ti_get_item
Read-onlyIdempotent
Retrieve a threat-intelligence record by collection and ID to inspect indicators, malware, leaks, or actors. Use IDs from collection or update results; a 404 can mean no by-ID endpoint, not deletion.
Instructions
Fetch one record by id: GET /api/v2/{collection}/{id}. Ids come from ti_get_collection or ti_get_updates results. Not every collection supports it — a 404 here does not mean the record is gone, only that this collection has no by-id endpoint.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Record id from a collection or search result. | |
| collection | Yes | Collection name without an endpoint suffix, e.g. "ioc/common" or "compromised/account_group". Known: apt/threat, apt/threat_actor, attacks/ddos, attacks/deface, attacks/phishing_group, attacks/phishing_kit, compromised/access, compromised/account_group, compromised/bank_card_group, compromised/breached, compromised/discord, compromised/masked_card, compromised/messenger, compromised/mule, compromised/reaper, compromised/suspicious_payment, hi/open_threats, hi/threat, hi/threat_actor, ioc/common, malware/cnc, malware/config, malware/malware, malware/phishing_kit, malware/signature, malware/yara, osi/git_repository, osi/public_leak, osi/vulnerability, suspicious_ip/open_proxy, suspicious_ip/scanner, suspicious_ip/socks_proxy, suspicious_ip/tor_node, suspicious_ip/vpn. Unknown names are passed through as-is; ti_list_collections shows what this account may actually read, ti_describe_collections what each one contains. |