get_mentioned_threat_actors
Monitor recent threat actor activities mentioned in threat intelligence sources to track emerging threats, identify active actors, and build situational awareness of the current threat landscape.
Instructions
Get mentioned threat actors
Use this tool when you need to monitor recent threat actor activities mentioned in threat intelligence sources. This is especially valuable for:
Tracking emerging threats and active threat actors
Monitoring the latest threat intelligence reporting
Identifying which threat actors are currently active or trending
Building situational awareness of the current threat landscape
Obtaining recent summaries of threat actor tactics and campaigns
Unlike list_threat_actors() which returns basic threat actor records, this function returns actual mentions with context from recent intelligence sources.
Args: offset (int, optional): The number of items to skip before starting to collect the result set. Defaults to 0. limit (int, optional): The maximum number of items to return. Minimum value is 1. Defaults to 10. sort (str, optional): Field to sort by - either 'name', 'created_at', or 'updated_at'. Defaults to 'created_at'. order (str, optional): Sort order - either 'asc' or 'desc'. Defaults to 'desc'.
Returns: Dict[str, Any]: Dictionary containing: - total: Total number of threat actor mentions available - offset: Current pagination offset - limit: Number of items returned per page - message: Status message (usually null when successful) - data: List of recent threat actor mentions, each containing: - uuid: Unique identifier for this mention - overview: Summary of the threat actor's recent activities or campaigns - created_at: Timestamp when this mention was first added to the system - updated_at: Timestamp when this mention was last updated - published_at: Original publication date of the source material - collected_at: When this intelligence was collected - reference_url: URL of the source article or report - reference_source: Name of the intelligence source (e.g., "securityaffairs") - reference_user_generated_content: Whether this is from user-generated content - threat_actor_uuid: UUID of the referenced threat actor - threat_actor_name: Name of the referenced threat actor
This function provides timely intelligence about threat actors from recently published sources, making it ideal for staying current on the threat landscape.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| offset | No | ||
| limit | No | ||
| sort | No | created_at | |
| order | No | desc |
Implementation Reference
- The handler function decorated with @mcp.tool() for the get_mentioned_threat_actors tool. It accepts pagination and sorting parameters and delegates to the malloryai_client to fetch mentioned threat actors, including detailed docstring for schema.
@mcp.tool() @handle_api_errors async def get_mentioned_threat_actors( offset: int = 0, limit: int = 10, sort: str = "created_at", order: str = "desc", ) -> Dict[str, Any]: """Get mentioned threat actors Use this tool when you need to monitor recent threat actor activities mentioned in threat intelligence sources. This is especially valuable for: - Tracking emerging threats and active threat actors - Monitoring the latest threat intelligence reporting - Identifying which threat actors are currently active or trending - Building situational awareness of the current threat landscape - Obtaining recent summaries of threat actor tactics and campaigns Unlike list_threat_actors() which returns basic threat actor records, this function returns actual mentions with context from recent intelligence sources. Args: offset (int, optional): The number of items to skip before starting to collect the result set. Defaults to 0. limit (int, optional): The maximum number of items to return. Minimum value is 1. Defaults to 10. sort (str, optional): Field to sort by - either 'name', 'created_at', or 'updated_at'. Defaults to 'created_at'. order (str, optional): Sort order - either 'asc' or 'desc'. Defaults to 'desc'. Returns: Dict[str, Any]: Dictionary containing: - total: Total number of threat actor mentions available - offset: Current pagination offset - limit: Number of items returned per page - message: Status message (usually null when successful) - data: List of recent threat actor mentions, each containing: - uuid: Unique identifier for this mention - overview: Summary of the threat actor's recent activities or campaigns - created_at: Timestamp when this mention was first added to the system - updated_at: Timestamp when this mention was last updated - published_at: Original publication date of the source material - collected_at: When this intelligence was collected - reference_url: URL of the source article or report - reference_source: Name of the intelligence source (e.g., "securityaffairs") - reference_user_generated_content: Whether this is from user-generated content - threat_actor_uuid: UUID of the referenced threat actor - threat_actor_name: Name of the referenced threat actor This function provides timely intelligence about threat actors from recently published sources, making it ideal for staying current on the threat landscape. """ return await malloryai_client.threat_actors.list_threat_actors_mentioned( offset=offset, limit=limit, sort=sort, order=order )