Your Data · Cross-Reference

`map_assets_to_actor`

Map your organisation's assets to a threat actor's TTPs. Resolves the actor (e.g. "Akira", "Qilin") to its MITRE ATT&CK techniques and linked CVEs, lists your matching discovered assets (optionally filtered by vendor/product), and flags which of your own CVE findings are attributed to the actor. Costs 1 credit.

Actor resolution uses two datasets

The actor name is resolved against both MITRE ATT&CK (~170 named intrusion sets) and the in-house Precursor dataset (815 actors), and the technique and CVE sets are the union of both. Neither covers the other: a ransomware operation MITRE has not named exists only in the second, while the older CVE-attribution set has broader CVE coverage than the newer cited one. actor.sources reports which tracks matched.

POST

tools/call

Cost: 1 credit per successful call · Scope: mcp:org · Response shape: jsonb

Returns data scoped to your own organisation only — the organisation is resolved from your API key and injected server-side, never read from the request.

Parameters

actorstringrequired

Threat actor / group name or alias to resolve, e.g. Akira or Qilin. Must be 1–120 characters.

vendorstringoptional

Optional vendor/product substring filter applied to your matching assets, e.g. sonicwall. Maximum 128 characters.

Example invocation

Ask your agent:

Map our SonicWall assets to current Akira TTPs.

Raw JSON-RPC:

curl -s https://api.precursorintelligence.com/functions/v1/mcp \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "map_assets_to_actor",
      "arguments": { "actor": "Akira", "vendor": "sonicwall" }
    }
  }'

Response

result.content[0].text (parsed)

{
  "actor": {
    "name": "Akira",
    "slug": "akira",
    "aliases": ["Akira Ransomware", "Storm-1567"],
    "sources": ["mitre_attack", "precursor_threat_intel"],
    "technique_ids": ["T1190", "T1133", "T1486", "T1567"],
    "cve_ids": ["CVE-2024-40766", "CVE-2023-27997"]
  },
  "techniques": [
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "tactics": ["Initial Access"]
    },
    {
      "id": "T1133",
      "name": "External Remote Services",
      "tactics": ["Initial Access", "Persistence"]
    },
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactics": ["Impact"]
    }
  ],
  "vendor_filter": "sonicwall",
  "my_matching_assets": [
    {
      "vendor": "sonicwall",
      "product": "sonicos",
      "version": "7.0.1",
      "cpe": "cpe:2.3:o:sonicwall:sonicos:7.0.1:*:*:*:*:*:*:*"
    }
  ],
  "my_cves_linked_to_actor": ["CVE-2024-40766"],
  "generated_at": "2026-06-18T09:30:00.000Z"
}

The full MCP envelope wrapping this payload is documented in Response Format.

Response fields

actorobjectoptional

The resolved threat actor. Contains name (canonical name), slug (when the actor is in the in-house dataset), aliases, sources (see below), technique_ids (MITRE ATT&CK technique identifiers), and cve_ids (CVEs linked to the actor).

actor.sourcesarrayoptional

Which datasets the name resolved against: mitre_attack, precursor_threat_intel, or both. An empty array means the name matched nothing — which is a completely different answer from "matched, but you have no exposure". Check it before reporting a clean result.

techniquesarrayoptional

Expanded detail for each of the actor's MITRE ATT&CK techniques. Each entry has id, name, and tactics (array of ATT&CK tactic names).

vendor_filterstring | nulloptional

The vendor/product substring filter that was applied, or null when no vendor argument was supplied.

my_matching_assetsarrayoptional

Assets from your discovered software inventory that match the actor's CVEs (and the optional vendor filter). Each entry has vendor, product, version, and cpe.

my_cves_linked_to_actorarrayoptional

CVE identifiers among your own findings that are attributed to this actor.

generated_atstringoptional

ISO 8601 timestamp indicating when this response was generated.

Errors

Code	Message	When
`-32602`	`invalid_params: actor: required_string`	The `actor` argument is missing.
`-32602`	`invalid_params: actor: length:1..120`	The `actor` value is empty or exceeds 120 characters.
`-32001`	`unauthorized`	The API key is invalid/revoked, the IP is not allowed, or the key lacks the `mcp:org` scope.
`-32002`	`insufficient_credits`	The organisation's credit balance is below 1.

For a complete reference of JSON-RPC error codes, see Errors.