Correlation Engine
get_correlationsRetrieve precomputed cross-dataset threat correlations. Start with the overview engine to see what data exists, then drill into a specific engine like MITRE heatmap, CVE velocity, or attribution.
Instructions
Read precomputed cross-dataset correlations. Choose an engine: 'overview' (rollup of all engines — default), 'mitre-heatmap', 'adversary-infra', 'ioc-consensus', 'cve-velocity', 'attribution', 'detection-debt', or 'enrichment'. Use 'overview' first to see what's available, then drill into a specific engine.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Paged engines only ('mitre-heatmap', 'ioc-consensus', 'detection-debt'): max rows, pre-ordered by score (default 50; max 200 for mitre-heatmap, 500 for the others). The summary block always covers the full set. | |
| engine | No | Which correlation engine to read (default 'overview') | |
| offset | No | Paged engines only: skip this many rows. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| cves | No | ||
| iocs | No | ||
| engines | No | ||
| sources | No | ||
| summary | No | ||
| sync_log | No | ||
| techniques | No | ||
| infrastructure | No | ||
| shared_entities | No |