Search security detections by keyword across name, description, tags, process names, CVEs, data sources, and more. Uses FTS5 full-text search. Supports Sigma, Splunk ESCU, Elastic, and KQL rules.

Get full details of a specific detection by ID. Returns query logic, logsource (product/category/service), data_sources, process_names, platforms, CVEs, and false_positives. Use this to extract detection conditions for kill-chain correlation.

List detections mapped to a MITRE ATT&CK technique ID. Returns logsource (product/category), data_sources, and process_names per rule — use these to rank candidates before calling get_detection. Rules with non-empty process_names are more artifact-specific than generic ones.

List detections filtered by severity level

Get statistics about indexed detections including counts by source, severity, and MITRE coverage

Get MITRE ATT&CK coverage stats: tactic breakdown, top 10 covered techniques, and weak-spot tactics (coverage < 50% of best tactic). Returns ~2KB. Filter by source_type to scope to a single rule source.

Find detection gaps for a threat profile (ransomware, apt, initial-access, persistence, credential-access, defense-evasion). Returns per-technique rule counts and zero-coverage gap IDs. Use source_type to scope to a specific rule source. Call with no arguments to list available profiles and a coverage overview across all of them.

Get the detection rule count for a single MITRE technique ID (~50 bytes). Use this as a fast pre-check before pulling full detection objects.

Get tactic-level detection counts as a compact object (~200 bytes). Faster and smaller than analyze_coverage. Use for quick orientation before deeper analysis.

Get a deduplicated flat list of MITRE technique IDs covered by detection rules (~200 bytes). No full objects. Filter by source_type, tactic, or severity to narrow scope.

Get the top 5 uncovered (or least-covered) technique IDs for a threat profile (~300 bytes). Returns only IDs — use as a fast triage signal before calling identify_gaps for full detail.

Get detection ideas for a MITRE technique ID as lean stubs (name, source, severity, log hint — no raw query content). ~2KB for up to 10 results. Use to find what rules exist before pulling full content with get_detection.

Convert a CVE into actionable SIEM detection logic. Fetches CVE details from NVD, maps to MITRE ATT&CK techniques, and generates detection queries in KQL (Sentinel), Splunk SPL, and Sigma formats with threat hunting hypotheses, false positive considerations, and response actions.

Convert a YARA rule to an approximate Sigma rule. Best-effort conversion focused on string/hex conditions mapped to process_creation logs (CommandLine). Always include a warning that manual review is required.

Convert Sigma detection rules to Kibana Query Language (KQL) for Elastic Stack (Kibana, Elasticsearch). Uses Elastic Common Schema (ECS) field mappings and simple field:value syntax. Supports modifiers, wildcards, and complex conditions.

Find detection rules that reference a specific process name or executable. Uses the process_names field extracted during indexing.

Find detection rules tagged with a specific CVE identifier across all rule sources.

Filter Sigma detection rules by logsource category, product, or service (e.g., product=windows, category=process_creation, service=sysmon).

Find detection rules that require a specific data source or log type (e.g., Sysmon Events, Process Creation Events, DeviceProcessEvents).

List all detections mapped to a MITRE ATT&CK tactic (e.g., execution, persistence, defense_evasion, credential_access).

Look up details about a MITRE ATT&CK technique by ID (e.g., T1059, T1059.001)

Search MITRE ATT&CK techniques by keyword

Look up a Living Off The Land Binary (LOLBAS) by name for abuse techniques

List all known LOLBAS (Living Off The Land Binaries) with their primary abuse type

Check if a CVE is in CISA Known Exploited Vulnerabilities catalog

Get a summary threat profile for common attack scenarios

Identify the type of an Indicator of Compromise and provide analysis guidance

Look up a URL in URLhaus to check if it distributes malware. Returns payload hashes, imphashes, and malware tags. Generates pivot suggestions for chained analysis.

Find all malicious URLs hosted on an IP address or domain in URLhaus.

Search URLhaus for all malicious URLs associated with a malware tag (e.g. "Emotet", "qakbot", "cobalt-strike").

Search ThreatFox for any IOC type (IP:port, domain, URL, MD5, SHA256). Returns confidence scores and malware family attribution.

Get all IOCs in ThreatFox for a specific malware family (e.g. "Cobalt Strike", "Sliver", "AgentTesla"). Returns C2 IPs, domains, and payload hashes.

