A relationship graph is a structured map of connections between files, domains, IP addresses, hashes, prompts, API endpoints, and other threat indicators. Instead of treating each artifact as isolated, the graph shows how items relate to one another across a sample, campaign, or infrastructure set.
In cyber security, relationship graphs matter because attackers often reuse code, hosting, strings, and service references. A graph can reveal shared infrastructure, common tooling, or a family of malware that would be easy to miss with simple keyword matching. In research workflows like CAIRN, these graphs help analysts connect metadata clues, cluster related samples, and prioritize what deserves deeper review. Defenders also use them in threat hunting and incident response to trace blast radius, identify pivot points, and separate noise from meaningful patterns.