search_threat_intel
Search OpenCTI for threat intelligence across indicators, threat actors, malware, techniques, CVEs, and reports. Filter by labels, dates, confidence, and pagination to refine results.
Instructions
Search OpenCTI for threat intelligence across all entity types (indicators, threat actors, malware, techniques, CVEs, reports).
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"query": "<query>"
},
"name": "search_threat_intel"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max results per entity type (default: 5, max: 20) | |
| query | Yes | Search term (IOC, threat actor name, malware, CVE, etc.) | |
| labels | No | Filter by labels (e.g., ['tlp:amber', 'malicious']) | |
| offset | No | Skip first N results (for pagination, max: 500) | |
| created_after | No | Filter by created date >= (ISO format: 2024-01-01) | |
| confidence_min | No | Minimum confidence threshold (0-100) | |
| created_before | No | Filter by created date <= (ISO format: 2024-12-31) |