search_malware
Identify malware families by name or alias, with optional filters for labels, confidence, and date to retrieve targeted threat intelligence from OpenCTI.
Instructions
Search for malware families by name or alias.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"query": "<query>"
},
"name": "search_malware"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max results (default: 10, max: 50) | |
| query | Yes | Malware name or alias (e.g., 'Cobalt Strike', 'Emotet') | |
| labels | No | Filter by labels | |
| offset | No | Skip first N results (for pagination) | |
| created_after | No | Filter by created date >= (ISO format) | |
| confidence_min | No | Minimum confidence (0-100) | |
| created_before | No | Filter by created date <= (ISO format) |