Use NRDAX from Python and the command line

Search, retrieve, cite, export and analyse the NRDAX attack-technique registry from scripts or the terminal.

The nrdax library and CLI are for people who want to query, cite, export, analyse or integrate NRDAX data. The website stays the main way to browse the registry; this is the same data, in your terminal and your code.

install

Install from PyPI

pip install nrdax

Latest release: v0.2.0 on PyPI. Code only; fetch the dataset with nrdax update.

Or install the latest version straight from source:

Install from source

pip install git+https://github.com/NullRabbitLabs/nrdax-python.git

Requires Python 3.10 - 3.13. No dataset ships inside the package: run nrdax update once to fetch the registry into a local cache, and subsequent commands then work offline against that snapshot.

quick start

bash

nrdax update
nrdax search "rpc resource exhaustion"
nrdax get NRDAX-T0006
nrdax related NRDAX-T0006
nrdax cite NRDAX-T0006 --format bibtex

update - refresh the local cache from the live NRDAX source.
search - full-text search the registry for a mechanism.
get - print one technique's canonical record by its NRDAX-Tnnnn id.
related - list the techniques related to one (same family).
cite - emit a citation for a technique (here, BibTeX).

This is not the full reference. See the CLI documentation ↗ for every command and option.

common research workflows

Find an existing technique

Search the registry by mechanism, not by exact name.

bash

nrdax search "unauthenticated rpc worker exhaustion"

Retrieve a canonical record

Print one technique by its permanent NRDAX-Tnnnn id.

bash

nrdax get NRDAX-T0006

Find related techniques

List the techniques the registry relates to one (its family).

bash

nrdax related NRDAX-T0006

Export a research subset

Filter to a chain and write the selection to a file for a paper or notebook.

bash

nrdax export --chain solana --format json --output solana-attacks.json

Generate a citation

Produce a ready-to-paste citation in BibTeX (or text, markdown, or CSL-JSON).

bash

nrdax cite NRDAX-T0006 --format bibtex

Use NRDAX from Python

The same registry as a library - load it, get a technique, search.

python

from nrdax import NRDAX

registry = NRDAX.load()
technique = registry.get("NRDAX-T0006")
results = registry.search("rpc exhaustion")

Full API in the Python API documentation ↗.

supported outputs

Every command that returns data can emit it in the format your workflow needs:

Terminal - readable tables, the default for interactive use.
JSON - the registry's structured shape, for scripts and pipelines.
CSV - flattened rows (techniques or instances), for spreadsheets and notebooks.
STIX 2.1 - attack-pattern objects, byte-compatible with the canonical NRDAX emitter.

That makes NRDAX usable in research scripts, notebooks, papers and reports, threat-intelligence workflows, knowledge graphs, security tooling, and automated systems - wherever you already work.

reproducible & offline research

No dataset is bundled in the package - you fetch it explicitly and pin it. nrdax update pulls the registry into a local cache; from then on commands run offline against that snapshot. The dataset, schema, and package versions are tracked distinctly, so you can record and inspect exactly which dataset version a result came from.

bash

nrdax update    # fetch the registry into a local cache
nrdax info      # dataset version, source, and counts
nrdax changes   # what changed since your snapshot

open source

nrdax is Apache-2.0 licensed and developed in the open. Useful contributions - workflow examples, notebooks, integrations, bug reports, and documentation improvements - are welcome.