Skip to main content
Use /v2/relationships after entity resolution when you need connected actors, campaigns, malware, sectors, countries, indicators, or techniques.

​
Relationship Types

Supported relationship types include:
  • actor
  • campaign
  • malware
  • sector
  • country
  • ioc
  • technique
For CVE subjects, technique pivots through the vulnerability described by the CVE. For IOC subjects, ioc pivots through event-correlation context to related indicators. sector and country can return target-industry and target-country pivots when that context is available. Use concrete IOC entity types (ip, domain, url, hash, or email) rather than ioc as the subject type.

​
Workflow

  1. Start from a resolved subject when possible.
  2. Request only the relationship types needed for the investigation.
  3. Keep max_results bounded.
  4. Hydrate important related entities before high-impact recommendations.
  5. Use evidence calls to validate material relationship claims.

​
Agent Guidance

Relationships are pivots, not proof by themselves. Treat high-impact links as leads until supporting evidence confirms them.