get_collection_timeline_events
Retrieve curated timeline events from threat intelligence collections for campaigns and threat actors, grouped by event category.
Instructions
Retrieves timeline events from the given collection, when available.
This is super valuable curated information produced by security analysits at Google Threat Intelligence.
We should fetch this information for campaigns and threat actors always.
It's common to display the events grouped by the "event_category" field.
Args: id (required): Collection identifier Return: List of events related to the given collection.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| api_key | No |
Implementation Reference
- gti_mcp/tools/collections.py:384-406 (handler)Handler function that retrieves timeline events for a collection by calling the /collections/{id}/timeline/events API endpoint. Returns a sanitized list of events on success, or an error dict on non-200 response.
@server.tool() async def get_collection_timeline_events(id: str, ctx: Context, api_key: str = None): """Retrieves timeline events from the given collection, when available. This is super valuable curated information produced by security analysits at Google Threat Intelligence. We should fetch this information for campaigns and threat actors always. It's common to display the events grouped by the "event_category" field. Args: id (required): Collection identifier Return: List of events related to the given collection. """ async with vt_client(ctx, api_key=api_key) as client: resp = await client.get_async(f"/collections/{id}/timeline/events") if resp.status != 200: error_json = await resp.json_async() error_info = error_json.get("error", {}) return [{"error": f"API Error: {error_info.get('message', 'Unknown error')}"}] data = await resp.json_async() return utils.sanitize_response(data.get("data", [])) - gti_mcp/tools/collections.py:384-384 (registration)Tool is registered via the @server.tool() decorator, which binds it to the FastMCP server instance from gti_mcp/server.py. The tools module is imported via 'from gti_mcp.tools import *' in server.py:73
@server.tool() - gti_mcp/utils.py:119-138 (helper)Helper utility used to remove empty dicts/lists from the response data before returning to the caller.
def sanitize_response(data: typing.Any) -> typing.Any: """Removes empty dictionaries and lists recursively from a response.""" if isinstance(data, dict): sanitized_dict = {} for key, value in data.items(): sanitized_value = sanitize_response(value) if sanitized_value is not None: sanitized_dict[key] = sanitized_value return sanitized_dict elif isinstance(data, list): sanitized_list = [] for item in data: sanitized_item = sanitize_response(item) if sanitized_item is not None: sanitized_list.append(sanitized_item) return sanitized_list elif isinstance(data, str): return data if data else None else: return data - gti_mcp/server.py:72-74 (registration)The server imports all tools (including collections.py) from gti_mcp.tools, which registers all @server.tool() decorated functions.
# Load tools. from gti_mcp.tools import *