ti_global_search
Search all threat-intelligence collections for an indicator to identify which collections contain it and how many records match, then retrieve details from the relevant collection.
Instructions
Global search across every collection: GET /api/v2/search?q=... Answers which collections hold the indicator and how many records each has (apiPath, label, link, count). Start here when you have an indicator but not a collection, then pull the detail with ti_get_collection using the same query. Accepts free text ("8.8.8.8") or attribute:value ("email:example@gmail.com"). An entry with error was NOT searched (the collection failed or is not granted), which is not the same as no match. If this tool itself fails, search the likely collections one by one with ti_get_collection instead.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Indicator to look for, optionally as attribute:value. |