Correlation Path
get_correlation_pathTrace the shortest evidence path between two threats to show if they're connected, listing intermediate threats and shared artifacts per hop. Includes a reason when no path exists.
Instructions
Shortest evidence path between two threats across the similarity graph: the intermediate threats, each hop's dominant linking signal and shared artifacts, and the weakest-link strength of the whole path. Answers "is this incident connected to that campaign, and through what". Returns found:false with a reason (no edges vs different components) rather than an empty array.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | Target threat ID. | |
| from | Yes | Starting threat ID. | |
| max_hops | No | Search depth, 1-8 (default 6). |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | ||
| from | Yes | ||
| hops | No | ||
| found | Yes | ||
| reason | No | Why no path exists (no similarity edges vs different components) when found is false. | |
| path_strength | No |