--- title: Recorded Future slug: connectors/recorded-future docTags: createdAt: 2026-06-09T16:30:23.847Z --- Recorded Future is a threat intelligence platform that aggregates and analyzes data from diverse sources to provide actionable insights for identifying and mitigating cyber threats. Recorded Future is a leading threat intelligence platform that aggregates and analyzes data from open, dark web, and technical sources to deliver actionable security insights. This connector enables Swimlane Turbine users to automate enrichment of indicators of compromise (IOCs), retrieve real-time threat intelligence on domains, IPs, hashes, URLs, vulnerabilities, and identities, and manage alert workflows directly within their security automation playbooks. By integrating Recorded Future with Swimlane Turbine, security teams can accelerate threat detection, prioritize and respond to incidents, and proactively mitigate risks using up-to-date intelligence. This integration empowers analysts to streamline investigations, automate alert triage, and enhance their organization’s security posture with minimal manual effort. ## Prerequisites Before using the Recorded Future connector, ensure you have the following prerequisites: - API Key Authentication is required to access Recorded Future services: - URL: The base endpoint for accessing the Recorded Future API. - API Token: A valid API token issued by Recorded Future for authenticating requests. ## Limitations None to date. ### Supported Versions This connector uses the "Connect API" from Recorded Future. Actions use V2 unless otherwise noted. ### Additional Docs - [Recorded Future Connect API](https://api.recordedfuture.com/v2/) - [rfapi-python](https://github.com/recordedfuture/rfapi-python) ## Configuration ### Authentication Methods ### API Key Authentication: - URL: The endpoint for the Recorded Future API. - API Token: Your unique authentication token to access the Recorded Future API. ## Capabilities **Important:** Use *Bulk IOC Enrichment* when looking up multiple IOCs. The Recorded Future connector has the following capabilities: - Bulk IOC Enrichment - Search Alert Rules - Search Alert - Search Alert Hits - Search Alert by ID - Search Update Alert - Get Alert from an Alert Rule - Search for an Alert from an Alert Rule - Lookup Alert Notification - Get Domain Risk List - List Domain Risk Rules - Get Hash Risk List - List Hash Risk Rules - Get IP Risk List - List IP Risk Rules *... and so on* ### Bulk IOC Enrichment This endpoint is designed for high volume lookups of entities. Recorded Future's documentation for this action can be found [here](https://api.recordedfuture.com/v2/#!/SOAR/SOAR_lookup_of_entities). ### Search Alert Rules Recorded Future's documentation for this action can be found [here](https://api.recordedfuture.com/v2/#!/Alerts/Alert_Rule_Search). ### Search Alert Hits This action uses the V3 API. Recorded Future's documentation for this action can be found [here](https://api.recordedfuture.com/v2/#!/Alerts/Alert_Notification_Hits_Lookup). ### Search Alert by ID This action uses the V3 API. Recorded Future's documentation for this action can be found [here](https://api.recordedfuture.com/v2/#!/Alerts/Alert_Notification_Lookup). ### Search Update Alert Recorded Future's documentation for this action can be found [here](https://api.recordedfuture.com/v2/#!/Alerts/Alert_Notification_Update). ### Search Alert **Note:** This action uses a deprecated API endpoint. It is recommended to use the v3 API endpoint for alert searches. Recorded Future's documentation for the deprecated action can be found [here](https://api.recordedfuture.com/v2/#!/Alerts/Search_Alert_Notifications). The v3 API documentation can be found [here](https://api.recordedfuture.com/v2/#!/Alerts/Triggered_Alerts). ### Get Alert from an Alert Rule This action uses the v3 API. You can retrieve alerts associated with a specific alert rule by using the `alertRule` parameter. Recorded Future's documentation for this action can be found [here](https://api.recordedfuture.com/v2/#!/Alerts/Alert_Notification_Search). ### Search for an Alert from an Alert Rule This action uses the v3 API. You can search for alerts associated with a specific alert rule by specifying the `alertRule` parameter. Recorded Future's documentation for this action can be found [here](https://api.recordedfuture.com/v2/#!/Alerts/Alert_Notification_Search). ### Lookup Alert Notification **Note:** This action uses the v2 API endpoint. Recorded Future's documentation for this action can be found [here](https://api.recordedfuture.com/v2/#!/Alerts/Lookup_Alert_Notification). ### Get Domain Risk List You can download the domain risk list in various formats such as CSV or Splunk, and choose to receive it compressed using gzip. Recorded Future's documentation for this action can be found [here](https://api.recordedfuture.com/v2/#!/Domain/Domain_Risk_Lists). ### List Domain Risk Rules Recorded Future's documentation for this action can be found [here](https://api.recordedfuture.com/v2/#!/Domain/Domain_Risk_Rules). ### Get Hash Risk List You can download the hash risk list in various formats such as CSV or Splunk, and choose to receive it compressed using gzip. Recorded Future's documentation for this action can be found [here](https://api.recordedfuture.com/v2/#!/Hash/Hash_Risk_Lists). ### List Hash Risk Rules Recorded Future's documentation for this action can be found [here](https://api.recordedfuture.com/v2/#!/Hash/Hash_Risk_Rules). ### Get IP Risk List You can download the IP address risk list in various formats such as CSV or Splunk, and choose to receive it compressed using gzip. Recorded Future's documentation for this action can be found [here](https://api.recordedfuture.com/v2/#!/IP/IP_Address_Risk_Lists). ### List IP Risk Rules Recorded Future's documentation for this action can be found [here](https://api.recordedfuture.com/v2/#!/IP/IP_Address_Risk_Rules). ### Lookup (URL, IP, Hash, and Domain lookups) These actions allow you to retrieve detailed intelligence on specific entities such as URLs, IP addresses, hashes, and domains. Recorded Future's documentation for these actions can be found at: - **Lookup URL:** [here](https://api.recordedfuture.com/v2/#!/URL/Lookup_URL) - **Lookup IP Address:** [here](https://api.recordedfuture.com/v2/#!/IP/Lookup_IP_Address) - **Lookup Hash:** [here](https://api.recordedfuture.com/v2/#!/Hash/Lookup_Hash) - **Lookup Domain:** [here](https://api.recordedfuture.com/v2/#!/Domain/Lookup_Domain) ### Get URL Risk List You can download the URL risk list in various formats such as CSV or Splunk, and choose to receive it compressed using gzip. Recorded Future's documentation for this action can be found [here](https://api.recordedfuture.com/v2/#!/URL/URL_Risk_Lists). ### List URL Risk Rules Recorded Future's documentation for this action can be found [here](https://api.recordedfuture.com/v2/#!/URL/URL_Risk_Rules). ### Lookup Vulnerability Recorded Future's documentation for this action can be found [here](https://api.recordedfuture.com/v2/#!/Vulnerability/Vulnerability_Lookup). ### Get Vulnerability Risk List You can download the vulnerability risk list in various formats such as CSV or Splunk+CPE, and choose to receive it compressed using gzip. Recorded Future's documentation for this action can be found [here](https://api.recordedfuture.com/v2/#!/Vulnerability/Vulnerability_Risk_Lists). ### List Vulnerability Risk Rules Recorded Future's documentation for this action can be found [here](https://api.recordedfuture.com/v2/#!/Vulnerability/Vulnerability_Risk_Rules). ### Get Credentials Leaked This action allows you to retrieve references related to exposed credentials for a company. You can filter the results by risk category, such as `exposedCredential`, to focus on leaked credentials. Recorded Future's documentation for this action can be found [here](https://api.recordedfuture.com/v2/#!/Company/Company_References). ### Query IP Extensions This action retrieve extended details for an IP address, including specified extensions from the Recorded Future. Recorded Future's documentation for this action can be found [here](https://api.recordedfuture.com/v2/#!/IP/Ip_Address_Extension_Lookup). ### Identity Detections Retrieve credential exposures classified as External or Workforce from breach dumps and stealer logs. Recorded Future's documentation for this action can be found [here](https://docs.recordedfuture.com/reference/identity-detections) ### Identity Incident Report Generate an incident report for a stealer malware infection with all harvested credentials and machine context. Recorded Future's documentation for this action can be found [here](https://docs.recordedfuture.com/reference/identity-incident-report) ### Identity Hostname lookup Retrieve all stolen credentials from a compromised machine by its Windows computer name. Recorded Future's documentation for this action can be found [here](https://docs.recordedfuture.com/reference/identity-hostname) ### Identity IP Lookup Retrieve stolen credentials by the compromised machine's IP address or range at time of infection. Recorded Future's documentation for this action can be found [here](https://docs.recordedfuture.com/reference/identity-ip) ### Identity Password lookup Check whether password hashes appear in breach data or stealer logs, with k-anonymity prefix support. Recorded Future's documentation for this action can be found [here](https://docs.recordedfuture.com/reference/identity-password) ### Identity Dump metadata search Search metadata for data dumps and breach databases by name. Recorded Future's documentation for this action can be found [here](https://docs.recordedfuture.com/reference/identity-dump-metadata) # Configurations ## API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | apikey | API key | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Alert Lookup Retrieve detailed information for a specific alert in Recorded Future