Recorded Future v2

Unique threat intel technology that automatically serves up relevant insights in real time.

Data Enrichment & Threat Intelligence · Recorded Future Intelligence

Details

IDRecorded Future v2
ProviderMastercard
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Unique threat intel technology that automatically serves up relevant insights in real time.
This integration was integrated and tested with version 2.4.3 of Recorded Future v2

Some changes have been made that might affect your existing content.
If you are upgrading from a previous version of this integration, see Breaking Changes.

Configure Recorded Future v2 in Cortex

Parameter Description Required
Server URL (e.g., https://api.recordedfuture.com/gw/xsoar/)   True
API Token   True
File Suspicious Threshold Minimum risk score from Recorded Future to consider the file suspicious. False
File Malicious Threshold Minimum risk score from Recorded Future to consider the file malicious. False
CVE Suspicious Threshold Minimum risk score from Recorded Future to consider the CVE suspicious. False
CVE Malicious Threshold Minimum risk score from Recorded Future to consider the CVE malicious. False
IP Suspicious Threshold Minimum risk score from Recorded Future to consider the IP suspicious. False
IP Malicious Threshold Minimum risk score from Recorded Future to consider the IP malicious. False
Domain Suspicious Threshold Minimum risk score from Recorded Future to consider the domain suspicious. False
Domain Malicious Threshold Minimum risk score from Recorded Future to consider the domain malicious. False
URL Suspicious Threshold Minimum risk score from Recorded Future to consider the URL suspicious. False
URL Malicious Threshold Minimum risk score from Recorded Future to consider the URL malicious. False
Vulnerability Threshold Minimum risk score from Recorded Future to consider the vulnerability critical. False
Collective Insights The Recorded Future Intelligence Cloud aggregates data related to indicators, driving collective insights to better identify threats. Anonymized data is collected for analytical purposes to identify trends and insights with the Intelligence Cloud. Go to the Recorded Future support site to learn more about Collective Insights. True
Trust any certificate (not secure)   False
Use system proxy settings   False
Fetch incidents   False
Rule names to fetch alerts by Rule names to fetch alerts by, separated by semicolon. If empty, all alerts will be fetched. False
Alert Statuses to include in the fetch Comma-separated alert statuses (e.g. “unassigned,assigned,pending,actionable,no-action,tuning”). If empty, the default value of “no-action” will be used. False
Update alert status on fetch. If selected, alerts with a status of ‘no-action’ will be updated to ‘pending’ once fetched by the integration. False
First fetch time Format: <number> <time unit>, e.g., “12 hours”, “7 days”, “3 months”, “1 year”. False
Incident type   False
Maximum number of incidents per fetch   False
Source Reliability Reliability of the source providing the intelligence data. False
    False
Incidents Fetch Interval   False
Incidents Fetch Interval   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

domain

Gets a quick indicator of the risk associated with a domain.

Base Command

domain

Input

Argument Name Description Required
domain The domain for which to get the reputation. Required

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
Domain.Malicious.Vendor string For malicious domains, the vendor that made the decision.
Domain.Malicious.Description string For malicious Domains, the reason that the vendor made the decision.
Domain.Name string Domain name.
RecordedFuture.Domain.riskScore number Recorded Future domain risk score.
RecordedFuture.Domain.riskLevel string Recorded Future domain risk level.
RecordedFuture.Domain.Evidence.rule string Recorded Future risk rule name.
RecordedFuture.Domain.Evidence.mitigation string Recorded Future risk rule mitigation.
RecordedFuture.Domain.Evidence.description string Recorded Future risk rule description.
RecordedFuture.Domain.Evidence.timestamp date Recorded Future risk rule timestamp.
RecordedFuture.Domain.Evidence.level number Recorded Future risk rule level.
RecordedFuture.Domain.Evidence.ruleid string Recorded Future risk rule ID.
RecordedFuture.Domain.name string Domain name.
RecordedFuture.Domain.maxRules number Maximum number of Recorded Future domain risk rules.
RecordedFuture.Domain.rules string All the rules concatenated by comma.
RecordedFuture.Domain.ruleCount number Number of triggered Recorded Future domain risk rules.

ip

Gets a quick indicator of the risk associated with an IP address.

