search_threat_actor
Identify threat actors and APT groups by querying name or alias; apply filters like confidence, date, and labels to refine results.
Instructions
Search for threat actors and APT groups by name or alias.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"query": "<query>"
},
"name": "search_threat_actor"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max results (default: 10, max: 50) | |
| query | Yes | Threat actor name or alias (e.g., 'APT29', 'Lazarus') | |
| labels | No | Filter by labels | |
| offset | No | Skip first N results (for pagination) | |
| created_after | No | Filter by created date >= (ISO format) | |
| confidence_min | No | Minimum confidence (0-100) | |
| created_before | No | Filter by created date <= (ISO format) |