Search ThreatFox IOCs by tag (e.g. "c2", "loader", "rat", "ransomware").

Retrieve the ThreatFox recent IOC feed for ambient threat intel sync. Returns all IOCs submitted in the last 1, 7, or 30 days.

Look up a malware sample in MalwareBazaar by SHA256, MD5, or SHA1. Returns imphash, malware family, tags, and vendor detections.

Search MalwareBazaar for all samples belonging to a malware family. Returns hashes, imphashes, and file metadata.

Search MalwareBazaar for malware samples by tag (e.g. "keylogger", "ransomware", "loader").

Retrieve the most recently submitted samples from MalwareBazaar for ambient threat intel sync.

ELITE PIVOT: Find all MalwareBazaar samples sharing the same PE import hash (imphash). Reveals variants compiled from the same codebase — catches threat actors who forget to randomise their builds.

Full OTX enrichment for an IP address. Returns pulse count, reputation, country, ASN, attributed actors, malware families, MITRE techniques, and pivot suggestions.

OTX enrichment for a domain. Returns pulse context, passive DNS history (historical IPs), attributed actors, and malware families.

OTX enrichment for a file hash. Returns malware families, MITRE techniques, actor attribution, and imphash for sibling sample pivoting.

OTX enrichment for a URL. Returns pulse context, attributed actors, malware families, and suggests domain pivot.

ELITE: Search all OTX pulses attributed to a threat actor. Deduplicates IOCs across pulses and returns the actor's full infrastructure — C2 IPs, domains, hashes, MITRE techniques.

Fetch all indicators from a specific OTX pulse ID. Paginates automatically.

Fetch OTX subscribed pulses modified since a given timestamp. Use for scheduled ambient threat intel sync.

Search CISA cybersecurity advisories and alerts for a keyword, CVE, actor, or malware family. Supports filtering by type (advisory / alert / all). Advisories from CISA carry the highest confidence for active exploitation. Cached 1 hour.

Search NCSC UK RSS feed for security advisories matching a keyword, CVE, actor name, or malware family. UK National Cyber Security Centre advisories and guidance. Extracts MITRE techniques, CVEs, and attributed actors. Cached 1 hour.

Search NSA Cybersecurity RSS feed for security advisories matching a keyword, CVE, actor name, or malware family. NSA cybersecurity advisories and technical guidance. Extracts MITRE techniques, CVEs, and attributed actors. Cached 1 hour.

Search FBI / IC3 RSS feed for security advisories matching a keyword, CVE, actor name, or malware family. FBI flash alerts and IC3 public service announcements. Extracts MITRE techniques, CVEs, and attributed actors. Cached 1 hour.

Search CERT-EU RSS feed for security advisories matching a keyword, CVE, actor name, or malware family. CERT-EU threat intelligence publications for EU institutions. Extracts MITRE techniques, CVEs, and attributed actors. Cached 1 hour.

Search ANSSI / CERT-FR RSS feed for security advisories matching a keyword, CVE, actor name, or malware family. French ANSSI (CERT-FR) security alerts and vulnerability advisories. Extracts MITRE techniques, CVEs, and attributed actors. Cached 1 hour.

Search JPCERT/CC RSS feed for security advisories matching a keyword, CVE, actor name, or malware family. JPCERT/CC English-language security alerts and coordination notices. Extracts MITRE techniques, CVEs, and attributed actors. Cached 1 hour.

Search ACSC (ASD) RSS feed for security advisories matching a keyword, CVE, actor name, or malware family. Australian Cyber Security Centre alerts and advisories. Extracts MITRE techniques, CVEs, and attributed actors. Cached 1 hour.

Search CCCS / CCIRC RSS feed for security advisories matching a keyword, CVE, actor name, or malware family. Canadian Centre for Cyber Security alerts and advisories. Extracts MITRE techniques, CVEs, and attributed actors. Cached 1 hour.

ELITE: Search for joint advisories across Five Eyes agencies (CISA + NCSC-UK + ACSC + CCCS) simultaneously. Joint advisories carry the highest confidence of any TTP source — they reflect real-world intelligence shared by multiple national agencies. Results are deduplicated by title.

