search_threat_intel
Search OpenCTI for threat intelligence across indicators, threat actors, malware, techniques, CVEs, and reports. Filter by labels, dates, confidence, and pagination to refine results.
Instructions
Search OpenCTI for threat intelligence across all entity types (indicators, threat actors, malware, techniques, CVEs, reports).
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max results per entity type (default: 5, max: 20) | |
| query | Yes | Search term (IOC, threat actor name, malware, CVE, etc.) | |
| labels | No | Filter by labels (e.g., ['tlp:amber', 'malicious']) | |
| offset | No | Skip first N results (for pagination, max: 500) | |
| created_after | No | Filter by created date >= (ISO format: 2024-01-01) | |
| confidence_min | No | Minimum confidence threshold (0-100) | |
| created_before | No | Filter by created date <= (ISO format: 2024-12-31) |