Pivot with Relationships

Use /v2/relationships after entity resolution when you need connected actors, campaigns, malware, sectors, countries, indicators, or techniques.

General relationship types

Supported relationship types include:

actor
campaign
malware
sector
country
ioc
technique

For CVE subjects, technique pivots through the vulnerability described by the CVE. For IOC subjects, ioc pivots through event-correlation context to related indicators. sector and country can return target-industry and target-country pivots when that context is available. Use concrete IOC entity types (ip, domain, url, hash, or email) rather than ioc as the subject type.

Workflow

Start from a resolved subject when possible.
Request only the relationship types needed for the investigation.
Keep max_results bounded.
Hydrate important related entities before high-impact recommendations.
Use evidence calls to validate material relationship claims.

Agent guidance

Relationships are pivots, not proof by themselves. Treat high-impact links as leads until supporting evidence confirms them.

Traverse ATT&CK detection knowledge

Use the same relationships endpoint to explore tactics, techniques, detection strategies, analytics, and telemetry. relationship_types selects the type of related entity. predicates selects the meaning of the link. direction is relative to your subject and defaults to both.

Directed link	Predicate	From technique to detection guidance
Technique → tactic	`belongs_to`	Use `outgoing` to find a technique’s tactics.
Detection strategy → technique	`detects`	Use `incoming` to find strategies for a technique.
Detection strategy → analytic	`has_analytic`	Use `outgoing` from a strategy.
Analytic → data component	`requires_data_component`	Use `outgoing` from an analytic.
Data component → data source	`belongs_to_data_source`	Use `outgoing` from a component when the source reference exists.

Use incoming to traverse any link in reverse. The supported ATT&CK entity types are tactic, technique, detection-strategy, analytic, data-component, and data-source. Make separate requests for actor, campaign, malware, IOC, sector, and country pivots; you cannot mix those target types into an ATT&CK traversal. Existing general relationship requests retain their default behavior. Specify an ATT&CK predicate or a new target type to select this traversal explicitly.

Find detection strategies for PowerShell

With the credentials from the quickstart, request incoming detects links for T1059.001:

curl -sS -X POST "$KYBERIS_BASE_URL/v2/relationships" \
  -H "Authorization: ApiKey $KYBERIS_API_KEY_ID:$KYBERIS_API_KEY_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_context": {
      "objective": "Find ATT&CK detection guidance for PowerShell.",
      "requested_outcome": "Identify detection strategies and their analytics.",
      "workflow_stage": "relationships",
      "run_id": "run-powershell-001",
      "step_id": "step-01"
    },
    "query": "T1059.001",
    "relationship_types": ["detection-strategy"],
    "predicates": ["detects"],
    "direction": "incoming",
    "max_results": 10
  }'

For the next request, copy a returned item’s canonical_id and target_entity_type into subject.canonical_id and subject.entity_type. Remove query, set relationship_types to ["analytic"], predicates to ["has_analytic"], and direction to outgoing. Advance your agent-context step_id. Continue from each analytic to data-component, then from each component to data-source, using the predicates in the table. Provide exactly one of query or subject. ATT&CK traversal resolves exact canonical IDs, STIX IDs, external ATT&CK IDs such as DET0455 or AN1252, and exact names. Use expected_types to disambiguate names. Reuse returned canonical IDs unchanged; do not construct them from an external ATT&CK ID. These new entity types are supported in relationships; do not assume they are accepted by assessment or generic entity hydration endpoints.

Read guidance and telemetry

Read each item’s metadata.entity for its authored description, external references, platforms, lifecycle status, and available version/timestamps. Analytics can include structured log_source_references, log_sources, and mutable_elements for channels and tuning parameters. The response-level metadata.subject_entity contains the subject’s content, even if it has no matching relationships. Read metadata.warnings for missing references. Use this content to inform a detection engineering handoff. It is MITRE-authored technique-level guidance; it does not establish that a particular procedure ran or provide a generated emulation script. Preserve citations and distinguish source guidance from your own detection or emulation recommendations.

Filter and paginate

platform, such as Windows, excludes targets with explicitly incompatible platforms. Targets without platform metadata remain eligible.
include_inactive defaults to false: revoked or deprecated techniques, strategies, and analytics are omitted from links. Set it to true to include them with their status. Legacy data components and sources remain visible with status so you can still follow required telemetry references.
max_results defaults to 10 and accepts 1–100. Pass next_cursor back as cursor with the same subject, filters, and context. If the request or source snapshot changes, the cursor is rejected with HTTP 400; restart without it.

The same fields work per item in batch relationship requests. See relationship responses for metadata and the pagination differences between ATT&CK and general relationship pivots.

Getting started

Install Kyberis

Platform integrations

Threat investigations

Sample investigations

Interpret responses

General relationship types

Workflow

Agent guidance

Traverse ATT&CK detection knowledge

Find detection strategies for PowerShell

Read guidance and telemetry

Filter and paginate

​General relationship types

​Workflow

​Agent guidance

​Traverse ATT&CK detection knowledge

​Find detection strategies for PowerShell

​Read guidance and telemetry

​Filter and paginate

General relationship types

Workflow

Agent guidance

Traverse ATT&CK detection knowledge

Find detection strategies for PowerShell

Read guidance and telemetry

Filter and paginate