ELITE CORRELATION: Given a MITRE technique ID, fan out across MITRE ATT&CK, vendor threat intel blogs, and the local detection index. Returns a fused picture: which actors use it, what malware leverages it, recent vendor reports, detection coverage, and telemetry requirements. The definitive first stop for any TTP investigation.

ELITE CORRELATION: Build the most complete threat actor profile available. Fuses MITRE ATT&CK group data, live vendor blog reports, optional OTX IOC pivot, and detection coverage scores across the actor's top 20 techniques. Use this before any hunting engagement against a named threat actor.

ELITE: THE ULTIMATE HUNT TOOL. Given a client context (industry + region + scenario), produce a complete hunt package: relevant threat actors, priority TTPs, detection coverage analysis, coverage gaps, and vendor intelligence — all fused from multi-source data. Output is structured for direct import into a use-case tracker.

Generate a daily threat intelligence brief by scanning recent reports from all 21 vendor and community sources. Automatically extracts MITRE TTPs, CVEs, actors, and malware from each item. Filter by client industries or custom lookback window. Run this daily to stay current on the threat landscape. No Playwright required — all sources are polled directly via RSS.

Get the FIRST EPSS (Exploit Prediction Scoring System) probability score for a CVE. EPSS predicts the probability of exploitation in the wild within 30 days — essential for CVE prioritization beyond raw CVSS scores.

Batch EPSS score lookup for multiple CVEs. Rank CVEs by exploit probability to focus patching effort. Returns sorted list with risk tiers. Ideal for enriching vulnerability scanner output.

Look up a CVE in the NIST National Vulnerability Database (NVD). Returns full record including CVSS v3/v4 scores, affected CPEs, CWE classification, references, and publication dates. Set NVD_API_KEY environment variable for higher rate limits (50 req/30s vs 5).

Search Google Project Zero vulnerability research blog by keyword. Extracts MITRE TTPs, CVEs, and IOC markers automatically.

Search Exploit-DB for recent exploit submissions by keyword or CVE. Extracts MITRE TTPs, CVEs, and IOC markers automatically.

Search Rapid7 vulnerability research and threat intelligence blog. Extracts MITRE TTPs, CVEs, and IOC markers automatically.

Search Qualys security blog for vulnerability analysis and patch intelligence. Extracts MITRE TTPs, CVEs, and IOC markers automatically.

Search Tenable research blog for vulnerability intelligence and CVE analysis. Extracts MITRE TTPs, CVEs, and IOC markers automatically.

Search Zero Day Initiative (ZDI) blog for zero-day vulnerability disclosures. Extracts MITRE TTPs, CVEs, and IOC markers automatically.

Search Google TAG blog for government-backed threat actor and exploit intelligence. Extracts MITRE TTPs, CVEs, and IOC markers automatically.

Search Malpedia for threat actors and malware families. Malpedia is the authoritative reference for malware taxonomy and actor-to-family attribution. Requires MALPEDIA_API_KEY for full access.

Get a full Malpedia threat actor profile: aliases, country attribution, motivation, description, and all malware families attributed to this actor. Authoritative source for actor-to-malware mapping. Requires MALPEDIA_API_KEY.

Get a full Malpedia malware family profile: alternate names, description, attribution to threat actors, and reference URLs. The authoritative source for malware taxonomy and variant tracking. Requires MALPEDIA_API_KEY.

Search the SANS Internet Storm Center (ISC) daily diary feed. ISC handlers post real-time observations of active exploits, scanning campaigns, and novel attack techniques.

Get currently trending malware families from ANY.RUN sandbox telemetry. Shows what malware is most active right now based on analysis submissions. Useful for real-time threat landscape awareness.

Search BleepingComputer for cybersecurity news, ransomware incidents, and threat actor activity. Extracts MITRE TTPs, CVEs, actors, and malware families automatically.

Search Malwarebytes Labs threat intelligence blog for malware analysis and threat research. Extracts MITRE TTPs, CVEs, actors, and malware families automatically.

Search VX-Underground — the largest free malware sample repository. Returns matching papers, write-ups, and malware samples from their public index. Best for technical malware analysis, source code, and underground research.

Check if an IOC (domain, IP, URL) appears in MISP warning lists. MISP warning lists contain known false positives — legitimate infrastructure that commonly triggers threat intel feeds (Alexa top 1M, Microsoft, Google CDN, etc.). Run this BEFORE pivoting on a domain or IP to avoid wasting time on FPs.

