search_threat_actors
Identify threat actor groups by searching the Google Threat Intelligence platform for security investigations and threat analysis.
Instructions
Search threat actors in the Google Threat Intelligence platform.
Threat actors are modeled as collections. Once you get collections from this tool, you can use get_collection_report to fetch the full reports and their relationships.
You can use order_by to sort the results by: "relevance", "creation_date". You can use the sign "+" to make it order ascending, or "-" to make it descending. By default is "relevance-"
Args: query (required): Search query to find threats. limit: Limit the number of threats to retrieve. 10 by default. order_by: Order results by the given order key. "relevance-" by default.
Returns: List of collections, aka threats.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"query": "<query>"
},
"name": "search_threat_actors"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | Yes | ||
| order_by | No | relevance- |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |