Entity Profile
get_entity_profileGet a one-call dossier for any intelligence-graph entity: threat, technique, actor, IOC, or CVE. Returns centrality/pivot rank, top neighbors with fidelity, and type-specific rollups including risk scores, consensus, and rarity.
Instructions
One-call dossier for any node in the intelligence graph — threat, technique, actor, IOC or CVE. Returns its centrality/pivot rank, top graph neighbours with edge fidelity, and type-specific rollups (linked threats, techniques with risk scores, IOCs with consensus and rarity, campaigns, related CVEs). Best token-per-call ratio in the graph family: replaces five or six separate lookups. Neighbours on the NPMI edge types also carry raw pmi, co_occurrence_count and the marginals {c, df_actor, df_tech, N}. For technique and ioc nodes the response includes rarity — corpus_df (how many threats mention it) against corpus_n — which is what separates a distinctive shared technique from background noise; check top_neighbors_truncated and raise limit before concluding a neighbour is absent.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Neighbours in top_neighbors (default 20, max 100 over MCP). They are ordered by fidelity, so the rare low-fidelity edges are the ones a small limit drops. | |
| node_id | Yes | The entity id/value (TL- id, T-number, actor name, IOC value, or CVE id). | |
| node_type | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| cves | No | ||
| iocs | No | ||
| node | Yes | ||
| rarity | No | ||
| threats | No | ||
| campaigns | No | ||
| techniques | No | ||
| top_neighbors | No | ||
| top_neighbors_limit | No | ||
| top_neighbors_truncated | No | True when more neighbours exist than were returned — raise `limit`. |