Mallory MCP Server

Get mentioned threat actors

Use this tool when you need to monitor recent threat actor activities mentioned in threat intelligence sources. This is especially valuable for:

• Tracking emerging threats and active threat actors
• Monitoring the latest threat intelligence reporting
• Identifying which threat actors are currently active or trending
• Building situational awareness of the current threat landscape
• Obtaining recent summaries of threat actor tactics and campaigns

Unlike list_threat_actors() which returns basic threat actor records, this function returns actual mentions with context from recent intelligence sources.

Args: offset (int, optional): The number of items to skip before starting to collect the result set. Defaults to 0. limit (int, optional): The maximum number of items to return. Minimum value is 1. Defaults to 10. sort (str, optional): Field to sort by - either 'name', 'created_at', or 'updated_at'. Defaults to 'created_at'. order (str, optional): Sort order - either 'asc' or 'desc'. Defaults to 'desc'.

Returns: Dict[str, Any]: Dictionary containing: - total: Total number of threat actor mentions available - offset: Current pagination offset - limit: Number of items returned per page - message: Status message (usually null when successful) - data: List of recent threat actor mentions, each containing: - uuid: Unique identifier for this mention - overview: Summary of the threat actor's recent activities or campaigns - created_at: Timestamp when this mention was first added to the system - updated_at: Timestamp when this mention was last updated - published_at: Original publication date of the source material - collected_at: When this intelligence was collected - reference_url: URL of the source article or report - reference_source: Name of the intelligence source (e.g., "securityaffairs") - reference_user_generated_content: Whether this is from user-generated content - threat_actor_uuid: UUID of the referenced threat actor - threat_actor_name: Name of the referenced threat actor

This function provides timely intelligence about threat actors from recently published sources, making it ideal for staying current on the threat landscape.