# title
IoC Correlation (Open Evidence Schema v1)

# description
Cross-tenant correlation of a single Indicator of Compromise. The `tenant_count` field is the number of distinct opted-in tenants who have independently observed this IoC. Individual tenant identities are never exposed; the API only returns correlations whose `tenant_count` ≥ 3 (k-anonymity, k=3), and only for IoCs the caller has also independently observed.

# properties.ioc_type.description
Atomic artifact category. Values align with the Evidence Agent output schema.

# properties.ioc_value_display.description
The IoC value as originally observed (case preserved). Use this for UI rendering.

# properties.ioc_value_normalized.description
Deterministically normalised form of the IoC value (lowercased IPs/domains/hashes, uppercased CVEs, filepath case preserved). Use this for equality comparisons across tenants.

# properties.tenant_count.description
Number of distinct opted-in tenants that have independently observed this IoC. Always ≥ 3 by construction (k-anonymity); smaller counts are suppressed at the aggregation layer.

# properties.first_globally_observed_at.description
Earliest observation timestamp across all opted-in tenants for this IoC.

# properties.last_globally_observed_at.description
Most recent observation timestamp across all opted-in tenants for this IoC.

# properties.caller_first_observed_at.description
Timestamp when the caller's own tenant first observed this IoC. Null if the caller has not observed it (in which case the correlation should not have been surfaced — treat null as a data integrity warning).

# properties.caller_observation_count.description
How many times the caller's own tenant has observed this IoC across their incidents.