using its unique alert ID. ### Endpoint - **URL:** `v2/alert/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | -------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Alert Lookup action | | `parameters.taggedText` | boolean | Optional | Parameters for the Alert Lookup action | ### Input Example `{"parameters":{"taggedText":true},"path_parameters":{"id":"lWjyiz"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.review` | object | Response data | | `data.review.assignee` | object | Response data | | `data.review.statusDate` | object | Response data | | `data.review.statusInPortal` | string | Response data | | `data.review.status` | string | Response data | | `data.review.noteDate` | object | Response data | | `data.review.statusChangeBy` | object | Response data | | `data.review.noteAuthor` | object | Response data | | `data.review.note` | object | Response data | | `data.entities` | array | Response data | | `data.entities.trend` | object | Response data | | `data.entities.documents` | array | Response data | | `data.entities.documents.file_name` | string | Response data | | `data.entities.documents.file` | string | Response data | | `data.entities.risk` | object | Response data | | `data.entities.risk.criticalityLabel` | string | Response data | | `data.entities.risk.score` | object | Response data | | `data.entities.risk.documents` | array | Response data | | `data.entities.risk.documents.source` | object | Response data | | `data.entities.risk.documents.url` | object | Response data | | `data.entities.risk.documents.references` | array | Response data | | `data.entities.risk.documents.authors` | array | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 16:35:06 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node016hnx3pnie7pf1tvh7j74fpyza3994472.nod...` ## Bulk IOC Enrichment Enrich multiple Indicators of Compromise at once using Recorded Future's threat intelligence to provide comprehensive security insights. ### Endpoint - **URL:** `v2/soar/enrichment` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------------- | | `ip` | array | Optional | Parameter for Bulk IOC Enrichment | | `domain` | array | Optional | Parameter for Bulk IOC Enrichment | | `url` | array | Optional | URL endpoint for the request | | `hash` | array | Optional | Parameter for Bulk IOC Enrichment | | `vulnerability` | array | Optional | Parameter for Bulk IOC Enrichment | ### Input Example `{"json_body":{"ip":["1.0.0.0"],"domain":["www.swimlane.com"],"url":["https://www.swimlane.com"],"hash":["bdb237bf8c5de6b60ba1e2dcfe364fc24f583e568d1682f851a9d0f11a45c78d"],"vulnerability":["Zs4cBI"]}}` ## Domain Lookup Retrieve detailed threat intelligence for a specified domain from Recorded Future using the domain as a path parameter. ### Endpoint - **URL:** `v2/domain/{{domain}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | --------------------------------------- | | `path_parameters.domain` | string | Required | Parameters for the Domain Lookup action | | `parameters.fields` | array | Optional | Parameters for the Domain Lookup action | | `parameters.metadata` | boolean | Optional | Parameters for the Domain Lookup action | | `parameters.comment` | string | Optional | Parameters for the Domain Lookup action | ### Input Example `{"parameters":{"fields":["analystNotes","counts","enterpriseLists","entity","intelCard","links","metrics","relatedEntities","risk","riskMapping","sightings","threatLists","timestamps"],"metadata":true,"comment":"any comment"},"path_parameters":{"domain":"www.swimlane.com"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.analystNotes` | array | Response data | | `data.analystNotes.file_name` | string | Response data | | `data.analystNotes.file` | string | Response data | | `metadata` | object | Response data | | `metadata.entries` | array | Response data | | `metadata.entries.key` | string | Response data | | `metadata.entries.label` | string | Response data | | `metadata.entries.item` | object | Response data | | `metadata.entries.item.entries` | array | Response data | | `metadata.entries.item.entries.key` | string | Response data | | `metadata.entries.item.entries.label` | string | Response data | | `metadata.entries.item.entries.type` | string | Response data | | `metadata.entries.item.entries.item` | object | Response data | | `metadata.entries.item.entries.entries` | array | Response data | | `metadata.entries.item.type` | string | Response data | | `metadata.entries.type` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 15:20:06 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node0fd5obnu48hcl16apr2ibzkyva3942193.node...` ## Get Domain Risk List Retrieve a list of domain risks from Recorded Future to identify potential threats and vulnerabilities associated with specific domains. ### Endpoint - **URL:** `v2/domain/risklist` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ---------------------------------------------- | | `parameters.format` | string | Optional | Parameters for the Get Domain Risk List action | | `parameters.gzip` | boolean | Optional | Parameters for the Get Domain Risk List action | | `parameters.list` | string | Optional | Parameters for the Get Domain Risk List action | ### Input Example `{"parameters":{"format":"csv/splunk","gzip":true,"list":"actorinfrastructure"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ------------------------- | | `attachments` | object | Output field: attachments | ### Output Example `{"attachments":{}}` ## Get Domain Risk Rules Retrieve risk rules for domains from Recorded Future to identify potential threats and assess associated security risks. ### Endpoint - **URL:** `v2/domain/riskrules` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.results` | array | Response data | | `data.results.criticalityLabel` | string | Response data | | `data.results.description` | string | Response data | | `data.results.criticality` | number | Response data | | `data.results.relatedEntities` | array | Response data | | `data.results.relatedEntities.file_name` | string | Response data | | `data.results.relatedEntities.file` | string | Response data | | `data.results.name` | string | Response data | | `data.results.count` | number | Response data | | `data.results.categories` | array | Response data | | `data.results.categories.name` | string | Response data | | `data.results.categories.framework` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 21:30:36 GMT","Content-Type":"application/json;charset=utf-8","Content-Length":"1929","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node017j68k3iqy4rm1f6fz8x1eq424168935.node0; Pat...` ## Get Hash Risk List Retrieve a list of hash risk assessments from Recorded Future to gain insights into potential security threats. ### Endpoint - **URL:** `v2/hash/risklist` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | -------------------------------------------- | | `parameters.format` | string | Optional | Parameters for the Get Hash Risk List action | | `parameters.gzip` | boolean | Optional | Parameters for the Get Hash Risk List action | | `parameters.list` | string | Optional | Parameters for the Get Hash Risk List action | ### Input Example `{"parameters":{"format":"csv/splunk","gzip":true,"list":"large"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ------------------------- | | `attachments` | object | Output field: attachments | ### Output Example `{"attachments":{}}` ## Get Hash Risk Rules Retrieve risk rules linked to a specific hash from Recorded Future to support threat assessment and prioritization. ### Endpoint - **URL:** `v2/hash/riskrules` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.results` | array | Response data | | `data.results.criticalityLabel` | string | Response data | | `data.results.description` | string | Response data | | `data.results.categories` | array | Response data | | `data.results.categories.name` | string | Response data | | `data.results.categories.framework` | string | Response data | | `data.results.criticality` | number | Response data | | `data.results.relatedEntities` | array | Response data | | `data.results.relatedEntities.file_name` | string | Response data | | `data.results.relatedEntities.file` | string | Response data | | `data.results.name` | string | Response data | | `data.results.count` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 21:18:14 GMT","Content-Type":"application/json;charset=utf-8","Content-Length":"827","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node01snqb93wfqqnebjs4mrvs63ig4157334.node0; Path...` ## Get Identities | Lookup Subjects Retrieve identities linked to specified subjects in Recorded Future using the provided JSON body. ### Endpoint - **URL:** `identity/credentials/lookup` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | | ----------------------------------- | -------- | ------------ | ---------------------------- | --------------- | | `subjects` | array | Optional | Parameter for Get Identities | Lookup Subjects | | `subjects_sha1` | array | Optional | Parameter for Get Identities | Lookup Subjects | | `subjects_login` | array | Optional | Parameter for Get Identities | Lookup Subjects | | `subjects_login.login` | string | Optional | Parameter for Get Identities | Lookup Subjects | | `subjects_login.login_sha1` | string | Optional | Parameter for Get Identities | Lookup Subjects | | `subjects_login.domain` | string | Optional | Parameter for Get Identities | Lookup Subjects | | `filter` | object | Optional | Parameter for Get Identities | Lookup Subjects | | `filter.first_downloaded_gte` | string | Optional | Parameter for Get Identities | Lookup Subjects | | `filter.latest_downloaded_gte` | string | Optional | Parameter for Get Identities | Lookup Subjects | | `filter.exfiltration_date_gte` | string | Optional | Parameter for Get Identities | Lookup Subjects | | `filter.properties` | array | Optional | Parameter for Get Identities | Lookup Subjects | | `filter.breach_properties` | object | Optional | Parameter for Get Identities | Lookup Subjects | | `filter.breach_properties.name` | string | Optional | Name of the resource | | | `filter.breach_properties.date` | string | Optional | Date value | | | `filter.dump_properties` | object | Optional | Parameter for Get Identities | Lookup Subjects | | `filter.dump_properties.name` | string | Optional | Name of the resource | | | `filter.dump_properties.date` | string | Optional | Date value | | | `filter.username_properties` | array | Optional | Name of the resource | | | `filter.authorization_technologies` | array | Optional | Parameter for Get Identities | Lookup Subjects | | `filter.authorization_protocols` | array | Optional | Parameter for Get Identities | Lookup Subjects | ### Input Example `{"json_body":{"subjects":["alex.payte@recordedfuture.com"],"subjects_sha1":["string"],"subjects_login":[{"login":"string","login_sha1":"string","domain":"string"}],"filter":{"first_downloaded_gte":"2022-12-05T22:00:58.463Z","latest_downloaded_gte":"2022-12-05T22:00:58.463Z","exfiltration_date_gte":"2022-12-05T22:00:58.463Z","properties":["Letter"],"breach_properties":{"name":"string","date":"2022-12-05T22:00:58.463Z"},"dump_properties":{"name":"string","date":"2022-12-05T22:00:58.463Z"},"username_properties":["Email"],"authorization_technologies":["string"],"authorization_protocols":["string"]}}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `identities` | array | Unique identifier | | `identities.identity` | object | Unique identifier | | `identities.identity.subjects` | array | Unique identifier | | `identities.count` | number | Unique identifier | | `identities.credentials` | array | Unique identifier | | `identities.credentials.subject` | string | Unique identifier | | `identities.credentials.dumps` | array | Unique identifier | | `identities.credentials.dumps.name` | string | Unique identifier | | `identities.credentials.dumps.description` | string | Unique identifier | | `identities.credentials.dumps.downloaded` | string | Unique identifier | | `identities.credentials.dumps.type` | string | Unique identifier | | `identities.credentials.dumps.breaches` | array | Unique identifier | | `identities.credentials.dumps.breaches.name` | string | Unique identifier | | `identities.credentials.dumps.breaches.domain` | string | Unique identifier | | `identities.credentials.dumps.breaches.type` | string | Unique identifier | | `identities.credentials.dumps.breaches.breached` | string | Unique identifier | | `identities.credentials.dumps.breaches.start` | string | Unique identifier | | `identities.credentials.dumps.breaches.stop` | string | Unique identifier | | `identities.credentials.dumps.breaches.precision` | string | Unique identifier | | `identities.credentials.dumps.breaches.description` | string | Unique identifier | | `identities.credentials.dumps.breaches.site_description` | string | Unique identifier | | `identities.credentials.dumps.infrastructure` | object | Unique identifier | | `identities.credentials.dumps.infrastructure.ip` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 22:12:05 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","CF-Cache-Status":"DYNAMIC","Strict-Transport-Security":"max-age=31536000; includeSubDomains","Server":"cloudflare","CF-RAY":"77501f0adb016b1a-GRU","Content-Encoding":"gzip"},"reason":"OK","json_body":{"identities":[{}],"count":1}}` ## Get Identities | Search Domains Retrieve identity information for specified domains from Recorded Future using advanced search parameters in a customizable JSON body. ### Endpoint - **URL:** `identity/credentials/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | | ----------------------------------- | -------- | ------------ | ---------------------------- | -------------- | | `domains` | array | Optional | Parameter for Get Identities | Search Domains | | `domain_types` | array | Optional | Type of the resource | | | `filter` | object | Optional | Parameter for Get Identities | Search Domains | | `filter.first_downloaded_gte` | string | Optional | Parameter for Get Identities | Search Domains | | `filter.latest_downloaded_gte` | string | Optional | Parameter for Get Identities | Search Domains | | `filter.exfiltration_date_gte` | string | Optional | Parameter for Get Identities | Search Domains | | `filter.properties` | array | Optional | Parameter for Get Identities | Search Domains | | `filter.breach_properties` | object | Optional | Parameter for Get Identities | Search Domains | | `filter.breach_properties.name` | string | Optional | Name of the resource | | | `filter.breach_properties.date` | string | Optional | Date value | | | `filter.dump_properties` | object | Optional | Parameter for Get Identities | Search Domains | | `filter.dump_properties.name` | string | Optional | Name of the resource | | | `filter.dump_properties.date` | string | Optional | Date value | | | `filter.username_properties` | array | Optional | Name of the resource | | | `filter.authorization_technologies` | array | Optional | Parameter for Get Identities | Search Domains | | `filter.authorization_protocols` | array | Optional | Parameter for Get Identities | Search Domains | | `offset` | string | Optional | Parameter for Get Identities | Search Domains | | `limit` | number | Optional | Parameter for Get Identities | Search Domains | ### Input Example `{"json_body":{"domains":["string"],"domain_types":["Authorization"],"filter":{"first_downloaded_gte":"2022-12-05T22:20:25.745Z","latest_downloaded_gte":"2022-12-05T22:20:25.745Z","exfiltration_date_gte":"2022-12-05T22:20:25.745Z","properties":["Letter"],"breach_properties":{"name":"string","date":"2022-12-05T22:20:25.745Z"},"dump_properties":{"name":"string","date":"2022-12-05T22:20:25.745Z"},"username_properties":["Email"],"authorization_technologies":["string"],"authorization_protocols":["string"]},"offset":"string","limit":0}}` ## Get IP Risk List Retrieve a list of IP addresses with risk scores from Recorded Future to support enhanced threat analysis and informed security decisions. ### Endpoint - **URL:** `v2/ip/risklist` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------ | | `parameters.format` | string | Optional | Parameters for the Get IP Risk List action | | `parameters.gzip` | boolean | Optional | Parameters for the Get IP Risk List action | | `parameters.list` | string | Optional | Parameters for the Get IP Risk List action | ### Input Example `{"parameters":{"format":"csv/splunk","gzip":true,"list":"actorinfrastructure"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ------------------------- | | `attachments` | object | Output field: attachments | ### Output Example `{"attachments":{}}` ## Get URL Risk List Retrieve a list of URLs with associated risk scores from Recorded Future to help prioritize and respond to potential threats efficiently. ### Endpoint - **URL:** `v2/url/risklist` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------- | | `parameters.format` | string | Optional | Parameters for the Get URL Risk List action | | `parameters.gzip` | boolean | Optional | Parameters for the Get URL Risk List action | | `parameters.list` | string | Optional | Parameters for the Get URL Risk List action | ### Input Example `{"parameters":{"format":"csv/splunk","gzip":true,"list":"actorinfrastructure"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ------------------ | | `file` | array | Output field: file | ### Output Example `{"file":{"filename":"Example Name","file_data":"string"}}` ## Get URL Risk Rules Retrieve a list of risk rules applied to URLs in Recorded Future to support enhanced threat analysis and informed security decisions. ### Endpoint - **URL:** `v2/url/riskrules` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.results` | array | Response data | | `data.results.criticalityLabel` | string | Response data | | `data.results.description` | string | Response data | | `data.results.criticality` | number | Response data | | `data.results.relatedEntities` | array | Response data | | `data.results.relatedEntities.file_name` | string | Response data | | `data.results.relatedEntities.file` | string | Response data | | `data.results.name` | string | Response data | | `data.results.count` | number | Response data | | `data.results.categories` | array | Response data | | `data.results.categories.name` | string | Response data | | `data.results.categories.framework` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 18:55:05 GMT","Content-Type":"application/json;charset=utf-8","Content-Length":"1115","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node01ntljhka8cig2g8w9rk2sb7gn4079571.node0; Pat...` ## Get Vulnerability Risk List Retrieve and prioritize vulnerabilities with risk scores from Recorded Future to enhance your organization's security posture. ### Endpoint - **URL:** `v2/vulnerability/risklist` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ----------------------------------------------------- | | `parameters.format` | string | Optional | Parameters for the Get Vulnerability Risk List action | | `parameters.gzip` | boolean | Optional | Parameters for the Get Vulnerability Risk List action | | `parameters.list` | string | Optional | Parameters for the Get Vulnerability Risk List action | ### Input Example `{"parameters":{"format":"csv/splunk","gzip":true,"list":"actorinfrastructure"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ------------------------- | | `attachments` | object | Output field: attachments | ### Output Example `{"attachments":{}}` ## Get Vulnerability Risk Rules Retrieve a list of vulnerability risk rules from Recorded Future to enhance security insights. ### Endpoint - **URL:** `v2/vulnerability/riskrules` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.results` | array | Response data | | `data.results.criticalityLabel` | string | Response data | | `data.results.description` | string | Response data | | `data.results.categories` | array | Response data | | `data.results.categories.name` | string | Response data | | `data.results.categories.framework` | string | Response data | | `data.results.criticality` | number | Response data | | `data.results.relatedEntities` | array | Response data | | `data.results.relatedEntities.file_name` | string | Response data | | `data.results.relatedEntities.file` | string | Response data | | `data.results.name` | string | Response data | | `data.results.count` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 21:39:33 GMT","Content-Type":"application/json;charset=utf-8","Content-Length":"1326","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node0bno2qyhegmod18z4qv5haifgh4167508.node0; Pat...` ## Hash Lookup Retrieve threat intelligence details for a specified hash from Recorded Future using the hash as a path parameter. ### Endpoint - **URL:** `v2/hash/{{hash}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ------------------------------------- | | `path_parameters.hash` | string | Required | Parameters for the Hash Lookup action | | `parameters.fields` | array | Optional | Parameters for the Hash Lookup action | | `parameters.metadata` | boolean | Optional | Parameters for the Hash Lookup action | | `parameters.comment` | string | Optional | Parameters for the Hash Lookup action | ### Input Example `{"parameters":{"fields":["analystNotes","counts","enterpriseLists","entity","fileHashes","hashAlgorithm","intelCard","links","metrics","relatedEntities","risk","riskMapping","sightings","threatLists","timestamps"],"metadata":true,"comment":"any comment"},"path_parameters":{"hash":"bdb237bf8c5de6b60ba1e2dcfe364fc24f583e568d1682f851a9d0f11a45c78d"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.analystNotes` | array | Response data | | `data.analystNotes.file_name` | string | Response data | | `data.analystNotes.file` | string | Response data | | `metadata` | object | Response data | | `metadata.entries` | array | Response data | | `metadata.entries.key` | string | Response data | | `metadata.entries.label` | string | Response data | | `metadata.entries.item` | object | Response data | | `metadata.entries.item.entries` | array | Response data | | `metadata.entries.item.entries.key` | string | Response data | | `metadata.entries.item.entries.label` | string | Response data | | `metadata.entries.item.entries.type` | string | Response data | | `metadata.entries.item.entries.item` | object | Response data | | `metadata.entries.item.entries.entries` | array | Response data | | `metadata.entries.item.type` | string | Response data | | `metadata.entries.type` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 14:49:27 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node0zue821pxtbpm8k8iaalxgk8p3925540.node0...` ## Identity Detections Retrieve classified credential exposures from breach dumps and stealer logs in Recorded Future using a specified JSON body input. ### Endpoint - **URL:** `identity/detections` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------- | -------- | ------------ | -------------------------------------------------------------------- | | `filter` | object | Optional | Filter criteria to narrow down the detections returned by the query. | | `filter.detection_types` | array | Optional | Filter by detection type. | | `filter.novel_only` | boolean | Optional | Filter for novel detections that have not been previously observed. | | `filter.malware_only` | boolean | Optional | Filter for detections associated with malware. | | `filter.domains` | array | Optional | Filter by associated domains. | | `filter.source_type` | array | Optional | Filter by source type of the detection. | | `filter.detection_type` | string | Optional | Filter by detection type. | | `filter.authorization_technology` | object | Optional | Filter by associated authorization technologies. | | `filter.authorization_technology.any` | boolean | Optional | Match detections with any authorization technology. | | `filter.authorization_technology.id` | array | Optional | Filter by authorization technology ID. | | `filter.authorization_technology.name` | array | Optional | Filter by authorization technology name. | | `filter.cookies` | string | Optional | Filter for detections with unexpired cookies. | | `filter.created` | object | Optional | Filter by detection creation date. | | `filter.created.gte` | string | Optional | Filter for detections created on or after this date. | | `filter.created.lt` | string | Optional | Filter for detections created before this date. | | `organization_id` | array | Optional | Organization IDs to scope the detections query. | | `include_enterprise_level` | boolean | Optional | Include enterprise-level detections across all organizations. | | `limit` | number | Optional | Maximum number of detections to return. | | `offset` | string | Optional | Pagination token for next page. | ### Input Example `{"json_body":{"filter":{"detection_types":["External"],"novel_only":true,"malware_only":true,"domains":["example-corp.com"],"source_type":["MalwareLogs"],"detection_type":"External","authorization_technology":{"any":true,"id":["tech-okta-sso"],"name":["Okta Single Sign-On"]},"cookies":"UnexpiredCookies","created":{"gte":"2024-07-20T10:00:00Z","lt":"2024-07-25T10:00:00Z"}},"organization_id":["uhash:a1b2c3d4"],"include_enterprise_level":true,"limit":1000,"offset":"cD1lMzE5NTQ2OS1hYjYxLTQ1NTgtYjkyOC1iYjE3MWNkM2QyY2U"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------------ | -------- | ------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `total` | number | Output field: total | | `detections` | array | Output field: detections | | `detections.id` | string | Unique identifier | | `detections.type` | string | Type of the resource | | `detections.novel` | boolean | Output field: detections.novel | | `detections.source_type` | string | Type of the resource | | `detections.subject` | string | Output field: detections.subject | | `detections.password` | string | Output field: detections.password | | `detections.authorization_service` | object | Output field: detections.authorization\_service | | `detections.authorization_service.url` | string | URL endpoint for the request | | `detections.authorization_service.domain` | string | Output field: detections.authorization\_service.domain | | `detections.authorization_service.fqdn` | string | Output field: detections.authorization\_service.fqdn | | `detections.authorization_service.technology` | array | Output field: detections.authorization\_service.technology | | `detections.authorization_service.technology.name` | string | Name of the resource | | `detections.authorization_service.technology.id` | string | Unique identifier | | `detections.authorization_service.technology.category` | string | Output field: detections.authorization\_service.technology.category | | `detections.authorization_service.protocols` | array | Output field: detections.authorization\_service.protocols | | `detections.cookies` | array | Output field: detections.cookies | | `detections.cookies.dns` | string | Output field: detections.cookies.dns | | `detections.cookies.name` | string | Name of the resource | | `detections.cookies.http` | boolean | Output field: detections.cookies.http | | `detections.cookies.expiration` | string | Output field: detections.cookies.expiration | | `detections.cookies.secure` | boolean | Output field: detections.cookies.secure | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"total":10,"detections":[{}],"next_offset":"10"}}` ## Identity Dump Metadata Search Search for metadata on data dumps and breach databases in Recorded Future using criteria specified in a JSON body. ### Endpoint - **URL:** `identity/metadata/dump/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ---------------------------------------------------------------- | | `names` | array | Optional | List of dump or breach database names to search for in metadata. | | `limit` | number | Optional | Maximum number of results to return. | ### Input Example `{"json_body":{"names":["Collection 1"],"limit":1000}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | ------------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `dumps` | array | Output field: dumps | | `dumps.name` | string | Name of the resource | | `dumps.type` | string | Type of the resource | | `dumps.source` | string | Output field: dumps.source | | `dumps.description` | string | Output field: dumps.description | | `dumps.infrastructure` | object | Output field: dumps.infrastructure | | `dumps.infrastructure.ip` | string | Output field: dumps.infrastructure.ip | | `dumps.compromise` | object | Output field: dumps.compromise | | `dumps.compromise.os` | string | Output field: dumps.compromise.os | | `dumps.compromise.os_username` | string | Name of the resource | | `dumps.compromise.malware_file` | string | Output field: dumps.compromise.malware\_file | | `dumps.compromise.timezone` | string | Output field: dumps.compromise.timezone | | `dumps.compromise.computer_name` | string | Name of the resource | | `dumps.compromise.uac` | string | Output field: dumps.compromise.uac | | `dumps.compromise.antivirus` | array | Output field: dumps.compromise.antivirus | | `dumps.compromise.exfiltration_date` | string | Date value | | `dumps.location` | object | Output field: dumps.location | | `dumps.location.country` | object | Output field: dumps.location.country | | `dumps.location.country.name` | string | Name of the resource | | `dumps.location.country.displayName` | string | Name of the resource | | `dumps.location.country.countryCode` | string | Output field: dumps.location.country.countryCode | | `dumps.location.country.alpha2Code` | string | Output field: dumps.location.country.alpha2Code | | `dumps.location.country.alpha3Code` | string | Output field: dumps.location.country.alpha3Code | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"dumps":[{}]}}` ## Identity Hostname Lookup Retrieve