Create an entity in the knowledge graph (e.g., technique, actor, tool, detection)

Search knowledge graph entities by name or description

Create a relation between two entities in the knowledge graph

Log an analytical decision with reasoning for tribal knowledge capture

Get recent logged decisions (tribal knowledge)

Add a learning or insight gained during analysis

Get learnings/insights by topic

Get a summary of the knowledge graph contents

Get details about a MITRE ATT&CK threat group (APT) by name or ID. Returns aliases, description, and linked techniques.

Search MITRE ATT&CK threat groups by keyword. Searches name, description, and aliases.

Get details about MITRE ATT&CK software (malware or tools) by name. Includes Cobalt Strike, Mimikatz, etc.

Search MITRE ATT&CK software (malware and tools) by keyword.

Get MITRE ATT&CK mitigations for a specific technique. Answers "How do I mitigate T1059?"

Get required data sources and log types to detect a MITRE technique. Answers "What logs do I need for T1021?"

List MITRE ATT&CK campaigns, optionally filtered by search query.

Find all threat groups that use a specific MITRE technique.

Find all malware and tools that use a specific MITRE technique.

Get statistics about the indexed MITRE ATT&CK data (groups, software, techniques, etc.)

List all MITRE ATT&CK data sources with their data components.

Get all Atomic Red Team adversary simulation tests for a MITRE ATT&CK technique. Returns test names, attack commands, cleanup commands, platforms, executor type, and input arguments. Use to understand the full attack surface for a technique.

Full-text search across all Atomic Red Team tests (~1,770+). Searches test names, descriptions, commands, arguments, file paths, and binary names. Use to find tests by attack tool (e.g., "mimikatz"), binary (e.g., "certutil"), technique pattern (e.g., "registry run key"), or artifact (e.g., "powershell -enc").

Get full details of a specific Atomic Red Team test by its GUID. Returns complete attack command, cleanup command, input arguments with defaults, dependencies, and platform requirements.

Cross-reference Atomic Red Team tests against existing detection rules for a MITRE technique. For each ART test, checks whether any detection rule in the repo matches the attack artifacts. Returns a per-test validation matrix with COVERED/GAP status and an overall coverage percentage. Use this to find blind spots in rules you thought were complete.

Get summary statistics about indexed Atomic Red Team tests: total tests, techniques covered, breakdown by platform and executor type, top techniques by test count, and repository sync status.

Batch validation of detection coverage across multiple MITRE techniques using Atomic Red Team tests. For each technique, checks if ART tests exist and if detection rules are present. Returns an overall coverage matrix, prioritized gaps, and per-technique status. Use for threat actor profile validation or coverage audits.

Static analysis: parse a Sigma rule's detection conditions and cross-reference each one field-by-field against Atomic Red Team test artifacts. Returns a structured match matrix showing which conditions are MATCHED (verified against ART command text), INFERRED (parent process from executor type), UNABLE_TO_VERIFY (registry/network/access mask — ART doesn't record these), or NOT_IN_ART (no test covers this pattern). Also identifies ART tests the rule would miss. Pure string analysis — never executes anything.

Ingest a sample log into a coverage assessment session. Parses the log to extract event source, event ID, and fields, then maps to MITRE ATT&CK data sources and data components. Supports Windows Event XML, Sysmon, JSON (EDR/Cloud), auditd key-value, and CEF formats. You can also provide event_source + event_id + fields directly instead of a raw log. Creates a new session if session_id is not provided.

Run a full MITRE ATT&CK coverage assessment for a session. For each technique in the ATT&CK matrix, determines if it is COVERED (data + rules exist), DETECTABLE (data exists but no rules), PARTIAL (some data sources present), or GAP (no data sources). This is the core engine that answers: what can we detect, what can't we detect, and what logs are missing.

Get detailed gap report for a coverage session. Shows every technique that is GAP or PARTIAL, with exactly which data sources are missing and remediation steps. Filterable by tactic and coverage status.

Compare coverage between two assessment sessions. Shows which techniques improved (GAP→PARTIAL→DETECTABLE→COVERED) and how many gaps were closed. Use to answer: "If I add Sysmon, how much does my coverage improve?"

