Correlation Subgraph
get_correlation_subgraphRetrieve a subgraph of nodes and edges around any entity (threat, technique, actor, IOC, CVE) with configurable depth and fidelity to explore correlations incrementally without exceeding response limits.
Instructions
The N-hop neighbourhood around any graph node — nodes, edges, and each edge's fidelity — for incremental exploration of the correlation graph. Start at depth 1 and expand: a whole-corpus graph exceeds every response budget. For a pre-aggregated single-entity view prefer get_entity_profile, which is cheaper and usually what you want; use this when you need the actual edge topology.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| depth | No | Hops, 1-3 (default 1). Each hop multiplies the node count. | |
| seed_id | Yes | The entity id/value to expand from. | |
| seed_type | Yes | ||
| limit_edges | No | Default 80, max 120 over MCP. | |
| limit_nodes | No | Default 40, max 60 over MCP. | |
| min_fidelity | No | Drop edges below this fidelity (0-1). |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| seed | No | ||
| edges | No | ||
| nodes | No | ||
| params | No |