Search for validated relationships between entities in the Links graph.
Links represent technically validated relationships between entities — established through sandbox
analysis, infrastructure analysis, network traffic analysis, and Insikt Group research — not mere
co-occurrence in articles.
The Entity Match API may be used to determine the ID for a certain entity.
For quick single-entity triage, the links enrichment field on entity Lookup endpoints provides the
same intelligence in a more compact format combined with other enrichment. Use this dedicated Links API
instead when you need filtering, batch queries across multiple entities, per-entity risk scores on
linked entities, or graph traversal via the connected_entities filter.
Filters
This endpoint supports a variety of filters that can be used to control either the output or the sources used.
In order to filter the output, sections may be used to only return links categorized as for example
"Victims & Exploit Targets", or entity_types to only return certain types of entities, like IP addresses.
See the metadata endpoint for possible values.
Sources are grouped into two types, technical analysis and Insikt Group research.
Technical link sources may be further filtered by specifying only the relevant event types, or a timeframe for
event recency (up to a maximum of 1825 days from today).
Limits
The depth of the search is abstracted into defined scopes.
A larger scope may yield more links, at the cost of increased latency.
See the search_scope filter for the exact number of references searched per scope.
A maximum number of results per entity type may also be defined.
Results
Results are grouped on the input entity ID,
and may include an error property if the search for that particular entity failed.
Linked entities are always returned with a basic set of properties as well as a variable set of attributes that
depend on the entity type. For example, indicators will have risk data,
MITRE ATT&CK identifiers will have a more detailed name and organizations,
companies and persons will have a boolean flag for whether or not they are threat actors.