Search Threats
search_threatsRead-onlyIdempotent
Search and filter the threat catalog by free-text terms, CVE, actor, product, severity, and more, returning concise summary rows for quick triage.
Instructions
The deterministic threat-catalog query tool. Returns LEAN summary rows {id, title, severity, category, status, threat_actor, nation_state, affected_products, cves, cvss_score, summary, created} — call get_threat for full detail on a specific id. Combine a free-text query with any structured filters; ALL filters AND-combine and apply together (e.g. query="supply chain" + threat_actor="TeamPCP" + category="SUPPLY_CHAIN" returns only matching rows, with affected_products inline). Paginated: limit (default 20, max 100) + offset/cursor; result carries total, has_more, and next_cursor.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Filter to threats affecting an operating system (e.g. "Windows", "Linux", "VMware ESXi") | |
| cve | No | Filter by CVE id (e.g. CVE-2026-45321) | |
| tag | No | Filter by exact tag (e.g. "supply-chain-compromise") | |
| tool | No | Filter to threats using a tool (e.g. "Cobalt Strike", "Mimikatz") | |
| limit | No | Max results (default 20, max 100) | |
| query | No | Free-text term across title/summary/description/CVE/actor (optional; AND-combined with filters) | |
| cursor | No | Opaque pagination cursor (next_cursor from a prior result); ignored when offset is given. | |
| offset | No | Row offset for pagination (default 0). | |
| sector | No | Filter by grounded industry sector (e.g. "Healthcare", "Government") | |
| status | No | Threat status filter (e.g. active) | |
| malware | No | Filter to threats deploying a malware family (e.g. "LockBit", "Vidar") | |
| campaign | No | Filter to threats in a named campaign/operation (e.g. "Snowflake campaign") | |
| category | No | e.g. SUPPLY_CHAIN, MALWARE, RANSOMWARE, VULNERABILITY, APT, PHISHING, ZERO_DAY (call list_threat_categories for the full vocabulary) | |
| severity | No | critical | high | medium | low | |
| motivation | No | Filter by motivation (e.g. financial, espionage) | |
| nation_state | No | Filter by nation-state (e.g. Russia, China, Iran) | |
| threat_actor | No | Filter by attributed actor name/alias (e.g. "TeamPCP", "APT29") | |
| created_after | No | ISO date — only threats created on/after (e.g. 2026-05-01) | |
| target_region | No | Filter by targeted region (e.g. APAC, Europe) | |
| target_sector | No | Filter by targeted sector (e.g. Healthcare, Finance) | |
| created_before | No | ISO date — only threats created on/before | |
| mitre_technique | No | Filter by MITRE technique id (e.g. T1059) | |
| affected_product | No | Filter by affected product/vendor (e.g. "npm", "Microsoft", "VS Code") |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | Yes | ||
| total | No | Total matching rows, when the handler reports one. | |
| has_more | No | True when another page may exist. | |
| next_cursor | No | Opaque cursor for the next page, or null when this is the last page or the endpoint ignores offset. |