domain: ATT&CK domain ("enterprise", "mobile", or "ics").
include_description: Whether to include descriptions in the structured
result and formatted output.
Returns:
{
"count": <number of matches>,
"techniques": [
{
"attack_id": "<TXXXX or TXXXX.YYY>",
"name": "<technique name>",
"stix_id": "<attack-pattern--...>",
"description": "<description or null>",
},
...
],
"formatted": "<human-readable formatted list>",
"message": "<status summary>"
}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | ||
| domain | No | enterprise | |
| include_description | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |