Entity Aliases (reverse)
get_entity_aliasesResolve any alias to its canonical entity and list all other aliases that map to it, revealing where distinct names collide into one actor.
Instructions
Every alias the reference set maps to ONE entity — the reverse of resolve_entity, which only walks a single alias forward. Use it to check alias collision: the commonest reason two "different actors" turn out to be one. IMPORTANT: the source (MISP) OVER-MERGES — it folds subgroups into their parent, so "andariel" and "bluenoroff" both appear under "Lazarus Group". An alias entry is a MAPPING, not an assertion of identity. Each alias therefore carries relation (canonical|subgroup|alias), other_entities (how many other entities claim the same label) and corpus_threats (how many threats this platform files under that exact label); corpus_uses_separately lists labels the corpus treats as their own actor despite the merge. Accepts a name or a uuid.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Name or alias to expand (e.g. "andariel"). Resolved exact-then-fuzzy, same ladder as resolve_entity. | |
| type | No | Optional: actor|malware|tool|sector|region|technique|campaign — narrows name resolution. | |
| uuid | No | Entity uuid, if you already have one from resolve_entity. Skips resolution. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| uuid | No | ||
| caveat | No | Over-merge warning. Do not drop it when summarising. | |
| aliases | No | ||
| cluster | No | ||
| matched | Yes | ||
| canonical | No | ||
| alias_count | No | ||
| entity_type | No | ||
| matched_via | No | uuid | exact | fuzzy | |
| corpus_uses_separately | No |