Recorded Future Connector

Recorded Future is a threat intelligence platform that aggregates and analyzes data from diverse sources to provide actionable insights for identifying and mitigating cyber threats.

Recorded Future is a leading threat intelligence platform that aggregates and analyzes data from open, dark web, and technical sources to deliver actionable security insights. This connector enables Swimlane Turbine users to automate enrichment of indicators of compromise (IOCs), retrieve real-time threat intelligence on domains, IPs, hashes, URLs, vulnerabilities, and identities, and manage alert workflows directly within their security automation playbooks. By integrating Recorded Future with Swimlane Turbine, security teams can accelerate threat detection, prioritize and respond to incidents, and proactively mitigate risks using up-to-date intelligence. This integration empowers analysts to streamline investigations, automate alert triage, and enhance their organization’s security posture with minimal manual effort.

Prerequisites

Before using the Recorded Future connector, ensure you have the following prerequisites:

API Key Authentication is required to access Recorded Future services:

URL: The base endpoint for accessing the Recorded Future API.

API Token: A valid API token issued by Recorded Future for authenticating requests.

Limitations

None to date.

Supported Versions

This connector uses the "Connect API" from Recorded Future. Actions use V2 unless otherwise noted.

Additional Docs

Recorded Future Connect API

rfapi-python

Configuration

Authentication Methods

API Key Authentication:

URL: The endpoint for the Recorded Future API.

API Token: Your unique authentication token to access the Recorded Future API.

Capabilities

Important: Use Bulk IOC Enrichment when looking up multiple IOCs.

The Recorded Future connector has the following capabilities:

Bulk IOC Enrichment

Search Alert Rules

Search Alert

Search Alert Hits

Search Alert by ID

Search Update Alert

Get Alert from an Alert Rule

Search for an Alert from an Alert Rule

Lookup Alert Notification

Get Domain Risk List

List Domain Risk Rules

Get Hash Risk List

List Hash Risk Rules

Get IP Risk List

List IP Risk Rules ... and so on

Bulk IOC Enrichment

This endpoint is designed for high volume lookups of entities.

Recorded Future's documentation for this action can be found here.

Search Alert Rules

Recorded Future's documentation for this action can be found here.

Search Alert Hits

This action uses the V3 API.

Recorded Future's documentation for this action can be found here.

Search Alert by ID

This action uses the V3 API.

Recorded Future's documentation for this action can be found here.

Search Update Alert

Recorded Future's documentation for this action can be found here.

Search Alert

Note: This action uses a deprecated API endpoint. It is recommended to use the v3 API endpoint for alert searches.

Recorded Future's documentation for the deprecated action can be found here. The v3 API documentation can be found here.

Get Alert from an Alert Rule

This action uses the v3 API. You can retrieve alerts associated with a specific alert rule by using the alertRule parameter.

Recorded Future's documentation for this action can be found here.

Search for an Alert from an Alert Rule

This action uses the v3 API.

You can search for alerts associated with a specific alert rule by specifying the alertRule parameter.

Recorded Future's documentation for this action can be found here.

Lookup Alert Notification

Note: This action uses the v2 API endpoint.

Recorded Future's documentation for this action can be found here.

Get Domain Risk List

You can download the domain risk list in various formats such as CSV or Splunk, and choose to receive it compressed using gzip.

Recorded Future's documentation for this action can be found here.

List Domain Risk Rules

Recorded Future's documentation for this action can be found here.

Get Hash Risk List

You can download the hash risk list in various formats such as CSV or Splunk, and choose to receive it compressed using gzip.

Recorded Future's documentation for this action can be found here.

List Hash Risk Rules

Recorded Future's documentation for this action can be found here.

Get IP Risk List

You can download the IP address risk list in various formats such as CSV or Splunk, and choose to receive it compressed using gzip.

Recorded Future's documentation for this action can be found here.

List IP Risk Rules

Recorded Future's documentation for this action can be found here.

Lookup (URL, IP, Hash, and Domain lookups)

These actions allow you to retrieve detailed intelligence on specific entities such as URLs, IP addresses, hashes, and domains.

Recorded Future's documentation for these actions can be found at:

Lookup URL: here

Lookup IP Address: here

Lookup Hash: here

Lookup Domain: here

Get URL Risk List

You can download the URL risk list in various formats such as CSV or Splunk, and choose to receive it compressed using gzip.

Recorded Future's documentation for this action can be found here.

List URL Risk Rules

Recorded Future's documentation for this action can be found here.

Lookup Vulnerability

Recorded Future's documentation for this action can be found here.

Get Vulnerability Risk List

You can download the vulnerability risk list in various formats such as CSV or Splunk+CPE, and choose to receive it compressed using gzip.

Recorded Future's documentation for this action can be found here.

List Vulnerability Risk Rules

Recorded Future's documentation for this action can be found here.

Get Credentials Leaked

This action allows you to retrieve references related to exposed credentials for a company. You can filter the results by risk category, such as exposedCredential, to focus on leaked credentials.

Recorded Future's documentation for this action can be found here.

Query IP Extensions

This action retrieve extended details for an IP address, including specified extensions from the Recorded Future.

Recorded Future's documentation for this action can be found here.

Identity Detections

Retrieve credential exposures classified as External or Workforce from breach dumps and stealer logs.

Recorded Future's documentation for this action can be found here

Identity Incident Report

Generate an incident report for a stealer malware infection with all harvested credentials and machine context.

Recorded Future's documentation for this action can be found here

Identity Hostname lookup

Retrieve all stolen credentials from a compromised machine by its Windows computer name.

Recorded Future's documentation for this action can be found here

Identity IP Lookup

Retrieve stolen credentials by the compromised machine's IP address or range at time of infection.

Recorded Future's documentation for this action can be found here

Identity Password lookup

Check whether password hashes appear in breach data or stealer logs, with k-anonymity prefix support.

Recorded Future's documentation for this action can be found here

Identity Dump metadata search

Search metadata for data dumps and breach databases by name.

Recorded Future's documentation for this action can be found here

Configurations

API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
apikey	API key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Alert Lookup

Retrieve detailed information for a specific alert in Recorded Future using its unique alert ID.

Endpoint

URL: v2/alert/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Alert Lookup action
parameters.taggedText	boolean	Optional	Parameters for the Alert Lookup action

Input Example

{"parameters":{"taggedText":true},"path_parameters":{"id":"lWjyiz"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.review	object	Response data
data.review.assignee	object	Response data
data.review.statusDate	object	Response data
data.review.statusInPortal	string	Response data
data.review.status	string	Response data
data.review.noteDate	object	Response data
data.review.statusChangeBy	object	Response data
data.review.noteAuthor	object	Response data
data.review.note	object	Response data
data.entities	array	Response data
data.entities.trend	object	Response data
data.entities.documents	array	Response data
data.entities.documents.file_name	string	Response data
data.entities.documents.file	string	Response data
data.entities.risk	object	Response data
data.entities.risk.criticalityLabel	string	Response data
data.entities.risk.score	object	Response data
data.entities.risk.documents	array	Response data
data.entities.risk.documents.source	object	Response data
data.entities.risk.documents.url	object	Response data
data.entities.risk.documents.references	array	Response data
data.entities.risk.documents.authors	array	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 16:35:06 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node016hnx3pnie7pf1tvh7j74fpyza3994472.nod...

Bulk IOC Enrichment

Enrich multiple Indicators of Compromise at once using Recorded Future's threat intelligence to provide comprehensive security insights.

Endpoint

URL: v2/soar/enrichment

Method: POST

Input

Argument Name	Type	Required	Description
ip	array	Optional	Parameter for Bulk IOC Enrichment
domain	array	Optional	Parameter for Bulk IOC Enrichment
url	array	Optional	URL endpoint for the request
hash	array	Optional	Parameter for Bulk IOC Enrichment
vulnerability	array	Optional	Parameter for Bulk IOC Enrichment

Input Example

{"json_body":{"ip":["1.0.0.0"],"domain":["www.swimlane.com"],"url":["https://www.swimlane.com"],"hash":["bdb237bf8c5de6b60ba1e2dcfe364fc24f583e568d1682f851a9d0f11a45c78d"],"vulnerability":["Zs4cBI"]}}

Domain Lookup

Retrieve detailed threat intelligence for a specified domain from Recorded Future using the domain as a path parameter.

Endpoint

URL: v2/domain/{{domain}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.domain	string	Required	Parameters for the Domain Lookup action
parameters.fields	array	Optional	Parameters for the Domain Lookup action
parameters.metadata	boolean	Optional	Parameters for the Domain Lookup action
parameters.comment	string	Optional	Parameters for the Domain Lookup action

Input Example

{"parameters":{"fields":["analystNotes","counts","enterpriseLists","entity","intelCard","links","metrics","relatedEntities","risk","riskMapping","sightings","threatLists","timestamps"],"metadata":true,"comment":"any comment"},"path_parameters":{"domain":"www.swimlane.com"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.analystNotes	array	Response data
data.analystNotes.file_name	string	Response data
data.analystNotes.file	string	Response data
metadata	object	Response data
metadata.entries	array	Response data
metadata.entries.key	string	Response data
metadata.entries.label	string	Response data
metadata.entries.item	object	Response data
metadata.entries.item.entries	array	Response data
metadata.entries.item.entries.key	string	Response data
metadata.entries.item.entries.label	string	Response data
metadata.entries.item.entries.type	string	Response data
metadata.entries.item.entries.item	object	Response data
metadata.entries.item.entries.entries	array	Response data
metadata.entries.item.type	string	Response data
metadata.entries.type	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 15:20:06 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node0fd5obnu48hcl16apr2ibzkyva3942193.node...

Get Domain Risk List

Retrieve a list of domain risks from Recorded Future to identify potential threats and vulnerabilities associated with specific domains.

Endpoint

URL: v2/domain/risklist

Method: GET

Input

Argument Name	Type	Required	Description
parameters.format	string	Optional	Parameters for the Get Domain Risk List action
parameters.gzip	boolean	Optional	Parameters for the Get Domain Risk List action
parameters.list	string	Optional	Parameters for the Get Domain Risk List action

Input Example

{"parameters":{"format":"csv/splunk","gzip":true,"list":"actorinfrastructure"}}

Output

Parameter	Type	Description
attachments	object	Output field: attachments

Output Example

{"attachments":{}}

Get Domain Risk Rules

Retrieve risk rules for domains from Recorded Future to identify potential threats and assess associated security risks.

Endpoint

URL: v2/domain/riskrules

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.results	array	Response data
data.results.criticalityLabel	string	Response data
data.results.description	string	Response data
data.results.criticality	number	Response data
data.results.relatedEntities	array	Response data
data.results.relatedEntities.file_name	string	Response data
data.results.relatedEntities.file	string	Response data
data.results.name	string	Response data
data.results.count	number	Response data
data.results.categories	array	Response data
data.results.categories.name	string	Response data
data.results.categories.framework	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 21:30:36 GMT","Content-Type":"application/json;charset=utf-8","Content-Length":"1929","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node017j68k3iqy4rm1f6fz8x1eq424168935.node0; Pat...

Get Hash Risk List

Retrieve a list of hash risk assessments from Recorded Future to gain insights into potential security threats.

Endpoint

URL: v2/hash/risklist

Method: GET

Input

Argument Name	Type	Required	Description
parameters.format	string	Optional	Parameters for the Get Hash Risk List action
parameters.gzip	boolean	Optional	Parameters for the Get Hash Risk List action
parameters.list	string	Optional	Parameters for the Get Hash Risk List action

Input Example

{"parameters":{"format":"csv/splunk","gzip":true,"list":"large"}}

Output

Parameter	Type	Description
attachments	object	Output field: attachments

Output Example

{"attachments":{}}

Get Hash Risk Rules

Retrieve risk rules linked to a specific hash from Recorded Future to support threat assessment and prioritization.

Endpoint

URL: v2/hash/riskrules

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.results	array	Response data
data.results.criticalityLabel	string	Response data
data.results.description	string	Response data
data.results.categories	array	Response data
data.results.categories.name	string	Response data
data.results.categories.framework	string	Response data
data.results.criticality	number	Response data
data.results.relatedEntities	array	Response data
data.results.relatedEntities.file_name	string	Response data
data.results.relatedEntities.file	string	Response data
data.results.name	string	Response data
data.results.count	number	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 21:18:14 GMT","Content-Type":"application/json;charset=utf-8","Content-Length":"827","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node01snqb93wfqqnebjs4mrvs63ig4157334.node0; Path...

Get Identities | Lookup Subjects

Retrieve identities linked to specified subjects in Recorded Future using the provided JSON body.

Endpoint

URL: identity/credentials/lookup

Method: POST

Input

Argument Name	Type	Required	Description
subjects	array	Optional	Parameter for Get Identities	Lookup Subjects
subjects_sha1	array	Optional	Parameter for Get Identities	Lookup Subjects
subjects_login	array	Optional	Parameter for Get Identities	Lookup Subjects
subjects_login.login	string	Optional	Parameter for Get Identities	Lookup Subjects
subjects_login.login_sha1	string	Optional	Parameter for Get Identities	Lookup Subjects
subjects_login.domain	string	Optional	Parameter for Get Identities	Lookup Subjects
filter	object	Optional	Parameter for Get Identities	Lookup Subjects
filter.first_downloaded_gte	string	Optional	Parameter for Get Identities	Lookup Subjects
filter.latest_downloaded_gte	string	Optional	Parameter for Get Identities	Lookup Subjects
filter.exfiltration_date_gte	string	Optional	Parameter for Get Identities	Lookup Subjects
filter.properties	array	Optional	Parameter for Get Identities	Lookup Subjects
filter.breach_properties	object	Optional	Parameter for Get Identities	Lookup Subjects
filter.breach_properties.name	string	Optional	Name of the resource
filter.breach_properties.date	string	Optional	Date value
filter.dump_properties	object	Optional	Parameter for Get Identities	Lookup Subjects
filter.dump_properties.name	string	Optional	Name of the resource
filter.dump_properties.date	string	Optional	Date value
filter.username_properties	array	Optional	Name of the resource
filter.authorization_technologies	array	Optional	Parameter for Get Identities	Lookup Subjects
filter.authorization_protocols	array	Optional	Parameter for Get Identities	Lookup Subjects

Input Example

{"json_body":{"subjects":["[email protected]"],"subjects_sha1":["string"],"subjects_login":[{"login":"string","login_sha1":"string","domain":"string"}],"filter":{"first_downloaded_gte":"2022-12-05T22:00:58.463Z","latest_downloaded_gte":"2022-12-05T22:00:58.463Z","exfiltration_date_gte":"2022-12-05T22:00:58.463Z","properties":["Letter"],"breach_properties":{"name":"string","date":"2022-12-05T22:00:58.463Z"},"dump_properties":{"name":"string","date":"2022-12-05T22:00:58.463Z"},"username_properties":["Email"],"authorization_technologies":["string"],"authorization_protocols":["string"]}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
identities	array	Unique identifier
identities.identity	object	Unique identifier
identities.identity.subjects	array	Unique identifier
identities.count	number	Unique identifier
identities.credentials	array	Unique identifier
identities.credentials.subject	string	Unique identifier
identities.credentials.dumps	array	Unique identifier
identities.credentials.dumps.name	string	Unique identifier
identities.credentials.dumps.description	string	Unique identifier
identities.credentials.dumps.downloaded	string	Unique identifier
identities.credentials.dumps.type	string	Unique identifier
identities.credentials.dumps.breaches	array	Unique identifier
identities.credentials.dumps.breaches.name	string	Unique identifier
identities.credentials.dumps.breaches.domain	string	Unique identifier
identities.credentials.dumps.breaches.type	string	Unique identifier
identities.credentials.dumps.breaches.breached	string	Unique identifier
identities.credentials.dumps.breaches.start	string	Unique identifier
identities.credentials.dumps.breaches.stop	string	Unique identifier
identities.credentials.dumps.breaches.precision	string	Unique identifier
identities.credentials.dumps.breaches.description	string	Unique identifier
identities.credentials.dumps.breaches.site_description	string	Unique identifier
identities.credentials.dumps.infrastructure	object	Unique identifier
identities.credentials.dumps.infrastructure.ip	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 22:12:05 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","CF-Cache-Status":"DYNAMIC","Strict-Transport-Security":"max-age=31536000; includeSubDomains","Server":"cloudflare","CF-RAY":"77501f0adb016b1a-GRU","Content-Encoding":"gzip"},"reason":"OK","json_body":{"identities":[{}],"count":1}}

Get Identities | Search Domains

Retrieve identity information for specified domains from Recorded Future using advanced search parameters in a customizable JSON body.

Endpoint

URL: identity/credentials/search

Method: POST

Input

Argument Name	Type	Required	Description
domains	array	Optional	Parameter for Get Identities	Search Domains
domain_types	array	Optional	Type of the resource
filter	object	Optional	Parameter for Get Identities	Search Domains
filter.first_downloaded_gte	string	Optional	Parameter for Get Identities	Search Domains
filter.latest_downloaded_gte	string	Optional	Parameter for Get Identities	Search Domains
filter.exfiltration_date_gte	string	Optional	Parameter for Get Identities	Search Domains
filter.properties	array	Optional	Parameter for Get Identities	Search Domains
filter.breach_properties	object	Optional	Parameter for Get Identities	Search Domains
filter.breach_properties.name	string	Optional	Name of the resource
filter.breach_properties.date	string	Optional	Date value
filter.dump_properties	object	Optional	Parameter for Get Identities	Search Domains
filter.dump_properties.name	string	Optional	Name of the resource
filter.dump_properties.date	string	Optional	Date value
filter.username_properties	array	Optional	Name of the resource
filter.authorization_technologies	array	Optional	Parameter for Get Identities	Search Domains
filter.authorization_protocols	array	Optional	Parameter for Get Identities	Search Domains
offset	string	Optional	Parameter for Get Identities	Search Domains
limit	number	Optional	Parameter for Get Identities	Search Domains

Input Example

{"json_body":{"domains":["string"],"domain_types":["Authorization"],"filter":{"first_downloaded_gte":"2022-12-05T22:20:25.745Z","latest_downloaded_gte":"2022-12-05T22:20:25.745Z","exfiltration_date_gte":"2022-12-05T22:20:25.745Z","properties":["Letter"],"breach_properties":{"name":"string","date":"2022-12-05T22:20:25.745Z"},"dump_properties":{"name":"string","date":"2022-12-05T22:20:25.745Z"},"username_properties":["Email"],"authorization_technologies":["string"],"authorization_protocols":["string"]},"offset":"string","limit":0}}

Get IP Risk List

Retrieve a list of IP addresses with risk scores from Recorded Future to support enhanced threat analysis and informed security decisions.

Endpoint

URL: v2/ip/risklist

Method: GET

Input

Argument Name	Type	Required	Description
parameters.format	string	Optional	Parameters for the Get IP Risk List action
parameters.gzip	boolean	Optional	Parameters for the Get IP Risk List action
parameters.list	string	Optional	Parameters for the Get IP Risk List action

Input Example

{"parameters":{"format":"csv/splunk","gzip":true,"list":"actorinfrastructure"}}

Output

Parameter	Type	Description
attachments	object	Output field: attachments

Output Example

{"attachments":{}}

Get URL Risk List

Retrieve a list of URLs with associated risk scores from Recorded Future to help prioritize and respond to potential threats efficiently.

Endpoint

URL: v2/url/risklist

Method: GET

Input

Argument Name	Type	Required	Description
parameters.format	string	Optional	Parameters for the Get URL Risk List action
parameters.gzip	boolean	Optional	Parameters for the Get URL Risk List action
parameters.list	string	Optional	Parameters for the Get URL Risk List action

Input Example

{"parameters":{"format":"csv/splunk","gzip":true,"list":"actorinfrastructure"}}

Output

Parameter	Type	Description
file	array	Output field: file

Output Example

{"file":{"filename":"Example Name","file_data":"string"}}

Get URL Risk Rules

Retrieve a list of risk rules applied to URLs in Recorded Future to support enhanced threat analysis and informed security decisions.

Endpoint

URL: v2/url/riskrules

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.results	array	Response data
data.results.criticalityLabel	string	Response data
data.results.description	string	Response data
data.results.criticality	number	Response data
data.results.relatedEntities	array	Response data
data.results.relatedEntities.file_name	string	Response data
data.results.relatedEntities.file	string	Response data
data.results.name	string	Response data
data.results.count	number	Response data
data.results.categories	array	Response data
data.results.categories.name	string	Response data
data.results.categories.framework	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 18:55:05 GMT","Content-Type":"application/json;charset=utf-8","Content-Length":"1115","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node01ntljhka8cig2g8w9rk2sb7gn4079571.node0; Pat...

Get Vulnerability Risk List

Retrieve and prioritize vulnerabilities with risk scores from Recorded Future to enhance your organization's security posture.

Endpoint

URL: v2/vulnerability/risklist

Method: GET

Input

Argument Name	Type	Required	Description
parameters.format	string	Optional	Parameters for the Get Vulnerability Risk List action
parameters.gzip	boolean	Optional	Parameters for the Get Vulnerability Risk List action
parameters.list	string	Optional	Parameters for the Get Vulnerability Risk List action

Input Example

{"parameters":{"format":"csv/splunk","gzip":true,"list":"actorinfrastructure"}}

Output

Parameter	Type	Description
attachments	object	Output field: attachments

Output Example

{"attachments":{}}

Get Vulnerability Risk Rules

Retrieve a list of vulnerability risk rules from Recorded Future to enhance security insights.

Endpoint

URL: v2/vulnerability/riskrules

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.results	array	Response data
data.results.criticalityLabel	string	Response data
data.results.description	string	Response data
data.results.categories	array	Response data
data.results.categories.name	string	Response data
data.results.categories.framework	string	Response data
data.results.criticality	number	Response data
data.results.relatedEntities	array	Response data
data.results.relatedEntities.file_name	string	Response data
data.results.relatedEntities.file	string	Response data
data.results.name	string	Response data
data.results.count	number	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 21:39:33 GMT","Content-Type":"application/json;charset=utf-8","Content-Length":"1326","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node0bno2qyhegmod18z4qv5haifgh4167508.node0; Pat...

Hash Lookup

Retrieve threat intelligence details for a specified hash from Recorded Future using the hash as a path parameter.

Endpoint

URL: v2/hash/{{hash}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.hash	string	Required	Parameters for the Hash Lookup action
parameters.fields	array	Optional	Parameters for the Hash Lookup action
parameters.metadata	boolean	Optional	Parameters for the Hash Lookup action
parameters.comment	string	Optional	Parameters for the Hash Lookup action

Input Example

{"parameters":{"fields":["analystNotes","counts","enterpriseLists","entity","fileHashes","hashAlgorithm","intelCard","links","metrics","relatedEntities","risk","riskMapping","sightings","threatLists","timestamps"],"metadata":true,"comment":"any comment"},"path_parameters":{"hash":"bdb237bf8c5de6b60ba1e2dcfe364fc24f583e568d1682f851a9d0f11a45c78d"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.analystNotes	array	Response data
data.analystNotes.file_name	string	Response data
data.analystNotes.file	string	Response data
metadata	object	Response data
metadata.entries	array	Response data
metadata.entries.key	string	Response data
metadata.entries.label	string	Response data
metadata.entries.item	object	Response data
metadata.entries.item.entries	array	Response data
metadata.entries.item.entries.key	string	Response data
metadata.entries.item.entries.label	string	Response data
metadata.entries.item.entries.type	string	Response data
metadata.entries.item.entries.item	object	Response data
metadata.entries.item.entries.entries	array	Response data
metadata.entries.item.type	string	Response data
metadata.entries.type	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 14:49:27 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node0zue821pxtbpm8k8iaalxgk8p3925540.node0...

Identity Detections

Retrieve classified credential exposures from breach dumps and stealer logs in Recorded Future using a specified JSON body input.

Endpoint

URL: identity/detections

Method: POST

Input

Argument Name	Type	Required	Description
filter	object	Optional	Filter criteria to narrow down the detections returned by the query.
filter.detection_types	array	Optional	Filter by detection type.
filter.novel_only	boolean	Optional	Filter for novel detections that have not been previously observed.
filter.malware_only	boolean	Optional	Filter for detections associated with malware.
filter.domains	array	Optional	Filter by associated domains.
filter.source_type	array	Optional	Filter by source type of the detection.
filter.detection_type	string	Optional	Filter by detection type.
filter.authorization_technology	object	Optional	Filter by associated authorization technologies.
filter.authorization_technology.any	boolean	Optional	Match detections with any authorization technology.
filter.authorization_technology.id	array	Optional	Filter by authorization technology ID.
filter.authorization_technology.name	array	Optional	Filter by authorization technology name.
filter.cookies	string	Optional	Filter for detections with unexpired cookies.
filter.created	object	Optional	Filter by detection creation date.
filter.created.gte	string	Optional	Filter for detections created on or after this date.
filter.created.lt	string	Optional	Filter for detections created before this date.
organization_id	array	Optional	Organization IDs to scope the detections query.
include_enterprise_level	boolean	Optional	Include enterprise-level detections across all organizations.
limit	number	Optional	Maximum number of detections to return.
offset	string	Optional	Pagination token for next page.

Input Example

{"json_body":{"filter":{"detection_types":["External"],"novel_only":true,"malware_only":true,"domains":["example-corp.com"],"source_type":["MalwareLogs"],"detection_type":"External","authorization_technology":{"any":true,"id":["tech-okta-sso"],"name":["Okta Single Sign-On"]},"cookies":"UnexpiredCookies","created":{"gte":"2024-07-20T10:00:00Z","lt":"2024-07-25T10:00:00Z"}},"organization_id":["uhash:a1b2c3d4"],"include_enterprise_level":true,"limit":1000,"offset":"cD1lMzE5NTQ2OS1hYjYxLTQ1NTgtYjkyOC1iYjE3MWNkM2QyY2U"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
total	number	Output field: total
detections	array	Output field: detections
detections.id	string	Unique identifier
detections.type	string	Type of the resource
detections.novel	boolean	Output field: detections.novel
detections.source_type	string	Type of the resource
detections.subject	string	Output field: detections.subject
detections.password	string	Output field: detections.password
detections.authorization_service	object	Output field: detections.authorization_service
detections.authorization_service.url	string	URL endpoint for the request
detections.authorization_service.domain	string	Output field: detections.authorization_service.domain
detections.authorization_service.fqdn	string	Output field: detections.authorization_service.fqdn
detections.authorization_service.technology	array	Output field: detections.authorization_service.technology
detections.authorization_service.technology.name	string	Name of the resource
detections.authorization_service.technology.id	string	Unique identifier
detections.authorization_service.technology.category	string	Output field: detections.authorization_service.technology.category
detections.authorization_service.protocols	array	Output field: detections.authorization_service.protocols
detections.cookies	array	Output field: detections.cookies
detections.cookies.dns	string	Output field: detections.cookies.dns
detections.cookies.name	string	Name of the resource
detections.cookies.http	boolean	Output field: detections.cookies.http
detections.cookies.expiration	string	Output field: detections.cookies.expiration
detections.cookies.secure	boolean	Output field: detections.cookies.secure

Output Example

{"status_code":200,"reason":"OK","json_body":{"total":10,"detections":[{}],"next_offset":"10"}}

Identity Dump Metadata Search

Search for metadata on data dumps and breach databases in Recorded Future using criteria specified in a JSON body.

Endpoint

URL: identity/metadata/dump/search

Method: POST

Input

Argument Name	Type	Required	Description
names	array	Optional	List of dump or breach database names to search for in metadata.
limit	number	Optional	Maximum number of results to return.

Input Example

{"json_body":{"names":["Collection 1"],"limit":1000}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
dumps	array	Output field: dumps
dumps.name	string	Name of the resource
dumps.type	string	Type of the resource
dumps.source	string	Output field: dumps.source
dumps.description	string	Output field: dumps.description
dumps.infrastructure	object	Output field: dumps.infrastructure
dumps.infrastructure.ip	string	Output field: dumps.infrastructure.ip
dumps.compromise	object	Output field: dumps.compromise
dumps.compromise.os	string	Output field: dumps.compromise.os
dumps.compromise.os_username	string	Name of the resource
dumps.compromise.malware_file	string	Output field: dumps.compromise.malware_file
dumps.compromise.timezone	string	Output field: dumps.compromise.timezone
dumps.compromise.computer_name	string	Name of the resource
dumps.compromise.uac	string	Output field: dumps.compromise.uac
dumps.compromise.antivirus	array	Output field: dumps.compromise.antivirus
dumps.compromise.exfiltration_date	string	Date value
dumps.location	object	Output field: dumps.location
dumps.location.country	object	Output field: dumps.location.country
dumps.location.country.name	string	Name of the resource
dumps.location.country.displayName	string	Name of the resource
dumps.location.country.countryCode	string	Output field: dumps.location.country.countryCode
dumps.location.country.alpha2Code	string	Output field: dumps.location.country.alpha2Code
dumps.location.country.alpha3Code	string	Output field: dumps.location.country.alpha3Code

Output Example

{"status_code":200,"reason":"OK","json_body":{"dumps":[{}]}}

Identity Hostname Lookup

Retrieve all stolen credentials associated with a compromised machine by providing its hostname in Recorded Future.

Endpoint

URL: identity/hostname/lookup

Method: POST

Input

Argument Name	Type	Required	Description
organization_id	string	Optional	Unique identifier for the organization to query within.
hostname	string	Optional	Windows computer name to search for associated credentials.
filter	object	Optional	Filter criteria to narrow down the credentials returned by the query.
filter.first_downloaded_gte	string	Optional	Filter for credentials first downloaded on or after this date.
filter.latest_downloaded_gte	string	Optional	Filter for credentials latest downloaded on or after this date.
filter.exfiltration_date_gte	string	Optional	Filter for credentials with exfiltration date on or after this date.
filter.properties	array	Optional	Filter for credentials that have specific properties, such as containing uppercase letters or being at least 8 characters long.
filter.username_properties	array	Optional	Filter for credentials with specific username properties, such as being an email address.
filter.breach_properties	object	Optional	Filter for credentials that were involved in breaches with specific properties, such as the breach name or date.
filter.breach_properties.name	string	Optional	Filter for credentials involved in breaches with this name.
filter.breach_properties.date	string	Optional	Filter for credentials involved in breaches that occurred on this date.
filter.dump_properties	object	Optional	Filter for credentials that were found in dumps with specific properties, such as the dump name or date.
filter.dump_properties.name	string	Optional	Filter for credentials found in dumps with this name.
filter.dump_properties.date	string	Optional	Filter for credentials found in dumps that were published on this date.
filter.authorization_technologies	array	Optional	Filter for credentials associated with specific authorization technologies, such as SAML or OAuth.
filter.authorization_protocols	array	Optional	Filter for credentials associated with specific authorization protocols, such as RDP or SSH.
filter.malware_families	array	Optional	Filter for credentials associated with specific malware families, such as RedLine Stealer or Vidar.
limit	number	Optional	Maximum number of credentials to return.
offset	string	Optional	Pagination token for next page of results.

Input Example

{"json_body":{"organization_id":"uhash:a1b2c3d4","hostname":"server-01.us.east","filter":{"first_downloaded_gte":"2024-01-01T00:00:00Z","latest_downloaded_gte":"2024-12-01T00:00:00Z","exfiltration_date_gte":"2024-01-01T00:00:00Z","properties":["UpperCase","AtLeast8Characters"],"username_properties":["Email"],"breach_properties":{"name":"ExampleCorp Breach 2024","date":"2024-03-15T00:00:00Z"},"dump_properties":{"name":"Collection","date":"2019-01-07T00:00:00Z"},"authorization_technologies":["SAML"],"authorization_protocols":["RDP"],"malware_families":["RedLine Stealer"]},"limit":1000,"offset":"cD1lMzE5NTQ2OS1hYjYxLTQ1NTgtYjkyOC1iYjE3MWNkM2QyY2U="}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
identities	array	Unique identifier
identities.identity	object	Unique identifier
identities.identity.subjects	array	Unique identifier
identities.count	number	Unique identifier
identities.credentials	array	Unique identifier
identities.credentials.subject	string	Unique identifier
identities.credentials.authorization_service	object	Unique identifier
identities.credentials.authorization_service.url	string	URL endpoint for the request
identities.credentials.authorization_service.domain	string	Unique identifier
identities.credentials.authorization_service.fqdn	string	Unique identifier
identities.credentials.authorization_service.protocols	array	Unique identifier
identities.credentials.authorization_service.technology	array	Unique identifier
identities.credentials.authorization_service.technology.id	string	Unique identifier
identities.credentials.authorization_service.technology.name	string	Unique identifier
identities.credentials.authorization_service.technology.category	string	Unique identifier
identities.credentials.authorization_services	array	Unique identifier
identities.credentials.authorization_services.url	string	URL endpoint for the request
identities.credentials.authorization_services.domain	string	Unique identifier
identities.credentials.authorization_services.fqdn	string	Unique identifier
identities.credentials.authorization_services.protocols	array	Unique identifier
identities.credentials.authorization_services.technology	array	Unique identifier
identities.credentials.authorization_services.technology.id	string	Unique identifier
identities.credentials.authorization_services.technology.name	string	Unique identifier

Output Example

{"status_code":200,"reason":"OK","json_body":{"identities":[{}],"count":0,"next_offset":"cD1lMzE5NTQ2OS1hYjYxLTQ1NTgtYjkyOC1iYjE3MWNkM2QyY2U="}}

Identity Incident Report

Generate a comprehensive incident report on stealer malware infections, including credentials and machine context, using source and include_details in Recorded Future.

Endpoint

URL: identity/incident/report

Method: POST

Input

Argument Name	Type	Required	Description
include_details	boolean	Optional	Include extended device and malware details in the response.
organization_id	string	Optional	Unique identifier for the organization associated with the incident report.
source	string	Optional	The dump source identifier (e.g., dump-redline-2024-07-21-001).
limit	number	Optional	Maximum number of credential entries to return.
offset	string	Optional	Pagination token for next page.

Input Example

{"json_body":{"include_details":true,"organization_id":"uhash:a1b2c3d4","source":"dump-redline-2024-07-21-001","limit":1000,"offset":"eyJsaW1pdCI6IDEwMCwgIm9mZnNldCI6IDEwMH0="}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
count	number	Count value
total_count	number	Count value
credentials	array	Output field: credentials
credentials.authorization_domain	string	Output field: credentials.authorization_domain
credentials.email_or_login	string	Output field: credentials.email_or_login
credentials.password	string	Output field: credentials.password
credentials.password_sha1	string	Output field: credentials.password_sha1
credentials.domain_category	string	Output field: credentials.domain_category
credentials.domain_technology	string	Output field: credentials.domain_technology
credentials.contains_cookies	boolean	Output field: credentials.contains_cookies
credentials.contains_active_cookies	boolean	Output field: credentials.contains_active_cookies
credentials.contains_high_risk_technologies	boolean	Output field: credentials.contains_high_risk_technologies
details	object	Output field: details
details.malware_family	string	Output field: details.malware_family
details.os	string	Output field: details.os
details.os_username	string	Name of the resource
details.malware_file	string	Output field: details.malware_file
details.timezone	string	Output field: details.timezone
details.uac	string	Output field: details.uac
details.exfiltration_date	string	Date value
details.antivirus	string	Output field: details.antivirus
details.ip_address	string	Output field: details.ip_address
details.postal_code	string	Output field: details.postal_code

Output Example

{"status_code":200,"reason":"OK","json_body":{"count":0,"total_count":0,"credentials":[{}],"details":{"malware_family":"RedLine Stealer","os":"Windows 10 Pro","os_username":"jsmith","malware_file":"C:\\Users\\jsmith\\AppData\\Local\\Temp\\winmgr.exe","timezone":"America/New_York","uac":"UAC-Admin","exfiltration_date":"2025-07-24T14:30:00Z","antivirus":"Windows Defender","ip_address":"198.51.100.14","postal_code":"90210","country":"United States"},"next_offset":"eyJsaW1pdCI6IDEwMCwgIm9mZnNldCI6ID...

Identity IP Lookup

Retrieve credentials compromised by a specific IP address or range at the time of infection using Recorded Future.

Endpoint

URL: identity/ip/lookup

Method: POST

Input

Argument Name	Type	Required	Description
organization_id	string	Optional	Unique identifier for the organization to scope the search within.
ip	string	Optional	IP address of the compromised machine at time of infection.
range	object	Optional	IP range of the compromised machine at time of infection, using comparison operators.
range.gte	string	Optional	Filter for credentials from machines with IP addresses greater than or equal to this value.
range.gt	string	Optional	Filter for credentials from machines with IP addresses greater than this value.
range.lte	string	Optional	Filter for credentials from machines with IP addresses less than or equal to this value.
range.lt	string	Optional	Filter for credentials from machines with IP addresses less than this value.
filter	object	Optional	Additional filters to apply to the search query, such as date ranges, properties, and associated breach or dump information.
filter.first_downloaded_gte	string	Optional	The first date when these credentials were received and indexed by Recorded Future.
filter.latest_downloaded_gte	string	Optional	Latest date when these credentials were received and indexed by Recorded Future. It is not unusual for the same credentials to be exposed multiple times, in data from different dumps and/or logs.
filter.exfiltration_date_gte	string	Optional	The date when data was exfiltrated (stolen) from the victim.
filter.properties	array	Optional	Password property filters.
filter.username_properties	array	Optional	Username property filters.
filter.breach_properties	object	Optional	Filters for breach properties to further refine the search results based on the associated breach information.
filter.breach_properties.name	string	Optional	Name of the breach to filter by.
filter.breach_properties.date	string	Optional	Date of the breach to filter by.
filter.dump_properties	object	Optional	Filters for dump properties to further refine the search results based on the associated dump information.
filter.dump_properties.name	string	Optional	Name of the dump to filter by.
filter.dump_properties.date	string	Optional	Date of the dump to filter by.
filter.authorization_technologies	array	Optional	Filter for credentials associated with specific authorization technologies.
filter.authorization_protocols	array	Optional	Parameter for Identity IP Lookup
filter.malware_families	array	Optional	Filter for credentials associated with specific malware families.
limit	number	Optional	Maximum number of credential entries to return.
offset	string	Optional	Pagination token for next page of results.

Input Example

{"json_body":{"organization_id":"uhash:a1b2c3d4","ip":"198.51.100.1","range":{"gte":"192.0.2.0","gt":"192.0.2.0","lte":"192.0.2.255","lt":"192.0.2.255"},"filter":{"first_downloaded_gte":"2024-01-01T00:00:00Z","latest_downloaded_gte":"2024-01-01T00:00:00Z","exfiltration_date_gte":"2024-01-01T00:00:00Z","properties":["Symbol"],"username_properties":["Email"],"breach_properties":{"name":"ExampleCorp Breach 2024","date":"2024-03-15T00:00:00Z"},"dump_properties":{"name":"Collection","date":"2019-01-07T00:00:00Z"},"authorization_technologies":["SAML"],"authorization_protocols":["RDP"],"malware_families":["RedLine Stealer"]},"limit":1000,"offset":"cD1lMzE5NTQ2OS1hYjYxLTQ1NTgtYjkyOC1iYjE3MWNkM2QyY2U="}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
identities	array	Unique identifier
identities.identity	object	Unique identifier
identities.identity.subjects	array	Unique identifier
identities.count	number	Unique identifier
identities.credentials	array	Unique identifier
identities.credentials.subject	string	Unique identifier
identities.credentials.authorization_service	object	Unique identifier
identities.credentials.authorization_service.url	string	URL endpoint for the request
identities.credentials.authorization_service.domain	string	Unique identifier
identities.credentials.authorization_service.fqdn	string	Unique identifier
identities.credentials.authorization_service.protocols	array	Unique identifier
identities.credentials.authorization_service.technology	array	Unique identifier
identities.credentials.authorization_service.technology.id	string	Unique identifier
identities.credentials.authorization_service.technology.name	string	Unique identifier
identities.credentials.authorization_service.technology.category	string	Unique identifier
identities.credentials.authorization_services	array	Unique identifier
identities.credentials.authorization_services.url	string	URL endpoint for the request
identities.credentials.authorization_services.domain	string	Unique identifier
identities.credentials.authorization_services.fqdn	string	Unique identifier
identities.credentials.authorization_services.protocols	array	Unique identifier
identities.credentials.authorization_services.technology	array	Unique identifier
identities.credentials.authorization_services.technology.id	string	Unique identifier
identities.credentials.authorization_services.technology.name	string	Unique identifier

Output Example

{"status_code":200,"reason":"OK","json_body":{"identities":[{}],"count":0,"next_offset":"cD1lMzE5NTQ2OS1hYjYxLTQ1NTgtYjkyOC1iYjE3MWNkM2QyY2U="}}

Identity Password Lookup

Check if specified password hashes have been exposed in breach data or stealer logs using k-anonymity, requiring passwords to be provided in the JSON body.

Endpoint

URL: identity/password/lookup

Method: POST

Input

Argument Name	Type	Required	Description
passwords	array	Optional	Parameter for Identity Password Lookup
passwords.algorithm	string	Required	The hashing algorithm used to generate the password hash, which determines the formatting of the hash value for lookup.
passwords.hash	string	Required	The password hash value to look up, formatted according to the specified algorithm.

Input Example

{"json_body":{"passwords":[{"algorithm":"HASH32","hash":"5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
results	array	Result of the operation
results.password	object	Result of the operation
results.password.algorithm	string	Result of the operation
results.password.hash	string	Result of the operation
results.exposure_status	string	Status value

Output Example

{"status_code":200,"reason":"OK","json_body":{"results":[{}]}}

IP Lookup

Retrieve threat intelligence, risk scores, and related entities for a specified IP address from Recorded Future.

Endpoint

URL: v2/ip/{{ip}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.ip	string	Required	Parameters for the IP Lookup action
parameters.fields	string	Optional	Parameters for the IP Lookup action
parameters.metadata	boolean	Optional	Parameters for the IP Lookup action
parameters.comment	string	Optional	Parameters for the IP Lookup action

Input Example

{"parameters":{"fields":"analystNotes,counts,enterpriseLists,entity,intelCard,links,location,metrics,relatedEntities,risk,riskMapping,riskyCIDRIPs,sightings,threatLists,timestamps","metadata":true,"comment":"any comment"},"path_parameters":{"ip":"1.0.0.0"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.analystNotes	array	Response data
data.analystNotes.file_name	string	Response data
data.analystNotes.file	string	Response data
metadata	object	Response data
metadata.entries	array	Response data
metadata.entries.key	string	Response data
metadata.entries.label	string	Response data
metadata.entries.item	object	Response data
metadata.entries.item.entries	array	Response data
metadata.entries.item.entries.key	string	Response data
metadata.entries.item.entries.label	string	Response data
metadata.entries.item.entries.type	string	Response data
metadata.entries.item.entries.item	object	Response data
metadata.entries.item.entries.entries	array	Response data
metadata.entries.item.type	string	Response data
metadata.entries.type	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 14:04:25 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node09l9ww6ixtnia1ma9kvawcg4hh3649789.node...

List IP Risk Rules

Retrieve a list of IP risk rules from Recorded Future to identify potential threats and risks associated with specific IP addresses.

Endpoint

URL: v2/ip/riskrules

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.results	array	Response data
data.results.criticalityLabel	string	Response data
data.results.description	string	Response data
data.results.categories	array	Response data
data.results.categories.name	string	Response data
data.results.categories.framework	string	Response data
data.results.criticality	number	Response data
data.results.relatedEntities	array	Response data
data.results.relatedEntities.file_name	string	Response data
data.results.relatedEntities.file	string	Response data
data.results.name	string	Response data
data.results.count	number	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 18:36:15 GMT","Content-Type":"application/json;charset=utf-8","Content-Length":"1973","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node0hz75vvep08gxas7aete7u6s4071112.node0; Path=...

Lookup Vulnerability

Retrieve detailed information about a specific vulnerability from Recorded Future using its unique ID.

Endpoint

URL: v2/vulnerability/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Lookup Vulnerability action
parameters.fields	array	Optional	Parameters for the Lookup Vulnerability action
parameters.metadata	boolean	Optional	Parameters for the Lookup Vulnerability action
parameters.comment	string	Optional	Parameters for the Lookup Vulnerability action

Input Example

{"parameters":{"fields":["analystNotes","commonNames","counts","cpe","cpe22uri","cvss","cvssv3","enterpriseLists","entity","intelCard","links","metrics","nvdDescription","rawrisk","relatedEntities","relatedLinks","risk","riskMapping","sightings","threatLists","timestamps"],"metadata":true,"comment":"a comment"},"path_parameters":{"id":"Zs4cBI"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.analystNotes	array	Response data
data.analystNotes.attributes	object	Response data
data.analystNotes.attributes.validated_on	string	Response data
data.analystNotes.attributes.published	string	Response data
data.analystNotes.attributes.text	string	Response data
data.analystNotes.attributes.topic	object	Response data
data.analystNotes.attributes.topic.id	string	Response data
data.analystNotes.attributes.topic.name	string	Response data
data.analystNotes.attributes.topic.type	string	Response data
data.analystNotes.attributes.topic.description	string	Response data
data.analystNotes.attributes.context_entities	array	Response data
data.analystNotes.attributes.context_entities.id	string	Response data
data.analystNotes.attributes.context_entities.name	string	Response data
data.analystNotes.attributes.context_entities.type	string	Response data
data.analystNotes.attributes.validation_urls	array	Response data
data.analystNotes.attributes.validation_urls.id	string	Response data
data.analystNotes.attributes.validation_urls.name	string	Response data
data.analystNotes.attributes.validation_urls.type	string	Response data
data.analystNotes.attributes.title	string	Response data
data.analystNotes.attributes.note_entities	array	Response data
data.analystNotes.attributes.note_entities.id	string	Response data
data.analystNotes.attributes.note_entities.name	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 21:56:02 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node01knaoe0qzo9fivc0e4y5j2rbr4183315.node...

Malware Lookup

Retrieve comprehensive malware details from Recorded Future using a specified malware ID in the path parameters.

Endpoint

URL: v2/malware/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Malware Lookup action
parameters.fields	array	Optional	Parameters for the Malware Lookup action
parameters.metadata	boolean	Optional	Parameters for the Malware Lookup action
parameters.comment	string	Optional	Parameters for the Malware Lookup action

Input Example

{"parameters":{"fields":["analystNotes","categories","counts","entity","intelCard","links","metrics","relatedEntities","sightings","timestamps"],"metadata":true,"comment":"any comment"},"path_parameters":{"id":"some id"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.analystNotes	array	Response data
data.analystNotes.file_name	string	Response data
data.analystNotes.file	string	Response data
metadata	object	Response data
metadata.entries	array	Response data
metadata.entries.key	string	Response data
metadata.entries.label	string	Response data
metadata.entries.item	object	Response data
metadata.entries.item.entries	array	Response data
metadata.entries.item.entries.key	string	Response data
metadata.entries.item.entries.label	string	Response data
metadata.entries.item.entries.type	string	Response data
metadata.entries.item.entries.item	object	Response data
metadata.entries.item.entries.entries	array	Response data
metadata.entries.item.type	string	Response data
metadata.entries.type	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 16:58:04 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node044kroehlurc4ek4pefoxgz2h4004105.node0...

Query IP Extensions

Retrieve extended details and specific extensions for a given IP address from Recorded Future using the specified IP and extension path parameters.

Endpoint

URL: /v2/ip/{{ip}}/extension/{{extension}}

Method: GET

Input

Argument Name	Type	Required	Description
parameters.metadata	boolean	Optional	Include metadata.
path_parameters.ip	string	Required	The IP address to lookup. Must be a single IP address.
path_parameters.extension	string	Required	Extension to call.

Input Example

{"parameters":{"metadata":true},"path_parameters":{"ip":"10.0.0.8","extension":"CarbonBlack"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Search

Search for Recorded Future alerts using specified filters and retrieve matching results.

Endpoint

URL: v2/alert/search

Method: GET

Input

Argument Name	Type	Required	Description
parameters.triggered	string	Optional	Parameters for the Search action
parameters.assignee	string	Optional	Parameters for the Search action
parameters.freetext	string	Optional	Parameters for the Search action
parameters.limit	number	Optional	Parameters for the Search action
parameters.status	string	Optional	Parameters for the Search action
parameters.alertRule	string	Optional	Parameters for the Search action
parameters.taggedText	boolean	Optional	Parameters for the Search action
parameters.from	number	Optional	Parameters for the Search action
parameters.direction	string	Optional	Parameters for the Search action
parameters.orderby	string	Optional	Parameters for the Search action

Input Example

{"parameters":{"triggered":"2022-01-20T0","assignee":"NONE","freetext":"a","limit":10,"status":"no-action","alertRule":"iAPILC","taggedText":true,"from":0,"direction":"asc","orderby":"triggered"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.results	array	Response data
data.results.review	object	Response data
data.results.review.assignee	object	Response data
data.results.review.statusDate	object	Response data
data.results.review.statusInPortal	string	Response data
data.results.review.status	string	Response data
data.results.review.noteDate	object	Response data
data.results.review.statusChangeBy	object	Response data
data.results.review.noteAuthor	object	Response data
data.results.review.note	object	Response data
data.results.url	string	Response data
data.results.rule	object	Response data
data.results.rule.name	string	Response data
data.results.rule.url	string	Response data
data.results.rule.owner_id	string	Response data
data.results.rule.owner_name	string	Response data
data.results.rule.id	string	Response data
data.results.rule.organisation_name	string	Response data
data.results.rule.organisation_id	string	Response data
data.results.triggered	string	Response data
data.results.id	string	Response data
data.results.title	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 14:10:44 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node0ycr5u0bob499jeiki407m61f3902973.node0...

Search Alert by ID

Retrieve detailed information for a specific alert in Recorded Future using its unique alert ID.

Endpoint

URL: /v3/alerts/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Alert ID
parameters.fields	string	Optional	Fields to include ai_insights, hits, id, log, owner_organisation_details, review, rule, title, type, url
parameters.taggedText	boolean	Optional	Parameters for the Search Alert by ID action

Input Example

{"parameters":{"fields":"hits","taggedText":false},"path_parameters":{"id":"lWjyiz"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.hits	array	Response data
data.hits.entities	array	Response data
data.hits.entities.id	string	Response data
data.hits.entities.name	string	Response data
data.hits.entities.type	string	Response data
data.hits.document	object	Response data
data.hits.document.source	object	Response data
data.hits.document.source.id	string	Response data
data.hits.document.source.name	string	Response data
data.hits.document.source.type	string	Response data
data.hits.document.title	string	Response data
data.hits.document.url	object	Response data
data.hits.document.authors	array	Response data
data.hits.document.authors.file_name	string	Response data
data.hits.document.authors.file	string	Response data
data.hits.fragment	string	Response data
data.hits.id	string	Response data
data.hits.language	string	Response data
data.hits.primary_entity	object	Response data
data.hits.primary_entity.id	string	Response data
data.hits.primary_entity.name	string	Response data
data.hits.primary_entity.type	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 01 Feb 2024 09:11:22 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","content-security-policy":"default-src 'self' data:; img-src 'self'...

Search Alert Rules

Retrieve a list of alert rules from Recorded Future based on specified criteria to support targeted security responses.

Endpoint

URL: /v2/alert/rule

Method: GET

Input

Argument Name	Type	Required	Description
parameters.freetext	string	Optional	Parameters for the Search Alert Rules action
parameters.limit	number	Optional	Parameters for the Search Alert Rules action
parameters.taggedText	boolean	Optional	Parameters for the Search Alert Rules action

Input Example

{"parameters":{"freetext":"","limit":10,"taggedText":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.results	array	Response data
data.results.intelligence_goals	array	Response data
data.results.intelligence_goals.file_name	string	Response data
data.results.intelligence_goals.file	string	Response data
data.results.priority	boolean	Response data
data.results.tags	array	Response data
data.results.tags.file_name	string	Response data
data.results.tags.file	string	Response data
data.results.use_case_id	object	Response data
data.results.id	string	Response data
data.results.owner	object	Response data
data.results.owner.name	string	Response data
data.results.owner.id	string	Response data
data.results.title	string	Response data
data.results.created	string	Response data
data.results.notification_settings	object	Response data
data.results.notification_settings.email_subscribers	array	Response data
data.results.notification_settings.email_subscribers.file_name	string	Response data
data.results.notification_settings.email_subscribers.file	string	Response data
data.results.notification_settings.mobile_subscribers	array	Response data
data.results.notification_settings.mobile_subscribers.file_name	string	Response data
data.results.notification_settings.mobile_subscribers.file	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 17:03:37 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node017juks5vmnh5k1rk5152a1k3et4022289.nod...

Search Alerts

Retrieve triggered alerts from Recorded Future based on specified criteria to support threat analysis and incident response workflows.

Endpoint

URL: /v3/alerts/

Method: GET

Input

Argument Name	Type	Required	Description
parameters.triggered	string	Optional	Filter on triggered timestamp, using time queries and ranges
parameters.assignee	string	Optional	Assignee email, or 'NONE' to match notifications without an assignee
parameters.statusInPortal	string	Optional	Filter on status (as used in the portal)
parameters.alertRule	string	Optional	Filter on alert rule ID
parameters.freetext	string	Optional	Freetext search
parameters.limit	number	Optional	Maximum number of references from which notes are fetched, at most 1000.
parameters.from	number	Optional	Offset from first result. The API may only return the first 1000 results, meaning limit + from cannot exceed 1000.
parameters.taggedText	boolean	Optional	Enables tags in text fragments
parameters.orderby	string	Optional	Sort order
parameters.direction	string	Optional	Sort direction
parameters.fields	string	Optional	Fields to include ai_insights, hits, id, log, owner_organisation_details, review, rule, title, type, url

Input Example

{"parameters":{"triggered":"2024-01-31T20:36:31.757Z","assignee":"new","statusInPortal":"New","alertRule":"string","freetext":"string","limit":10,"from":1,"taggedText":false,"orderby":"triggered","direction":"asc","fields":"hits"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.file_name	string	Response data
data.file	string	Response data
counts	object	Output field: counts
counts.returned	number	Output field: counts.returned
counts.total	number	Output field: counts.total

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 01 Feb 2024 08:57:04 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","content-security-policy":"default-src 'self' data:; img-src 'self'...

Search Alerts Hits

Retrieve data hits from Recorded Future Intelligence Cloud that triggered alerts, filtered by specified alert IDs.

Endpoint

URL: /v3/alerts/hits

Method: GET

Input

Argument Name	Type	Required	Description
parameters.ids	string	Required	Alert IDs separated by comma
parameters.taggedText	boolean	Optional	Parameters for the Search Alerts Hits action

Input Example

{"parameters":{"ids":"report:hjeFxU","taggedText":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.document	object	Response data
data.document.source	object	Response data
data.document.source.id	string	Response data
data.document.source.name	string	Response data
data.document.source.type	string	Response data
data.document.title	string	Response data
data.document.url	object	Response data
data.document.authors	array	Response data
data.document.authors.file_name	string	Response data
data.document.authors.file	string	Response data
data.fragment	string	Response data
data.id	string	Response data
data.language	string	Response data
data.index	number	Response data
data.entities	array	Response data
data.entities.id	string	Response data
data.entities.name	string	Response data
data.entities.type	string	Response data
data.alert_id	string	Response data
data.primary_entity	object	Response data
data.primary_entity.id	string	Response data
data.primary_entity.name	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 01 Feb 2024 09:04:01 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","content-security-policy":"default-src 'self' data:; img-src 'self'...

Search Update Alert

Update the assignee, status, and notes for Recorded Future alerts by providing the required information in a JSON body.

Endpoint

URL: /v2/alert/update

Method: POST

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
success	array	Whether the operation was successful
success.id	string	Unique identifier
success.status	string	Status value
success.statusInPortal	string	Status value
error	array	Error message if any
error.file_name	string	Name of the resource
error.file	string	Error message if any

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 01 Feb 2024 11:24:41 GMT","Content-Type":"application/json;charset=utf-8","Content-Length":"93","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","content-security-policy":"default-src 'self' data:; img-src 'self' https: ...

URL Lookup

Retrieve threat intelligence data for a specified URL from Recorded Future using the provided URL as a path parameter.

Endpoint

URL: v2/url/{{url}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.url	string	Required	Parameters for the URL Lookup action
parameters.fields	array	Optional	Parameters for the URL Lookup action
parameters.metadata	boolean	Optional	Parameters for the URL Lookup action
parameters.comment	string	Optional	Parameters for the URL Lookup action

Input Example

{"parameters":{"fields":["analystNotes","counts","enterpriseLists","entity","links","metrics","relatedEntities","risk","riskMapping","sightings","timestamps"],"metadata":true,"comment":"any comment"},"path_parameters":{"url":"http://www.swimlane.com"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.analystNotes	array	Response data
data.analystNotes.file_name	string	Response data
data.analystNotes.file	string	Response data
metadata	object	Response data
metadata.entries	array	Response data
metadata.entries.key	string	Response data
metadata.entries.label	string	Response data
metadata.entries.item	object	Response data
metadata.entries.item.entries	array	Response data
metadata.entries.item.entries.key	string	Response data
metadata.entries.item.entries.label	string	Response data
metadata.entries.item.entries.type	string	Response data
metadata.entries.item.entries.item	object	Response data
metadata.entries.item.entries.entries	array	Response data
metadata.entries.item.type	string	Response data
metadata.entries.type	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 15:13:36 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node018jn9idiwhfc2qk90vm793phq3945028.node...

Response Headers

Header	Description	Example
cache-control	Directives for caching mechanisms	no-cache, no-store, private, must-revalidate, max-age=0, no-transform
CF-Cache-Status	HTTP response header: CF-Cache-Status	DYNAMIC
CF-RAY	HTTP response header: CF-RAY	774efe7a09630124-GRU
Connection	HTTP response header: Connection	keep-alive
content-encoding	HTTP response header: content-encoding	gzip
Content-Length	The length of the response body in bytes	1929
content-security-policy	HTTP response header: content-security-policy	default-src 'self' data:; img-src 'self' https: data: blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' fonts.googleapis.com cdn.jsdelivr.net; font-src 'self' fonts.gstatic.com; worker-src blob:;
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Mon, 05 Dec 2022 15:20:06 GMT
expires	The date/time after which the response is considered stale	Thu, 01 Jan 1970 00:00:00 GMT
pragma	HTTP response header: pragma	no-cache
Server	Information about the software used by the origin server	cloudflare
set-cookie	HTTP response header: set-cookie	JSESSIONID=node016hnx3pnie7pf1tvh7j74fpyza3994472.node0; Path=/rfq; Secure; HttpOnly
strict-transport-security	HTTP response header: strict-transport-security	max-age=31536000; includeSubDomains
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
x-content-type-options	HTTP response header: x-content-type-options	nosniff