all stolen credentials associated with a compromised machine by providing its hostname in Recorded Future. ### Endpoint - **URL:** `identity/hostname/lookup` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------- | | `organization_id` | string | Optional | Unique identifier for the organization to query within. | | `hostname` | string | Optional | Windows computer name to search for associated credentials. | | `filter` | object | Optional | Filter criteria to narrow down the credentials returned by the query. | | `filter.first_downloaded_gte` | string | Optional | Filter for credentials first downloaded on or after this date. | | `filter.latest_downloaded_gte` | string | Optional | Filter for credentials latest downloaded on or after this date. | | `filter.exfiltration_date_gte` | string | Optional | Filter for credentials with exfiltration date on or after this date. | | `filter.properties` | array | Optional | Filter for credentials that have specific properties, such as containing uppercase letters or being at least 8 characters long. | | `filter.username_properties` | array | Optional | Filter for credentials with specific username properties, such as being an email address. | | `filter.breach_properties` | object | Optional | Filter for credentials that were involved in breaches with specific properties, such as the breach name or date. | | `filter.breach_properties.name` | string | Optional | Filter for credentials involved in breaches with this name. | | `filter.breach_properties.date` | string | Optional | Filter for credentials involved in breaches that occurred on this date. | | `filter.dump_properties` | object | Optional | Filter for credentials that were found in dumps with specific properties, such as the dump name or date. | | `filter.dump_properties.name` | string | Optional | Filter for credentials found in dumps with this name. | | `filter.dump_properties.date` | string | Optional | Filter for credentials found in dumps that were published on this date. | | `filter.authorization_technologies` | array | Optional | Filter for credentials associated with specific authorization technologies, such as SAML or OAuth. | | `filter.authorization_protocols` | array | Optional | Filter for credentials associated with specific authorization protocols, such as RDP or SSH. | | `filter.malware_families` | array | Optional | Filter for credentials associated with specific malware families, such as RedLine Stealer or Vidar. | | `limit` | number | Optional | Maximum number of credentials to return. | | `offset` | string | Optional | Pagination token for next page of results. | ### Input Example `{"json_body":{"organization_id":"uhash:a1b2c3d4","hostname":"server-01.us.east","filter":{"first_downloaded_gte":"2024-01-01T00:00:00Z","latest_downloaded_gte":"2024-12-01T00:00:00Z","exfiltration_date_gte":"2024-01-01T00:00:00Z","properties":["UpperCase","AtLeast8Characters"],"username_properties":["Email"],"breach_properties":{"name":"ExampleCorp Breach 2024","date":"2024-03-15T00:00:00Z"},"dump_properties":{"name":"Collection","date":"2019-01-07T00:00:00Z"},"authorization_technologies":["SAML"],"authorization_protocols":["RDP"],"malware_families":["RedLine Stealer"]},"limit":1000,"offset":"cD1lMzE5NTQ2OS1hYjYxLTQ1NTgtYjkyOC1iYjE3MWNkM2QyY2U="}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `identities` | array | Unique identifier | | `identities.identity` | object | Unique identifier | | `identities.identity.subjects` | array | Unique identifier | | `identities.count` | number | Unique identifier | | `identities.credentials` | array | Unique identifier | | `identities.credentials.subject` | string | Unique identifier | | `identities.credentials.authorization_service` | object | Unique identifier | | `identities.credentials.authorization_service.url` | string | URL endpoint for the request | | `identities.credentials.authorization_service.domain` | string | Unique identifier | | `identities.credentials.authorization_service.fqdn` | string | Unique identifier | | `identities.credentials.authorization_service.protocols` | array | Unique identifier | | `identities.credentials.authorization_service.technology` | array | Unique identifier | | `identities.credentials.authorization_service.technology.id` | string | Unique identifier | | `identities.credentials.authorization_service.technology.name` | string | Unique identifier | | `identities.credentials.authorization_service.technology.category` | string | Unique identifier | | `identities.credentials.authorization_services` | array | Unique identifier | | `identities.credentials.authorization_services.url` | string | URL endpoint for the request | | `identities.credentials.authorization_services.domain` | string | Unique identifier | | `identities.credentials.authorization_services.fqdn` | string | Unique identifier | | `identities.credentials.authorization_services.protocols` | array | Unique identifier | | `identities.credentials.authorization_services.technology` | array | Unique identifier | | `identities.credentials.authorization_services.technology.id` | string | Unique identifier | | `identities.credentials.authorization_services.technology.name` | string | Unique identifier | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"identities":[{}],"count":0,"next_offset":"cD1lMzE5NTQ2OS1hYjYxLTQ1NTgtYjkyOC1iYjE3MWNkM2QyY2U="}}` ## Identity Incident Report Generate a comprehensive incident report on stealer malware infections, including credentials and machine context, using source and include\_details in Recorded Future. ### Endpoint - **URL:** `identity/incident/report` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------------------------------------------------------- | | `include_details` | boolean | Optional | Include extended device and malware details in the response. | | `organization_id` | string | Optional | Unique identifier for the organization associated with the incident report. | | `source` | string | Optional | The dump source identifier (e.g., dump-redline-2024-07-21-001). | | `limit` | number | Optional | Maximum number of credential entries to return. | | `offset` | string | Optional | Pagination token for next page. | ### Input Example `{"json_body":{"include_details":true,"organization_id":"uhash:a1b2c3d4","source":"dump-redline-2024-07-21-001","limit":1000,"offset":"eyJsaW1pdCI6IDEwMCwgIm9mZnNldCI6IDEwMH0="}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------- | -------- | ------------------------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `count` | number | Count value | | `total_count` | number | Count value | | `credentials` | array | Output field: credentials | | `credentials.authorization_domain` | string | Output field: credentials.authorization\_domain | | `credentials.email_or_login` | string | Output field: credentials.email\_or\_login | | `credentials.password` | string | Output field: credentials.password | | `credentials.password_sha1` | string | Output field: credentials.password\_sha1 | | `credentials.domain_category` | string | Output field: credentials.domain\_category | | `credentials.domain_technology` | string | Output field: credentials.domain\_technology | | `credentials.contains_cookies` | boolean | Output field: credentials.contains\_cookies | | `credentials.contains_active_cookies` | boolean | Output field: credentials.contains\_active\_cookies | | `credentials.contains_high_risk_technologies` | boolean | Output field: credentials.contains\_high\_risk\_technologies | | `details` | object | Output field: details | | `details.malware_family` | string | Output field: details.malware\_family | | `details.os` | string | Output field: details.os | | `details.os_username` | string | Name of the resource | | `details.malware_file` | string | Output field: details.malware\_file | | `details.timezone` | string | Output field: details.timezone | | `details.uac` | string | Output field: details.uac | | `details.exfiltration_date` | string | Date value | | `details.antivirus` | string | Output field: details.antivirus | | `details.ip_address` | string | Output field: details.ip\_address | | `details.postal_code` | string | Output field: details.postal\_code | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"count":0,"total_count":0,"credentials":[{}],"details":{"malware_family":"RedLine Stealer","os":"Windows 10 Pro","os_username":"jsmith","malware_file":"C:\\Users\\jsmith\\AppData\\Local\\Temp\\winmgr.exe","timezone":"America/New_York","uac":"UAC-Admin","exfiltration_date":"2025-07-24T14:30:00Z","antivirus":"Windows Defender","ip_address":"198.51.100.14","postal_code":"90210","country":"United States"},"next_offset":"eyJsaW1pdCI6IDEwMCwgIm9mZnNldCI6ID...