Get Threat
get_threatGet a single threat's full dossier by ID—overview, attribution, MITRE techniques, IOCs, detection roster, timeline, targets, and tags—with optional section filtering to control response size.
Instructions
Get the detail for a single threat by its ID (e.g. TL-2026-0042): overview, attribution, MITRE techniques, IOCs, the detection roster, timeline, targets and tags. RETRIEVABLE IN PARTS — pass sections to choose what comes back; the response echoes _sections telling you what was returned and what was omitted. By default detection RULE BODIES (SPL/KQL/Sigma) are omitted — they are ~40% of a heavy dossier and have dedicated tools (export_detection / get_detection_detail) — and description is trimmed to 1500 chars with description_chars disclosing the true length. Pass sections="all" and max_description=-1 for the complete record. For malware families, tools, sectors/regions, OS and campaigns, call get_threat_enrichment.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Threat ID (e.g. TL-2026-0042) | |
| sections | No | CSV of sections to return. Any of: overview, attribution, mitre, iocs, detections (WITH rule bodies), detections_meta (roster only, the default), timeline, tags, targets, remediation, references (full bibliography), references_compact (ranked primary-first + corroboration summary, in the default), similar, updates, osint, flow, entities — or "all", or "row" (exclusive: a ~500-byte identity row plus section counts). Default: overview,attribution,mitre,iocs,detections_meta,timeline,tags,targets,similar,flow,osint,references_compact | |
| max_description | No | Char budget for the narrative description. Default 1500; 0 drops it; -1 returns it whole. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Threat ID (TL-YYYY-NNNN). | |
| iocs | No | ||
| tags | No | ||
| osint | No | Community-OSINT summary; null below Red tier or when unscanned. | |
| title | No | ||
| status | No | ||
| summary | No | ||
| category | No | ||
| severity | No | ||
| _sections | No | ||
| created_at | No | ||
| detections | No | ||
| references | No | Full bibliography. Present only under sections=references or sections=all. | |
| updated_at | No | ||
| attribution | No | ||
| description | No | ||
| identifiers | No | ||
| mitre_attack | No | ||
| description_chars | No | True length of description when it was trimmed to max_description. | |
| references_compact | No | Ranked primary-first, capped at 8. Present in the DEFAULT projection and in both bundles. | |
| references_summary | No | ||
| description_truncated | No |