Base Command

ip

Input

Argument Name Description Required
ip IP address for which to get the reputation. Required

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
IP.Malicious.Vendor string For malicious IP addresses, the vendor that made the decision.
IP.Malicious.Description string For malicious IP addresses, the reason that the vendor made the decision.
IP.Address string IP address.
RecordedFuture.IP.riskScore number Recorded Future IP risk score.
RecordedFuture.IP.riskLevel string Recorded Future IP risk level.
RecordedFuture.IP.Evidence.rule string Recorded Future risk rule name.
RecordedFuture.IP.Evidence.mitigation string Recorded Future risk rule mitigation.
RecordedFuture.IP.Evidence.description string Recorded Future risk rule description.
RecordedFuture.IP.Evidence.timestamp date Recorded Future risk rule timestamp.
RecordedFuture.IP.Evidence.level number Recorded Future risk rule level.
RecordedFuture.IP.Evidence.ruleid string Recorded Future risk rule ID.
RecordedFuture.IP.name string IP address.
RecordedFuture.IP.maxRules number Maximum number of Recorded Future IP risk rules.
RecordedFuture.IP.rules string All the rules concatenated by comma.
RecordedFuture.IP.ruleCount number Number of triggered Recorded Future IP risk rules.

file

Gets a quick indicator of the risk associated with a file.

Base Command

file

Input

Argument Name Description Required
file File hash for which to check the reputation. Can be an MD5, SHA1, SHA256, SHA512, CRC32 or CTPH. Required

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
File.SHA256 string SHA-256 hash of the file.
File.SHA512 string SHA-512 hash of the file.
File.SHA1 string SHA-1 hash of the file.
File.MD5 string MD5 hash of the file.
File.CRC32 string CRC32 hash of the file.
File.CTPH string CTPH hash of the file.
File.Malicious.Vendor string For malicious files, the vendor that made the decision.
File.Malicious.Description string For malicious files, the reason that the vendor made the decision.
RecordedFuture.File.riskScore number Recorded Future hash risk score.
RecordedFuture.File.riskLevel string Recorded Future hash risk level.
RecordedFuture.File.Evidence.rule string Recorded Future risk rule name.
RecordedFuture.File.Evidence.mitigation string Recorded Future risk rule mitigation.
RecordedFuture.File.Evidence.description string Recorded Future risk rule description.
RecordedFuture.File.Evidence.timestamp date Recorded Future risk rule timestamp.
RecordedFuture.File.Evidence.level number Recorded Future risk rule level.
RecordedFuture.File.Evidence.ruleid string Recorded Future risk rule ID.
RecordedFuture.File.name string File name.
RecordedFuture.File.maxRules number Maximum number of Recorded Future hash risk rules.
RecordedFuture.File.rules string All the rules concatenated by comma.
RecordedFuture.File.ruleCount number Number of triggered Recorded Future hash risk rules.

cve

Gets a quick indicator of the risk associated with a CVE.

Base Command

cve

Input

Argument Name Description Required
cve CVE for which to get the reputation. Required

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
CVE.ID string Vulnerability name.
RecordedFuture.CVE.riskScore number Recorded Future vulnerability risk score.
RecordedFuture.CVE.riskLevel string Recorded Future vulnerability risk level.
RecordedFuture.CVE.Evidence.rule string Recorded Future risk rule name.
RecordedFuture.CVE.Evidence.mitigation string Recorded Future risk rule mitigation.
RecordedFuture.CVE.Evidence.description string Recorded Future risk rule description.
RecordedFuture.CVE.Evidence.timestamp date Recorded Future risk rule timestamp.
RecordedFuture.CVE.Evidence.level number Recorded Future risk rule level.
RecordedFuture.CVE.Evidence.ruleid string Recorded Future risk rule ID.
RecordedFuture.CVE.name string CVE name.
RecordedFuture.CVE.maxRules number Maximum number of Recorded Future vulnerability risk rules.
RecordedFuture.CVE.rules string All the rules concatenated by comma.
RecordedFuture.CVE.ruleCount number Number of triggered Recorded Future vulnerability risk rules.

url

Gets a quick indicator of the risk associated with a URL.

Base Command

url

Input

Argument Name Description Required
url URL for which to get the reputation. Required

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
URL.Malicious.Vendor string For malicious URLs, the vendor that made the decision.
URL.Malicious.Description string For malicious URLs, the reason that the vendor made the decision.
URL.Data string URL name.
RecordedFuture.URL.riskScore number Recorded Future URL risk score.
RecordedFuture.URL.riskLevel string Recorded Future URL risk level.
RecordedFuture.URL.Evidence.rule string Recorded Risk rule name.
RecordedFuture.URL.Evidence.mitigation string Recorded Risk rule mitigation.
RecordedFuture.URL.Evidence.description string Recorded Risk rule description.
RecordedFuture.URL.Evidence.timestamp date Recorded Risk rule timestamp.
RecordedFuture.URL.Evidence.level number Recorded Risk rule level.
RecordedFuture.URL.Evidence.ruleid string Recorded Risk rule ID.
RecordedFuture.URL.name string URL name.
RecordedFuture.URL.maxRules number Maximum number of Recorded Future URL risk rules.
RecordedFuture.URL.rules string All the rules concatenated by comma.
RecordedFuture.URL.ruleCount number Number of triggered Recorded Future URL risk rules.

recordedfuture-threat-assessment

Get an indicator of the risk based on context.

Base Command

recordedfuture-threat-assessment

Input

Argument Name Description Required
context Context to use for the assessment. This is used by Recorded Future to calculate the relevant score and verdict. Can be “c2”, “malware”, or “phishing”. Possible values are: c2, malware, phishing. Required
ip IP addresses to check if they are related to the selected context. Optional
domain Domains to check if they are related to the selected context. Optional
file File hashes to check if they are related to the selected context. Optional
url URLs to check if they are related to the selected context. Optional
cve CVEs to check if they are related to the selected context. Optional
filter Will filter out entities that have zero as score. Possible values are: yes, no. Optional

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string Indicator type.
DBotScore.Vendor string Vendor used to calculate the score.
DBotScore.Score number The actual score.
File.SHA256 string SHA-256 hash of the file.
File.SHA512 string SHA-512 hash of the file.
File.SHA1 string SHA-1 hash of the file.
File.MD5 string MD5 hash of the file.
File.CRC32 string CRC32 hash of the file.
File.CTPH string CTPH hash of the file.
IP.Address string IP address.
IP.ASN string ASN.
IP.Geo.Country string IP address geolocation country.
Domain.Name string Domain name.
URL.Data string URL name.
CVE.ID string Vulnerability name.
RecordedFuture.verdict boolean Recorded Future verdict.
RecordedFuture.context string Threat assessment context.
RecordedFuture.riskScore number Recorded Future maximum risk score.
RecordedFuture.Entities.id string Recorded Future entity ID.
RecordedFuture.Entities.name string Recorded Future entity name.
RecordedFuture.Entities.type string Recorded Future entity type.
RecordedFuture.Entities.score string Recorded Future entity score.
RecordedFuture.Entities.context string Contains the current context if there is evidence.
RecordedFuture.Entities.Evidence.ruleid string Recorded Future risk rule ID.
RecordedFuture.Entities.Evidence.timestamp date Recorded Future evidence timestamp.
RecordedFuture.Entities.Evidence.mitigation string Recorded Future evidence mitigation.
RecordedFuture.Entities.Evidence.description string Recorded Future evidence description.
RecordedFuture.Entities.Evidence.rule string Recorded Future risk rule.
RecordedFuture.Entities.Evidence.level number Recorded Future risk rule level.

recordedfuture-intelligence

Get threat intelligence for an IP, Domain, CVE, URL, File or Malware.