` ## Identity IP Lookup Retrieve credentials compromised by a specific IP address or range at the time of infection using Recorded Future. ### Endpoint - **URL:** `identity/ip/lookup` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `organization_id` | string | Optional | Unique identifier for the organization to scope the search within. | | `ip` | string | Optional | IP address of the compromised machine at time of infection. | | `range` | object | Optional | IP range of the compromised machine at time of infection, using comparison operators. | | `range.gte` | string | Optional | Filter for credentials from machines with IP addresses greater than or equal to this value. | | `range.gt` | string | Optional | Filter for credentials from machines with IP addresses greater than this value. | | `range.lte` | string | Optional | Filter for credentials from machines with IP addresses less than or equal to this value. | | `range.lt` | string | Optional | Filter for credentials from machines with IP addresses less than this value. | | `filter` | object | Optional | Additional filters to apply to the search query, such as date ranges, properties, and associated breach or dump information. | | `filter.first_downloaded_gte` | string | Optional | The first date when these credentials were received and indexed by Recorded Future. | | `filter.latest_downloaded_gte` | string | Optional | Latest date when these credentials were received and indexed by Recorded Future. It is not unusual for the same credentials to be exposed multiple times, in data from different dumps and/or logs. | | `filter.exfiltration_date_gte` | string | Optional | The date when data was exfiltrated (stolen) from the victim. | | `filter.properties` | array | Optional | Password property filters. | | `filter.username_properties` | array | Optional | Username property filters. | | `filter.breach_properties` | object | Optional | Filters for breach properties to further refine the search results based on the associated breach information. | | `filter.breach_properties.name` | string | Optional | Name of the breach to filter by. | | `filter.breach_properties.date` | string | Optional | Date of the breach to filter by. | | `filter.dump_properties` | object | Optional | Filters for dump properties to further refine the search results based on the associated dump information. | | `filter.dump_properties.name` | string | Optional | Name of the dump to filter by. | | `filter.dump_properties.date` | string | Optional | Date of the dump to filter by. | | `filter.authorization_technologies` | array | Optional | Filter for credentials associated with specific authorization technologies. | | `filter.authorization_protocols` | array | Optional | Parameter for Identity IP Lookup | | `filter.malware_families` | array | Optional | Filter for credentials associated with specific malware families. | | `limit` | number | Optional | Maximum number of credential entries to return. | | `offset` | string | Optional | Pagination token for next page of results. | ### Input Example `{"json_body":{"organization_id":"uhash:a1b2c3d4","ip":"198.51.100.1","range":{"gte":"192.0.2.0","gt":"192.0.2.0","lte":"192.0.2.255","lt":"192.0.2.255"},"filter":{"first_downloaded_gte":"2024-01-01T00:00:00Z","latest_downloaded_gte":"2024-01-01T00:00:00Z","exfiltration_date_gte":"2024-01-01T00:00:00Z","properties":["Symbol"],"username_properties":["Email"],"breach_properties":{"name":"ExampleCorp Breach 2024","date":"2024-03-15T00:00:00Z"},"dump_properties":{"name":"Collection","date":"2019-01-07T00:00:00Z"},"authorization_technologies":["SAML"],"authorization_protocols":["RDP"],"malware_families":["RedLine Stealer"]},"limit":1000,"offset":"cD1lMzE5NTQ2OS1hYjYxLTQ1NTgtYjkyOC1iYjE3MWNkM2QyY2U="}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `identities` | array | Unique identifier | | `identities.identity` | object | Unique identifier | | `identities.identity.subjects` | array | Unique identifier | | `identities.count` | number | Unique identifier | | `identities.credentials` | array | Unique identifier | | `identities.credentials.subject` | string | Unique identifier | | `identities.credentials.authorization_service` | object | Unique identifier | | `identities.credentials.authorization_service.url` | string | URL endpoint for the request | | `identities.credentials.authorization_service.domain` | string | Unique identifier | | `identities.credentials.authorization_service.fqdn` | string | Unique identifier | | `identities.credentials.authorization_service.protocols` | array | Unique identifier | | `identities.credentials.authorization_service.technology` | array | Unique identifier | | `identities.credentials.authorization_service.technology.id` | string | Unique identifier | | `identities.credentials.authorization_service.technology.name` | string | Unique identifier | | `identities.credentials.authorization_service.technology.category` | string | Unique identifier | | `identities.credentials.authorization_services` | array | Unique identifier | | `identities.credentials.authorization_services.url` | string | URL endpoint for the request | | `identities.credentials.authorization_services.domain` | string | Unique identifier | | `identities.credentials.authorization_services.fqdn` | string | Unique identifier | | `identities.credentials.authorization_services.protocols` | array | Unique identifier | | `identities.credentials.authorization_services.technology` | array | Unique identifier | | `identities.credentials.authorization_services.technology.id` | string | Unique identifier | | `identities.credentials.authorization_services.technology.name` | string | Unique identifier | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"identities":[{}],"count":0,"next_offset":"cD1lMzE5NTQ2OS1hYjYxLTQ1NTgtYjkyOC1iYjE3MWNkM2QyY2U="}}` ## Identity Password Lookup Check if specified password hashes have been exposed in breach data or stealer logs using k-anonymity, requiring passwords to be provided in the JSON body. ### Endpoint - **URL:** `identity/password/lookup` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------- | | `passwords` | array | Optional | Parameter for Identity Password Lookup | | `passwords.algorithm` | string | Required | The hashing algorithm used to generate the password hash, which determines the formatting of the hash value for lookup. | | `passwords.hash` | string | Required | The password hash value to look up, formatted according to the specified algorithm. | ### Input Example `{"json_body":{"passwords":[{"algorithm":"HASH32","hash":"5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `results` | array | Result of the operation | | `results.password` | object | Result of the operation | | `results.password.algorithm` | string | Result of the operation | | `results.password.hash` | string | Result of the operation | | `results.exposure_status` | string | Status value | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"results":[{}]}}` ## IP Lookup Retrieve threat intelligence, risk scores, and related entities for a specified IP address from Recorded Future. ### Endpoint - **URL:** `v2/ip/{{ip}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ----------------------------------- | | `path_parameters.ip` | string | Required | Parameters for the IP Lookup action | | `parameters.fields` | string | Optional | Parameters for the IP Lookup action | | `parameters.metadata` | boolean | Optional | Parameters for the IP Lookup action | | `parameters.comment` | string | Optional | Parameters for the IP Lookup action | ### Input Example `{"parameters":{"fields":"analystNotes,counts,enterpriseLists,entity,intelCard,links,location,metrics,relatedEntities,risk,riskMapping,riskyCIDRIPs,sightings,threatLists,timestamps","metadata":true,"comment":"any comment"},"path_parameters":{"ip":"1.0.0.0"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.analystNotes` | array | Response data | | `data.analystNotes.file_name` | string | Response data | | `data.analystNotes.file` | string | Response data | | `metadata` | object | Response data | | `metadata.entries` | array | Response data | | `metadata.entries.key` | string | Response data | | `metadata.entries.label` | string | Response data | | `metadata.entries.item` | object | Response data | | `metadata.entries.item.entries` | array | Response data | | `metadata.entries.item.entries.key` | string | Response data | | `metadata.entries.item.entries.label` | string | Response data | | `metadata.entries.item.entries.type` | string | Response data | | `metadata.entries.item.entries.item` | object | Response data | | `metadata.entries.item.entries.entries` | array | Response data | | `metadata.entries.item.type` | string | Response data | | `metadata.entries.type` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 14:04:25 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node09l9ww6ixtnia1ma9kvawcg4hh3649789.node...` ## List IP Risk Rules Retrieve a list of IP risk rules from Recorded Future to identify potential threats and risks associated with specific IP addresses. ### Endpoint - **URL:** `v2/ip/riskrules` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.results` | array | Response data | | `data.results.criticalityLabel` | string | Response data | | `data.results.description` | string | Response data | | `data.results.categories` | array | Response data | | `data.results.categories.name` | string | Response data | | `data.results.categories.framework` | string | Response data | | `data.results.criticality` | number | Response data | | `data.results.relatedEntities` | array | Response data | | `data.results.relatedEntities.file_name` | string | Response data | | `data.results.relatedEntities.file` | string | Response data | | `data.results.name` | string | Response data | | `data.results.count` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 18:36:15 GMT","Content-Type":"application/json;charset=utf-8","Content-Length":"1973","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node0hz75vvep08gxas7aete7u6s4071112.node0; Path=...` ## Lookup Vulnerability Retrieve detailed information about a specific vulnerability from Recorded Future using its unique ID. ### Endpoint - **URL:** `v2/vulnerability/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ---------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Lookup Vulnerability action | | `parameters.fields` | array | Optional | Parameters for the Lookup Vulnerability action | | `parameters.metadata` | boolean | Optional | Parameters for the Lookup Vulnerability action | | `parameters.comment` | string | Optional | Parameters for the Lookup Vulnerability action | ### Input Example `{"parameters":{"fields":["analystNotes","commonNames","counts","cpe","cpe22uri","cvss","cvssv3","enterpriseLists","entity","intelCard","links","metrics","nvdDescription","rawrisk","relatedEntities","relatedLinks","risk","riskMapping","sightings","threatLists","timestamps"],"metadata":true,"comment":"a comment"},"path_parameters":{"id":"Zs4cBI"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.analystNotes` | array | Response data | | `data.analystNotes.attributes` | object | Response data | | `data.analystNotes.attributes.validated_on` | string | Response data | | `data.analystNotes.attributes.published` | string | Response data | | `data.analystNotes.attributes.text` | string | Response data | | `data.analystNotes.attributes.topic` | object | Response data | | `data.analystNotes.attributes.topic.id` | string | Response data | | `data.analystNotes.attributes.topic.name` | string | Response data | | `data.analystNotes.attributes.topic.type` | string | Response data | | `data.analystNotes.attributes.topic.description` | string | Response data | | `data.analystNotes.attributes.context_entities` | array | Response data | | `data.analystNotes.attributes.context_entities.id` | string | Response data | | `data.analystNotes.attributes.context_entities.name` | string | Response data | | `data.analystNotes.attributes.context_entities.type` | string | Response data | | `data.analystNotes.attributes.validation_urls` | array | Response data | | `data.analystNotes.attributes.validation_urls.id` | string | Response data | | `data.analystNotes.attributes.validation_urls.name` | string | Response data | | `data.analystNotes.attributes.validation_urls.type` | string | Response data | | `data.analystNotes.attributes.title` | string | Response data | | `data.analystNotes.attributes.note_entities` | array | Response data | | `data.analystNotes.attributes.note_entities.id` | string | Response data | | `data.analystNotes.attributes.note_entities.name` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 21:56:02 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node01knaoe0qzo9fivc0e4y5j2rbr4183315.node...` ## Malware Lookup Retrieve comprehensive malware details from Recorded Future using a specified malware ID in the path parameters. ### Endpoint - **URL:** `v2/malware/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ---------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Malware Lookup action | | `parameters.fields` | array | Optional | Parameters for the Malware Lookup action | | `parameters.metadata` | boolean | Optional | Parameters for the Malware Lookup action | | `parameters.comment` | string | Optional | Parameters for the Malware Lookup action | ### Input Example `{"parameters":{"fields":["analystNotes","categories","counts","entity","intelCard","links","metrics","relatedEntities","sightings","timestamps"],"metadata":true,"comment":"any comment"},"path_parameters":{"id":"some id"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.analystNotes` | array | Response data | | `data.analystNotes.file_name` | string | Response data | | `data.analystNotes.file` | string | Response data | | `metadata` | object | Response data | | `metadata.entries` | array | Response data | | `metadata.entries.key` | string | Response data | | `metadata.entries.label` | string | Response data | | `metadata.entries.item` | object | Response data | | `metadata.entries.item.entries` | array | Response data | | `metadata.entries.item.entries.key` | string | Response data | | `metadata.entries.item.entries.label` | string | Response data | | `metadata.entries.item.entries.type` | string | Response data | | `metadata.entries.item.entries.item` | object | Response data | | `metadata.entries.item.entries.entries` | array | Response data | | `metadata.entries.item.type` | string | Response data | | `metadata.entries.type` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 16:58:04 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node044kroehlurc4ek4pefoxgz2h4004105.node0...` ## Query IP Extensions Retrieve extended details and specific extensions for a given IP address from Recorded Future using the specified IP and extension path parameters. ### Endpoint - **URL:** `/v2/ip/{{ip}}/extension/{{extension}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------------------------ | | `parameters.metadata` | boolean | Optional | Include metadata. | | `path_parameters.ip` | string | Required | The IP address to lookup. Must be a single IP address. | | `path_parameters.extension` | string | Required | Extension to call. | ### Input Example `{"parameters":{"metadata":true},"path_parameters":{"ip":"10.0.0.8","extension":"CarbonBlack"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Search Search for Recorded Future alerts using specified filters and retrieve matching results. ### Endpoint - **URL:** `v2/alert/search` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | -------------------------------- | | `parameters.triggered` | string | Optional | Parameters for the Search action | | `parameters.assignee` | string | Optional | Parameters for the Search action | | `parameters.freetext` | string | Optional | Parameters for the Search action | | `parameters.limit` | number | Optional | Parameters for the Search action | | `parameters.status` | string | Optional | Parameters for the Search action | | `parameters.alertRule` | string | Optional | Parameters for the Search action | | `parameters.taggedText` | boolean | Optional | Parameters for the Search action | | `parameters.from` | number | Optional | Parameters for the Search action | | `parameters.direction` | string | Optional | Parameters for the Search action | | `parameters.orderby` | string | Optional | Parameters for the Search action | ### Input Example `{"parameters":{"triggered":"2022-01-20T0","assignee":"NONE","freetext":"a","limit":10,"status":"no-action","alertRule":"iAPILC","taggedText":true,"from":0,"direction":"asc","orderby":"triggered"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.results` | array | Response data | | `data.results.review` | object | Response data | | `data.results.review.assignee` | object | Response data | | `data.results.review.statusDate` | object | Response data | | `data.results.review.statusInPortal` | string | Response data | | `data.results.review.status` | string | Response data | | `data.results.review.noteDate` | object | Response data | | `data.results.review.statusChangeBy` | object | Response data | | `data.results.review.noteAuthor` | object | Response data | | `data.results.review.note` | object | Response data | | `data.results.url` | string | Response data | | `data.results.rule` | object | Response data | | `data.results.rule.name` | string | Response data | | `data.results.rule.url` | string | Response data | | `data.results.rule.owner_id` | string | Response data | | `data.results.rule.owner_name` | string | Response data | | `data.results.rule.id` | string | Response data | | `data.results.rule.organisation_name` | string | Response data | | `data.results.rule.organisation_id` | string | Response data | | `data.results.triggered` | string | Response data | | `data.results.id` | string | Response data | | `data.results.title` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 14:10:44 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node0ycr5u0bob499jeiki407m61f3902973.node0...` ## Search Alert by ID Retrieve detailed information for a specific alert in Recorded Future using its unique alert ID. ### Endpoint - **URL:** `/v3/alerts/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------ | | `path_parameters.id` | string | Required | Alert ID | | `parameters.fields` | string | Optional | Fields to include ai\_insights, hits, id, log, owner\_organisation\_details, review, rule, title, type, url | | `parameters.taggedText` | boolean | Optional | Parameters for the Search Alert by ID action | ### Input Example `{"parameters":{"fields":"hits","taggedText":false},"path_parameters":{"id":"lWjyiz"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.hits` | array | Response data | | `data.hits.entities` | array | Response data | | `data.hits.entities.id` | string | Response data | | `data.hits.entities.name` | string | Response data | | `data.hits.entities.type` | string | Response data | | `data.hits.document` | object | Response data | | `data.hits.document.source` | object | Response data | | `data.hits.document.source.id` | string | Response data | | `data.hits.document.source.name` | string | Response data | | `data.hits.document.source.type` | string | Response data | | `data.hits.document.title` | string | Response data | | `data.hits.document.url` | object | Response data | | `data.hits.document.authors` | array | Response data | | `data.hits.document.authors.file_name` | string | Response data | | `data.hits.document.authors.file` | string | Response data | | `data.hits.fragment` | string | Response data | | `data.hits.id` | string | Response data | | `data.hits.language` | string | Response data | | `data.hits.primary_entity` | object | Response data | | `data.hits.primary_entity.id` | string | Response data | | `data.hits.primary_entity.name` | string | Response data | | `data.hits.primary_entity.type` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 01 Feb 2024 09:11:22 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","content-security-policy":"default-src 'self' data:; img-src 'self'...