ti_describe_collections
Describes available threat-intelligence collections, queryable fields, limits, and filtering rules so you can choose the right collection and build accurate queries before retrieval.
Instructions
Reference data from the API guides, answered locally with no API call and no rate-limit cost: for each collection its category, availability (общая vs индивидуальная), TTL, Admiralty code, severity, max records per request, which iteration methods it supports, whether apply_hunting_rules applies, and its response fields — which are also the attributes usable as q=field:value. Call this before ti_get_collection to pick the right collection and filter.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| category | No | Optional: only collections in this category. | |
| collection | No | Optional: describe just this one. | |
| include_fields | No | Include the response-field lists. Default true for a single collection, false for a listing. |