Graph Campaigns
get_graph_campaignsIdentify campaign clusters assembled from a similarity graph, with member details, cohesion, actors, techniques, IOCs, and duplicate-risk evidence to distinguish real multi-event campaigns from duplicate reports.
Instructions
Campaign clusters the engine assembled from the similarity graph (connected components + label propagation): label, cohesion, top actors/techniques/IOCs/nation-states, and per-member {title, created_at, category, threat_actor}. Each cluster carries duplicate_risk plus its evidence (distinct_member_dates, date_span_days, shared_title_tokens) — a similarity-derived cluster of one event documented several times looks identical to a real multi-event campaign until you read those. Distinct from get_campaign_intelligence (looks up a NAMED campaign from threat text) and from list_campaigns (the roster of named campaigns); this one reports clusters the engine derived itself.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Default 15, max 50. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | Yes | ||
| summary | No |