Skip to main content
Relationship responses help agents discover pivots. Treat them as connected context, then validate important claims with evidence.

​
Response Envelope

/v2/relationships returns: Batch relationship responses use the standard batch envelope described in Batch responses.

​
Key Fields

Relationship items may include:
  • related entity ID and name
  • relationship type
  • direction or role
  • confidence
  • supporting evidence references
  • pagination cursor fields

​
IOC Relationship Expansion

For IOC subjects (ip, domain, url, hash, or email), relationship_types: ["ioc"] returns related indicators from event-correlation context when available. This is the supported path for IOC expansion; /v2/ioc-assessments does not return correlated IOCs inline. IOC subjects can also return sector relationships for targeted industries and country relationships for targeted countries when that context is available. These pivots are useful for environment relevance, especially when they match a caller-provided sector or operating region. IOC relationship items use relationship_type: "ioc", target_entity_type: "ioc", and include metadata.indicator_type when known. Sector and country relationship items use matching relationship_type and target_entity_type values. Treat all relationship items as pivots for hunting or blocking review, not proof by themselves.

​
How to use Relationships

Use relationships to select the next investigation step:
  • Actor links can trigger actor assessments.
  • Malware links can trigger malware or generic threat assessment paths.
  • IOC links can trigger IOC assessment or blocking review.
  • Sector links can support industry relevance.
  • Country links can support geography relevance.
  • Technique links can guide detection and hunting.

​
Caveat

Do not treat a relationship by itself as proof of current exploitation or targeting. Validate high-impact links with evidence.