Artifact Relationships

LAST UPDATED: SEPTEMBER 19, 2025

PREREQUISITES

Knowledge of field mapping.
Knowledge of artifact instantiation.

Artifact relationships define how different artifact entities interact and influence one another. By configuring relationships, analysts can model real-world behaviors, visualize connections on the Artifact Behavior diagram, and understand how multiple entities link together.

Worked Examples

PART 1 Relationship Configuration and Insights

Set up the following event source.
Add the following two EFM records:
Add the following relationship.

Relationship Configuration: Mini Guide and Key Insights*

Navigate to the Artifacts module.
Click on the Relationships sidebar item, then click on the + Add New Relationship button.
Select a source artifact (Artifact 1) and a destination artifact (Artifact 2), each with a corresponding role.
- The artifact role must be specified during EFM setup before it can be selected here.
- The relationship type name is a label that specifies the effect of the source artifact on the destination artifact.
- Two artifact types cannot be directly related to each other more than once.
- An artifact cannot form a direct relationship with itself.
- An integration and event source can optionally be specified to restrict artifact relationships so they form only after data ingestion and field mapping have been completed for that integration event source.
  - EXAMPLE
    Selected EFM Event Source
    Corresponding Inputs for Source Conditions
    This prevents artifact relationships from forming for event sources of other integrations, as well as for other event sources within the same integration (Zendesk in this case), when EFM matches occur.

Verify that a corresponding relationship record has been added to the table.

Send the following POST webhook request.

JSON

{
    "results": [
        {
            "id": "0008",
            "discriminator": "demo",
            "target1": "value1",
            "target2": "value2"

        }
    ]
}

Verify that two artifact entities have been created and are linked by the configured relationship.

PART 2 Alternative Example with Additional Artifact Entities

Add the following two EFM records:
Delete the relationship configured in step 3.
Add the following relationship.

Send the following POST webhook request.

JSON

{
    "results": [
        {
            "id": "0010",
            "discriminator": "demo",
            "target1": "value1",
            "target2": "value2",
            "target3": "value3",
            "target4": "value4"

        }
    ]
}

Verify that four artifact entities have been created, and that Custom Type 3 and Custom Type 4 are linked by the configured relationship.

ROLE DISTINGUISHES ARTIFACT INSTANCES

When two EFM records are configured to instantiate the same artifact type but are assigned different roles, the resulting artifact instance whose role matches the one specified in the Relationship popover is used to form the relationship. See FAQ 1.

PART 3 Multiple Relationships

Add the following relationship.

Send the following POST webhook request.

JSON

{
    "results": [
        {
            "id": "0012",
            "discriminator": "demo",
            "target1": "value1",
            "target2": "value2",
            "target3": "value3",
            "target4": "value4"

        }
    ]
}

Verify in the new D3 event that adding the "Communicates with" relationship between the Custom Type artifact entity and the Custom Type 4 artifact entity results in two disconnected relationship groups.

PART 4 Modeling Complex Interactions

Add the following relationship.

Send the following POST webhook request.

JSON

{
    "results": [
        {
            "id": "0014",
            "discriminator": "demo",
            "target1": "value1",
            "target2": "value2",
            "target3": "value3",
            "target4": "value4"

        }
    ]
}

Verify in the corresponding D3 event that adding the additional "Activates" relationship between the Custom Type 4 and Custom Type 3 artifact entities results in an interconnected, directed interaction flow.

FAQ

What happens if two EFM records instantiate the same artifact type but have different roles?

SCENARIO The following example is based on these configurations.

Frame 50 (2)-20250918-211139.png — Event Field Mapping Configurations

Frame 46 (1)-20250918-203911.png — Relationship Configurations

Send the following webhook Post request.
Verify that the relationship is established between artifact entities value2 and value5, not between value2 and value1.

RELATED ARTICLES