List Actors
search_actorsRead-onlyIdempotent
Retrieve a roster of threat actors with aggregate stats like threat count and severity. Filter by tool, sector, or malware to narrow results.
Instructions
List attributed threat actors with aggregate stats (threat_count, severity levels, categories, nation_state). Returns the full roster in one call, or narrow it with the optional tool / malware / sector filters (e.g. tool="Cobalt Strike" → only actors that used it). Use get_actor for a single actor's full profile. Not paginated; the response carries a total count.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tool | No | Only actors with a threat using this tool (e.g. "Cobalt Strike") | |
| sector | No | Only actors with a threat targeting this sector (e.g. "Healthcare") | |
| malware | No | Only actors with a threat deploying this malware family (e.g. "LockBit") |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| total | No | Total matching rows, when the handler reports one. | |
| actors | No | ||
| has_more | No | True when another page may exist. | |
| next_cursor | No | Opaque cursor for the next page, or null when this is the last page or the endpoint ignores offset. |