Recorded Future v2
Unique threat intel technology that automatically serves up relevant insights in real time.
Data Enrichment & Threat Intelligence · Recorded Future Intelligence
Configuration parameters
server_url— Server URL (e.g., https://api.recordedfuture.com/gw/xsoar/) (required)token— API Tokentoken_credential—file_threshold_suspicious— File Suspicious Thresholdfile_threshold— File Malicious Thresholdcve_threshold_suspicious— CVE Suspicious Thresholdcve_threshold— CVE Malicious Thresholdip_threshold_suspicious— IP Suspicious Thresholdip_threshold— IP Malicious Thresholddomain_threshold_suspicious— Domain Suspicious Thresholddomain_threshold— Domain Malicious Thresholdurl_threshold_suspicious— URL Suspicious Thresholdurl_threshold— URL Malicious Thresholdvulnerability_threshold— Vulnerability Thresholdcollective_insights— Collective Insights (required)insecure— Trust any certificate (not secure)proxy— Use system proxy settingsisFetch— Fetch incidentsrule_names— Rule names to fetch alerts byfetch_statuses— Alert Statuses to include in the fetchupdate_status— Update alert status on fetch.first_fetch— First fetch timeincidentType— Incident typemax_fetch— Maximum number of incidents per fetchintegrationReliability— Source ReliabilityfeedExpirationPolicy—feedExpirationInterval— Incidents Fetch IntervalincidentFetchInterval— Incidents Fetch Interval
Commands (18)
-
cveGets a quick indicator of the risk associated with a CVE.
-
domainGets a quick indicator of the risk associated with a domain.
-
fileGets a quick indicator of the risk associated with a file.
-
ipGets a quick indicator of the risk associated with an IP address.
-
recordedfuture-alert-rulesDeprecatedSearch for alert rule IDs. Deprecated: use rf-alerts from "Recorded Future Alerts" integration in "Recorded Future" pack instead.
-
recordedfuture-alert-set-noteDeprecatedSet a note for the alert in Recorded Future. Deprecated: use rf-alert-update from "Recorded Future Alerts" integration in "Recorded Future" pack instead.
-
recordedfuture-alert-set-statusDeprecatedSet alert into predefined status. Deprecated: use rf-alert-update from "Recorded Future Alerts" integration in "Recorded Future" pack instead.
-
recordedfuture-alertsDeprecatedGets details on alerts configured and generated by Recorded Future by alert rule ID and/or time range. Deprecated: use rf-alerts from "Recorded Future Alerts" integration in "Recorded Future" pack instead.
-
recordedfuture-collective-insightPost detection to collective insight.
-
recordedfuture-detection-rulesSearch detection rules.
-
recordedfuture-intelligenceGet threat intelligence for an IP, Domain, CVE, URL, File or Malware.
-
recordedfuture-linksGet Insikt Group Research Links for an IP, Domain, CVE, URL, File, or Malware.
-
recordedfuture-malware-searchSearch for a malware by specified filters.
-
recordedfuture-single-alertDeprecatedGet detailed information from vulnerability, typosquat and credential alerts. Deprecated in favor of "Recorded Future Alerts" integration in "Recorded Future" pack.
-
recordedfuture-threat-assessmentGet an indicator of the risk based on context.
-
recordedfuture-threat-linksSearch links.
-
recordedfuture-threat-mapGet threat actors map.
-
urlGets a quick indicator of the risk associated with a URL.