List Actors
search_actorsFind threat actors by filtering on tool, malware, or sector and review aggregate stats, severity, categories, and nation-state details. Use for attribution and triage.
Instructions
List attributed threat actors with aggregate stats (threat_count, severity levels, categories, nation_state). Returns the full roster in one call, or narrow it with the optional tool / malware / sector filters (e.g. tool="Cobalt Strike" → only actors that used it). Use get_actor for a single actor's full profile. Not paginated; the response carries a total count. Names are REPAIRED before they are returned: the corpus stores threat_actor as free text and comma-split it, so prose fragments and truncated parentheticals used to appear as adversaries — label_hygiene reports what was dropped and repaired. Two per-row flags matter: role: "co-mention" means the corpus never files a threat under that name as its primary attribution, and also_grounded_as means the corpus also records the name as a malware family or tool (e.g. SNOWLIGHT). Check both before reporting a row as an operator.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tool | No | Only actors with a threat using this tool (e.g. "Cobalt Strike") | |
| sector | No | Only actors with a threat targeting this sector (e.g. "Healthcare") | |
| malware | No | Only actors with a threat deploying this malware family (e.g. "LockBit") |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| total | No | Total matching rows, when the handler reports one. | |
| actors | No | ||
| has_more | No | True when another page may exist. | |
| next_cursor | No | Opaque cursor for the next page, or null when this is the last page or the endpoint ignores offset. | |
| label_hygiene | No |