search_threat_actors
Searches for threat actor information.
How to use it
search_threat_actors is exposed by the Opencti MCP MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the search_threat_actors tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.
Install Opencti MCP
npx -y @smithery/cli install opencti-server --client claudeOther tools in Opencti MCP (15)
Retrieves campaign information by name.
Retrieves file information by ID.
Retrieves the most recent threat intelligence reports.
Retrieves a specific report by its ID.
Retrieves user information by ID.
Lists all attack patterns in the system.
Lists all system connectors.
Lists all files in the system.
Lists all groups with their members.
Lists all available labels.
Lists all marking definitions.
Lists all status templates.
Lists all users in the system.
Searches for indicators of compromise.
Searches for malware information in the OpenCTI database.