Search for validated relationships between entities in the Links graph.

Links represent technically validated relationships between entities — established through sandbox analysis, infrastructure analysis, network traffic analysis, and Insikt Group research — not mere co-occurrence in articles.

The Entity Match API may be used to determine the ID for a certain entity.

For quick single-entity triage, the links enrichment field on entity Lookup endpoints provides the same intelligence in a more compact format combined with other enrichment. Use this dedicated Links API instead when you need filtering, batch queries across multiple entities, per-entity risk scores on linked entities, or graph traversal via the connected_entities filter.

Filters

This endpoint supports a variety of filters that can be used to control either the output or the sources used.

In order to filter the output, sections may be used to only return links categorized as for example "Victims & Exploit Targets", or entity_types to only return certain types of entities, like IP addresses. See the metadata endpoint for possible values.

Sources are grouped into two types, technical analysis and Insikt Group research. Technical link sources may be further filtered by specifying only the relevant event types, or a timeframe for event recency (up to a maximum of 1825 days from today).

Limits

The depth of the search is abstracted into defined scopes. A larger scope may yield more links, at the cost of increased latency. See the search_scope filter for the exact number of references searched per scope. A maximum number of results per entity type may also be defined.

Results

Results are grouped on the input entity ID, and may include an error property if the search for that particular entity failed.

Linked entities are always returned with a basic set of properties as well as a variable set of attributes that depend on the entity type. For example, indicators will have risk data, MITRE ATT&CK identifiers will have a more detailed name and organizations, companies and persons will have a boolean flag for whether or not they are threat actors.

{
  "entities": [
    "JLHNoH"
  ],
  "filters": {
    "sections": [
      "iU_ZsI"
    ],
    "entity_types": [
      "type:IpAddress"
    ],
    "sources": [
      "technical",
      "insikt"
    ],
    "technical": {
      "timeframe": "-30d",
      "events": [
        "type:MalwareAnalysis"
      ],
      "connected_entities": [
        "idn:google.com"
      ]
    }
  },
  "limits": {
    "per_entity_type": 100
  }
}

{
  "data": {
    "entity": {
      "type": "type:Malware",
      "id": "JLHNoH",
      "name": "Cobalt Strike"
    },
    "links": [
      {
        "type": "type:IpAddress",
        "id": "ip:8.8.8.8",
        "name": "8.8.8.8",
        "section": "iU_ZsI",
        "attributes": [
          {
            "value": 90
          }
        ]
      }
    ],
    "error": {
      "message": "The entity was not found",
      "status_code": 404
    }
  }
}