Skip to main content
Retrieve basic actor information from the Actors Hub catalog. Full profiles are available via the Get Actor Profile action. Note: Maximum 1 request per second is allowed.

​
Parameters

ParameterDescription
Active SourcesA comma-separated list of active sources to filter by.

Note: To obtain an up-to-date list of active sources, run an empty List Threat Actors action.
MITREA comma-separated list of MITRE IDs to filter by.
MotivationsThe motivations to filter by.
OffsetThe offset to start returning results from.
OriginsThe origins to filter by.
QueryThe query used on actor properties to filter results by handles, summary, contacts and more.

Note: If not provided, the request returns results according to the Actor Hub UI behavior, ranked by best match.
SizeThe maximum number of results to return.

Note: Maximum 1000 results are allowed.
Sort ByThe field to sort the results by.
Sort OrderThe order to sort the results by.
StatusesThe statuses to filter by.
Targeted GeographiesThe targeted geographies to filter by.
Targeted SectorsThe targeted sectors to filter by.
TypesThe types to filter by.

​
Example Output

{
	"totalUnfilteredCount": "Number",
	"total": "Number",
	"results": [
		{
			"threat_actor_id": "String",
			"summary": {
				"value": "String"
			},
			"current_name": {
				"value": "String"
			},
			"current_profile_picture_src": {
				"value": "String (URL)"
			},
			"is_aggregated": "Boolean",
			"handles": [
				{
					"value": "String"
				}
			],
			"motivation": [
				{
					"value": "String"
				}
			],
			"origin": [
				{
					"value": "String"
				}
			],
			"status": [
				{
					"value": "String"
				}
			],
			"type": [
				{
					"value": "String"
				}
			],
			"targeted_geographies": [
				{
					"value": "String"
				}
			],
			"targeted_sectors": [
				{
					"value": "String"
				}
			],
			"highlights": {},
			"active_sources": [
				{
					"value": "String",
					"count": "Number"
				}
			],
			"last_updated": "Unix timestamps",
			"mitre": [
				{
					"value": "String",
					"label": "String",
					"group": "String"
				}
			],
			"values_counter": {
				"handles": "Number",
				"motivation": "Number",
				"origin": "Number",
				"status": "Number",
				"type": "Number",
				"targeted_geographies": "Number",
				"targeted_sectors": "Number",
				"active_sources": "Number",
				"mitre": "Number"
			}
		}
	],
	"filters": {
		"motivations": [
			{
				"key": "String",
				"doc_count": "Number"
			}
		],
		"types": [
			{
				"key": "String",
				"doc_count": "Number"
			}
		],
		"origins": [
			{
				"key": "String",
				"doc_count": "Number"
			}
		],
		"statuses": [
			{
				"key": "String",
				"doc_count": "Number"
			}
		],
		"targeted_geographies": [
			{
				"key": "String",
				"doc_count": "Number"
			}
		],
		"targeted_sectors": [
			{
				"key": "String",
				"doc_count": "Number"
			}
		],
		"active_sources": [
			{
				"key": "String",
				"doc_count": "Number"
			}
		],
		"mitre": [
			{
				"key": "String",
				"doc_count": "Number",
				"label": "String",
				"group": "String"
			}
		]
	}
}

​
Workflow Library Example

List Threat Actors with Kela and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop