Get Actor Profile
get_actorRetrieve a concise threat-actor profile by name or alias, covering attribution counts, MITRE tactic and technique rollups, IOC category summaries, and relationship insights.
Instructions
Get a lean threat-actor profile by name or alias: actor metadata, attribution counts, attributed-threat summary rows, MITRE tactic rollup + technique ids, IOC category counts (no raw values), CVE/CWE/tool summaries, and relationships. Tactic keys are canonicalised (the corpus writes both "Credential Access" and "credential-access") and the rollup counts DISTINCT TECHNIQUES per tactic; mitre.technique_ids is capped at 60 against mitre.techniques_total. relationships splits into shared_infra / shared_techniques / shared_tooling with the type re-derived from the value, because corr_attribution types tool names as hashes. An empty actor_relationships means UNRECORDED, not unrelated — see actor_relationships_coverage. For heavy detail use the follow-up tools: get_threat(id) for a full threat, search_detections / get_detection_detail for detection bodies, search_iocs for IOC values, get_infrastructure_pivots for shared infrastructure.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Actor name or alias (e.g. 'APT29', 'Lazarus Group') |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| cves | No | ||
| actor | Yes | ||
| mitre | No | ||
| tools | No | ||
| counts | No | ||
| targets | No | ||
| threats | No | ||
| relationships | No | ||
| actor_relationships | No | ||
| actor_relationships_coverage | No | Present only when actor_relationships is empty: says the baseline has no row, not that the actor is unrelated. |