` ## Search Alert Rules Retrieve a list of alert rules from Recorded Future based on specified criteria to support targeted security responses. ### Endpoint - **URL:** `/v2/alert/rule` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | -------------------------------------------- | | `parameters.freetext` | string | Optional | Parameters for the Search Alert Rules action | | `parameters.limit` | number | Optional | Parameters for the Search Alert Rules action | | `parameters.taggedText` | boolean | Optional | Parameters for the Search Alert Rules action | ### Input Example `{"parameters":{"freetext":"","limit":10,"taggedText":true}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.results` | array | Response data | | `data.results.intelligence_goals` | array | Response data | | `data.results.intelligence_goals.file_name` | string | Response data | | `data.results.intelligence_goals.file` | string | Response data | | `data.results.priority` | boolean | Response data | | `data.results.tags` | array | Response data | | `data.results.tags.file_name` | string | Response data | | `data.results.tags.file` | string | Response data | | `data.results.use_case_id` | object | Response data | | `data.results.id` | string | Response data | | `data.results.owner` | object | Response data | | `data.results.owner.name` | string | Response data | | `data.results.owner.id` | string | Response data | | `data.results.title` | string | Response data | | `data.results.created` | string | Response data | | `data.results.notification_settings` | object | Response data | | `data.results.notification_settings.email_subscribers` | array | Response data | | `data.results.notification_settings.email_subscribers.file_name` | string | Response data | | `data.results.notification_settings.email_subscribers.file` | string | Response data | | `data.results.notification_settings.mobile_subscribers` | array | Response data | | `data.results.notification_settings.mobile_subscribers.file_name` | string | Response data | | `data.results.notification_settings.mobile_subscribers.file` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 17:03:37 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node017juks5vmnh5k1rk5152a1k3et4022289.nod...` ## Search Alerts Retrieve triggered alerts from Recorded Future based on specified criteria to support threat analysis and incident response workflows. ### Endpoint - **URL:** `/v3/alerts/` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------ | | `parameters.triggered` | string | Optional | Filter on triggered timestamp, using time queries and ranges | | `parameters.assignee` | string | Optional | Assignee email, or 'NONE' to match notifications without an assignee | | `parameters.statusInPortal` | string | Optional | Filter on status (as used in the portal) | | `parameters.alertRule` | string | Optional | Filter on alert rule ID | | `parameters.freetext` | string | Optional | Freetext search | | `parameters.limit` | number | Optional | Maximum number of references from which notes are fetched, at most 1000. | | `parameters.from` | number | Optional | Offset from first result. The API may only return the first 1000 results, meaning limit + from cannot exceed 1000. | | `parameters.taggedText` | boolean | Optional | Enables tags in text fragments | | `parameters.orderby` | string | Optional | Sort order | | `parameters.direction` | string | Optional | Sort direction | | `parameters.fields` | string | Optional | Fields to include ai\_insights, hits, id, log, owner\_organisation\_details, review, rule, title, type, url | ### Input Example `{"parameters":{"triggered":"2024-01-31T20:36:31.757Z","assignee":"new","statusInPortal":"New","alertRule":"string","freetext":"string","limit":10,"from":1,"taggedText":false,"orderby":"triggered","direction":"asc","fields":"hits"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.file_name` | string | Response data | | `data.file` | string | Response data | | `counts` | object | Output field: counts | | `counts.returned` | number | Output field: counts.returned | | `counts.total` | number | Output field: counts.total | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 01 Feb 2024 08:57:04 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","content-security-policy":"default-src 'self' data:; img-src 'self'...` ## Search Alerts Hits Retrieve data hits from Recorded Future Intelligence Cloud that triggered alerts, filtered by specified alert IDs. ### Endpoint - **URL:** `/v3/alerts/hits` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | -------------------------------------------- | | `parameters.ids` | string | Required | Alert IDs separated by comma | | `parameters.taggedText` | boolean | Optional | Parameters for the Search Alerts Hits action | ### Input Example `{"parameters":{"ids":"report:hjeFxU","taggedText":false}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.document` | object | Response data | | `data.document.source` | object | Response data | | `data.document.source.id` | string | Response data | | `data.document.source.name` | string | Response data | | `data.document.source.type` | string | Response data | | `data.document.title` | string | Response data | | `data.document.url` | object | Response data | | `data.document.authors` | array | Response data | | `data.document.authors.file_name` | string | Response data | | `data.document.authors.file` | string | Response data | | `data.fragment` | string | Response data | | `data.id` | string | Response data | | `data.language` | string | Response data | | `data.index` | number | Response data | | `data.entities` | array | Response data | | `data.entities.id` | string | Response data | | `data.entities.name` | string | Response data | | `data.entities.type` | string | Response data | | `data.alert_id` | string | Response data | | `data.primary_entity` | object | Response data | | `data.primary_entity.id` | string | Response data | | `data.primary_entity.name` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 01 Feb 2024 09:04:01 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","content-security-policy":"default-src 'self' data:; img-src 'self'...` ## Search Update Alert Update the assignee, status, and notes for Recorded Future alerts by providing the required information in a JSON body. ### Endpoint - **URL:** `/v2/alert/update` - **Method:** `POST` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `success` | array | Whether the operation was successful | | `success.id` | string | Unique identifier | | `success.status` | string | Status value | | `success.statusInPortal` | string | Status value | | `error` | array | Error message if any | | `error.file_name` | string | Name of the resource | | `error.file` | string | Error message if any | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 01 Feb 2024 11:24:41 GMT","Content-Type":"application/json;charset=utf-8","Content-Length":"93","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","content-security-policy":"default-src 'self' data:; img-src 'self' https: ...` ## URL Lookup Retrieve threat intelligence data for a specified URL from Recorded Future using the provided URL as a path parameter. ### Endpoint - **URL:** `v2/url/{{url}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ------------------------------------ | | `path_parameters.url` | string | Required | Parameters for the URL Lookup action | | `parameters.fields` | array | Optional | Parameters for the URL Lookup action | | `parameters.metadata` | boolean | Optional | Parameters for the URL Lookup action | | `parameters.comment` | string | Optional | Parameters for the URL Lookup action | ### Input Example `{"parameters":{"fields":["analystNotes","counts","enterpriseLists","entity","links","metrics","relatedEntities","risk","riskMapping","sightings","timestamps"],"metadata":true,"comment":"any comment"},"path_parameters":{"url":"http://www.swimlane.com"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.analystNotes` | array | Response data | | `data.analystNotes.file_name` | string | Response data | | `data.analystNotes.file` | string | Response data | | `metadata` | object | Response data | | `metadata.entries` | array | Response data | | `metadata.entries.key` | string | Response data | | `metadata.entries.label` | string | Response data | | `metadata.entries.item` | object | Response data | | `metadata.entries.item.entries` | array | Response data | | `metadata.entries.item.entries.key` | string | Response data | | `metadata.entries.item.entries.label` | string | Response data | | `metadata.entries.item.entries.type` | string | Response data | | `metadata.entries.item.entries.item` | object | Response data | | `metadata.entries.item.entries.entries` | array | Response data | | `metadata.entries.item.type` | string | Response data | | `metadata.entries.type` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 05 Dec 2022 15:13:36 GMT","Content-Type":"application/json;charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","cache-control":"no-cache, no-store, private, must-revalidate, max-age=0, no-transform","expires":"Thu, 01 Jan 1970 00:00:00 GMT","pragma":"no-cache","x-content-type-options":"nosniff","strict-transport-security":"max-age=31536000; includeSubDomains","set-cookie":"JSESSIONID=node018jn9idiwhfc2qk90vm793phq3945028.node...` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | ---------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | cache-control | Directives for caching mechanisms | no-cache, no-store, private, must-revalidate, max-age=0, no-transform | | CF-Cache-Status | HTTP response header: CF-Cache-Status | DYNAMIC | | CF-RAY | HTTP response header: CF-RAY | 774fd02b6f000319-GRU | | Connection | HTTP response header: Connection | keep-alive | | content-encoding | HTTP response header: content-encoding | gzip | | Content-Length | The length of the response body in bytes | 1929 | | content-security-policy | HTTP response header: content-security-policy | default-src 'self' data:; img-src 'self' https: data: blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' fonts.googleapis.com cdn.jsdelivr.net; font-src 'self' fonts.gstatic.com; worker-src blob:; | | Content-Type | The media type of the resource | application/json;charset=utf-8 | | Date | The date and time at which the message was originated | Mon, 05 Dec 2022 21:18:14 GMT | | expires | The date/time after which the response is considered stale | Thu, 01 Jan 1970 00:00:00 GMT | | pragma | HTTP response header: pragma | no-cache | | Server | Information about the software used by the origin server | cloudflare | | set-cookie | HTTP response header: set-cookie | JSESSIONID=node016hnx3pnie7pf1tvh7j74fpyza3994472.node0; Path=/rfq; Secure; HttpOnly | | strict-transport-security | HTTP response header: strict-transport-security | max-age=31536000; includeSubDomains | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | x-content-type-options | HTTP response header: x-content-type-options | nosniff |