Resolve Canonical Name
resolve_entityNormalize any actor, malware, tool, or technique alias to its canonical name and stable UUID, ensuring accurate threat intelligence lookups.
Instructions
Normalize an actor / malware / tool / sector / region / technique name or alias to its canonical reference form + stable UUID (e.g. "fancy bear" → "APT28"). Call this BEFORE pivoting (get_actor / get_malware_intelligence / get_tool_intelligence / search_threats) when unsure of the canonical name. Optional type narrows the lookup.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Name or alias to resolve | |
| type | No | Optional: actor|malware|tool|sector|region|technique|campaign |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| uuid | No | ||
| query | Yes | ||
| matched | Yes | ||
| canonical | No | Canonical name — feed to get_actor / get_malware_intelligence / get_tool_intelligence. | |
| entity_type | No | ||
| matched_via | No |