ListCyberThreats
ListCyberThreats retrieves threat indicators from multiple intelligence sources.
Authorizations
User-issued WorldMonitor API key.
Query Parameters
Start of time range (inclusive), Unix epoch milliseconds. Accepted but currently ignored; no-op until this handler supports the parameter.
End of time range (inclusive), Unix epoch milliseconds. Accepted but currently ignored; no-op until this handler supports the parameter.
Maximum items per page (1-100).
Cursor for next page.
Optional threat type filter.
CYBER_THREAT_TYPE_C2_SERVER, CYBER_THREAT_TYPE_MALWARE_HOST, CYBER_THREAT_TYPE_PHISHING, CYBER_THREAT_TYPE_MALICIOUS_URL Optional source filter.
CYBER_THREAT_SOURCE_FEODO, CYBER_THREAT_SOURCE_URLHAUS, CYBER_THREAT_SOURCE_C2INTEL, CYBER_THREAT_SOURCE_OTX, CYBER_THREAT_SOURCE_ABUSEIPDB Optional minimum criticality filter.
CRITICALITY_LEVEL_LOW, CRITICALITY_LEVEL_MEDIUM, CRITICALITY_LEVEL_HIGH, CRITICALITY_LEVEL_CRITICAL Optional JMESPath expression applied server-side to project or reduce the JSON response before it is returned (mirrors the MCP jmespath argument). Invalid expressions, expressions larger than 1024 UTF-8 bytes, or projections that exceed the 256 KB output cap return HTTP 400 with a {_jmespath_error, original_keys} envelope. Grammar and worked examples: https://www.worldmonitor.app/docs/mcp-jmespath.
