Correlate an indicator: do we hold it, and what is next to it
correlateAnswers two different questions about an IP address or domain, and keeps them apart: do we HOLD it, and what sits NEXT to it.
held is an exact yes or no, with held_in naming the lane that answered (iocs, the published blocklist lane, or the graph). neighbors is group membership in our indicator graph: the same /24 for an IPv4 address, the same registrable domain for a domain, with a real count (or "200+" with truncated:true when the scan hit its bound). neighbor_summary says what those neighbors are: how many are attributed to which actor or malware family, from how many lanes. A range we carry that covers the address, with no exact record, is reported as block_coverage, never as a detection.
strength is a single word for a hurried reader: none, adjacent-only, single-lane, multi-lane or corroborated. Read caveats before trusting it: a shared hosting platform or cloud range makes neighbors co-tenants, not related infrastructure, and the response says so when it applies.
Use it after enrich-ioc, or first, when the question is "is this part of something": a scanner next to a known C2, a lookalike domain on a campaign's registrar, a clean address in a dirty /24. Keyed Pro and Enterprise callers also get the neighbor rows themselves (neighbors.sample) to pivot on with enrich-ioc; free and anonymous callers get the counts and the summary.
Not consulted: our own edge observations (blocks, honeypot hits). Read-only. Hashes and URLs are not graph nodes; use enrich-ioc for those.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"indicator": "<indicator>"
},
"name": "correlate"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max neighbor rows returned to Pro and Enterprise callers. Default 10. Counts and the summary do not depend on it. | |
| indicator | Yes | An IPv4 address or a domain. |