Search attack techniques

post

https://cloud.tenable.com/api/v1/t1/apa/top-attack-techniques/search

Returns a paginated list of the top attack techniques identified within your organization that match the specified search criteria. This endpoint supports advanced filtering, sorting, and metadata enrichment, including MITRE ATT&CK framework mappings and recommended mitigations.

Note: To prioritize actionable data, this endpoint applies default filters to results:

Excluded Statuses — done, accepted
Excluded States — archive

To retrieve all techniques, including archived or resolved items, set the exclude_resolved parameter to false.

For more information, see Top Attack Techniques in the Exposure Management User Guide.

Requires the Basic [16] user role or the ATTACK_PATH_ANALYSIS.QUERY.SEARCH custom role privilege. See Roles and Permissions.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Query Params

limit

integer

100 to 10000

Defaults to 1000

The number of attack technique records to retrieve. If omitted, the default value is 1000. The minimum value is 100 and the maximum value is 10000.

offset

integer

≥ 0

Defaults to 0

The number of records to skip for offset-based pagination. If omitted, the default value is 0.

sort

string

The property and direction to sort the results by, in the format property:direction. For example: name:asc or priority:desc.

Supported properties for sorting include last_updated_at, priority, mitre_id, name, technique_name, status, state, and vector_ount.

exclude_resolved

boolean

Defaults to true

Excludes resolved attack techniques from the results. When true (default), the system filters out techniques with the following values:

Status — done, accepted
State — archive

Set to false to include all techniques regardless of status or state.

Body Params

Filter conditions for searching attack techniques. Filter operators can include nested conditions and operators to create complex filtering logic.

Defines a single filter condition used to narrow the search results for attack techniques.

property

string

enum

Specifies the property used to filter the results. For example: priority, name, or last_updated_at.

operator

string

enum

Specifies the comparison operator applied to the property filter. For example: eq (equals), ne (not equals), or contains.

value

Defines the specific value or values to match against the property. This can be a single value or an array of values depending on the operator used.

Headers

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

200Returned if the attack technique search results were retrieved successfully.

400Returned if your request specified invalid parameters or if your request was improperly formatted.

401Returned if the API keys specified in your request are invalid.

403Returned if you do not have permission to search attack techniques.

429Returned if you attempt to send too many requests in a specific period of time. For more information, see Rate Limiting.

500Returned if an internal error occurred.