Pareto-optimal log source recommendations. Analyzes coverage gaps and ranks missing data sources by how many technique gaps they would close. Answers: "Enable these 5 log sources to close 80% of your gaps." Prioritizes by actor usage (techniques used by more actors = higher priority).

List all known telemetry-to-MITRE mappings (Event ID → Data Source/Component). Use to see which event sources/IDs the coverage engine understands. Also shows session statistics.

Generates a formatted Word document (.docx) threat hunt report from structured hunt card data. Saves the file to C:\Users{username}\Desktop\Threat Hunting Reports{Actor}_{Date}.docx. Creates the output folder automatically if it does not exist. Input must include report metadata and an array of hunt cards (one per technique). Each card must contain: hunt_id, hypothesis_name, objective, priority, confidence, mitre_mapping (with group aliases), prerequisites, expected_artifacts, risks, log_sources, coverage_status, query (Sigma YAML), true_positive_criteria, and escalation_path. Returns the full output file path on success.

Search Sublime Security email detection rules by keyword, attack type, MITRE technique, or detection method. Returns matching rules with severity, category, and MITRE mapping. Use to find email-layer detections for phishing, BEC, malware delivery, and credential theft.

Get a specific Sublime Security rule by its ID, including the full MQL (Message Query Language) detection source, MITRE techniques, and metadata. Use after sublime_search to inspect the complete rule logic.

Sync the Sublime Security rules repository (git pull) and re-index all rules into the detection database. Run this to pick up newly published rules. Returns the count of rules indexed and any parse errors.

Get summary statistics about indexed Sublime Security rules: total count, severity breakdown, attack type distribution, top MITRE techniques, and last sync timestamp.

Look up a vulnerable/malicious driver in the LOLDrivers database by name or hash (SHA256). Returns driver details, hashes for blocklisting, CVEs, and detection guidance. Essential for BYOVD (Bring Your Own Vulnerable Driver) detection.

Look up DLL hijacking candidates for a given DLL name or executable. Returns vulnerable executables, hijack type (Phantom/Sideloading/Search Order), and expected DLL locations. Use for T1574.001/T1574.002 detection engineering.

Look up a Remote Monitoring & Management (RMM) tool by name. Returns executable names, network artifacts (domains, ports), registry artifacts, and known abuse by threat actors. Essential for T1219 remote access tool abuse detection.

Look up known false positives for a MITRE ATT&CK technique. Returns process names, command patterns, descriptions, and suppression logic. Use this during detection rule FP filter authoring.

Search Windows/Active Directory offensive commands by keyword, tool name, or technique. Returns exact commands used by attackers for AD exploitation. Use for building detection conditions from real attack commands.

Check if a domain is in the LOTS (Living Off Trusted Sites) database — legitimate services abused for C2, exfiltration, or payload hosting. Use for proxy/firewall rule enrichment and T1102/T1567 detection.

Look up a Windows API by name to see its malware behavior mapping. Returns technique associations, malware families using it, and detection notes. Use for understanding what behaviors an API call indicates.

Search across ALL LOLFarm sources (drivers, DLL hijacks, RMM tools, false positives, AD commands, abused domains, APIs) with a single query. Optional source filter to narrow results.

List all known vulnerable/malicious drivers in the LOLDrivers database. Optional category filter (vulnerable, malicious). Use for BYOVD blocklist generation.

List all known RMM (Remote Monitoring & Management) tools with their executable names and vendors. Use to build RMM allow/deny lists and T1219 detection rules.

List all known DLL hijacking candidates. Optional filter by hijack type (Phantom, Sideloading, Search Order, Environment Variable).

Get LOLFarm intelligence relevant to a MITRE ATT&CK technique. Tiered response: "summary" (default, ~500 tokens — counts + top names per source) for Step 1 recon, "detailed" (~2.5k tokens — top 15 per source with key fields) when authoring, "full" (everything — use sparingly). After summary, use per-source lookup_* tools for deep-dives instead of escalating mode.

Pull fresh data from LOLFarm upstream sources (LOLDrivers, HijackLibs, LOLRMM, LoFP, WADComs, LOTS, MalAPI, LOLBAS) into the local cache. Run weekly via scheduled task — most upstream sources update 1-4x per month. Failures in one source never block the others. Returns per-source counts + errors.