Known Actor Links
get_actor_relationshipsCheck which threat-actor relationships are already publicly documented (subgroup, overlaps, similar, linked-to) before claiming novelty. Returns UUIDs, sources, and matches in both directions.
Instructions
The platform's baseline of ALREADY-DOCUMENTED links between threat actors (subgroup / overlaps / similar / linked-to) with both uuids and the source. Call this before claiming any actor-to-actor relationship is new — it is the only surface that says whether a link is public knowledge. CRITICAL: this table is sparse, covering a small minority of the corpus's actor labels (the response carries live coverage numbers). An empty result means the link is UNRECORDED, never that it was disproved or that the actors are unrelated. Use it to rule a claim out of NOVELTY, never to rule a relationship out of EXISTENCE. Matches both slots, so it also returns rows where your actor is the target — get_actor's relationship list does not.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| actor | No | Optional: only rows naming this actor on either side (e.g. "Lazarus Group"). Omit to list the whole baseline. | |
| limit | No | Default 50, max 200. | |
| rel_type | No | Optional: filter by relationship type. The response's coverage.rel_types lists what is actually present. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | Yes | ||
| count | No | ||
| caveat | Yes | Absence-is-not-evidence statement. Do not drop it when summarising. | |
| coverage | Yes | ||
| unrecorded | No | Present and true when an `actor` filter matched nothing. Means UNRECORDED, not "no relationships exist". | |
| unrecorded_note | No |