Resolve Canonical Name
resolve_entityResolve aliases to canonical threat entity names and UUIDs, enabling accurate pivoting across intelligence tools. Specify entity type to narrow lookups.
Instructions
Normalize an actor / malware / tool / sector / region / technique name or alias to its canonical reference form + stable UUID (e.g. "fancy bear" → "APT28"). Call this BEFORE pivoting (get_actor / get_malware_intelligence / get_tool_intelligence / search_threats) when unsure of the canonical name. Optional type narrows the lookup.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Name or alias to resolve | |
| type | No | Optional: actor|malware|tool|sector|region|technique|campaign |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| uuid | No | ||
| query | Yes | ||
| matched | Yes | ||
| canonical | No | Canonical name — feed to get_actor / get_malware_intelligence / get_tool_intelligence. | |
| entity_type | No | ||
| matched_via | No |