Search attack paths

Returns a list of the top attack paths leading to critical assets. The response includes details about each attack path, such as associated techniques, nodes, and metadata. This endpoint enables you to use advanced search capabilities, including filtering, sorting, and pagination.

Note: Attack paths inherit their status from underlying techniques. To prioritize active threats, the system excludes the following statuses by default:

• chain_prevented — The attack chain is partially fixed.
• accepted — The risk is accepted.
• done — Remediation is complete.

To retrieve all paths regardless of status, set the exclude_resolved parameter to false.

For more information, see Top Attack Paths in the Exposure Management User Guide.