Base Command

recordedfuture-intelligence

Input

Argument Name Description Required
profile Depending on what profile you choose you will get different related entities matching the given profile. Possible values are: All, Threat Hunter, SecOp Analyst, TI Analyst, Vulnerability Analyst. Default is All. Optional
entity_type The type of entity for which to fetch context. Should be provided with its value in entityValue argument. Can be “domain”, “ip”, “file”, “url”, “cve”, or “malware”. Possible values are: domain, ip, file, url, cve, malware. Required
entity The value of the entity for which to fetch context. Should be provided with its type in entity_type argument. Supported hash types: MD5, SHA1, SHA256, SHA512, CRC32, and CTPH. Vulnerability supports CVEs. Required
fetch_related_entities Whether to fetch related entity data. Can be “yes” or “no”. Possible values are: yes, no. Optional
fetch_analyst_notes Whether to fetch analyst notes. Can be “yes” or “no”. Possible values are: yes, no. Default is no. Optional
fetch_riskyCIDRips Whether risk scores for other IP addresses within the same CIDR should be fetched (only for IP intelligence). Can be “yes” or “no”. Possible values are: no, yes. Default is no. Optional

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string Indicator type.
DBotScore.Vendor string Vendor used to calculate the score.
DBotScore.Score number The actual score.
File.SHA256 string SHA-256 hash of the file.
File.SHA512 string SHA-512 hash of the file.
File.SHA1 string SHA-1 hash of the file.
File.MD5 string MD5 hash of the file.
File.CRC32 string CRC32 hash of the file.
File.CTPH string CTPH hash of the file.
IP.Address string IP address.
IP.ASN string ASN.
IP.Geo.Country string IP address geolocation country.
Domain.Name string Domain name.
URL.Data string URL name.
CVE.ID string Vulnerability name.
RecordedFuture.IP.criticality number Risk criticality.
RecordedFuture.IP.criticalityLabel string Risk criticality label.
RecordedFuture.IP.riskString string Risk string.
RecordedFuture.IP.riskSummary string Risk summary.
RecordedFuture.IP.rules string Risk rules.
RecordedFuture.Ip.concatRules string All risk rules concatenated by comma.
RecordedFuture.IP.score number Risk score.
RecordedFuture.IP.firstSeen date Evidence first seen date.
RecordedFuture.IP.lastSeen date Evidence last seen date.
RecordedFuture.IP.intelCard string Recorded Future intelligence card URL.
RecordedFuture.IP.type string Recorded Future entity type.
RecordedFuture.IP.name string Recorded Future entity name.
RecordedFuture.IP.id string Recorded Future entity ID.
RecordedFuture.IP.location.asn string ASN number.
RecordedFuture.IP.location.cidr.id string Recorded Future CIDR ID.
RecordedFuture.IP.location.cidr.name string CIDR name.
RecordedFuture.IP.location.cidr.type string CIDR type.
RecordedFuture.IP.location.location.city string IP address geolocation city.
RecordedFuture.IP.location.location.continent string IP address geolocation continent.
RecordedFuture.IP.location.location.country string IP address geolocation country.
RecordedFuture.IP.location.organization string IP address geolocation organization.
RecordedFuture.IP.metrics.type string Recorded Future metrics type.
RecordedFuture.IP.metrics.value number Recorded Future metrics value.
RecordedFuture.IP.threatLists.description string Recorded Future threat list description.
RecordedFuture.IP.threatLists.id string Recorded Future threat list ID.
RecordedFuture.IP.threatLists.name string Recorded Future threat list name.
RecordedFuture.IP.threatLists.type string Recorded Future threat list type.
RecordedFuture.IP.relatedEntities.RelatedAttacker.count number Recorded Future related attacker count.
RecordedFuture.IP.relatedEntities.RelatedAttacker.id string Recorded Future related attacker ID.
RecordedFuture.IP.relatedEntities.RelatedAttacker.name string Recorded Future related attacker name.
RecordedFuture.IP.relatedEntities.RelatedAttacker.type string Recorded Future related attacker type.
RecordedFuture.IP.relatedEntities.RelatedTarget.count number Recorded Future related target count.
RecordedFuture.IP.relatedEntities.RelatedTarget.id string Recorded Future related target ID.
RecordedFuture.IP.relatedEntities.RelatedTarget.name string Recorded Future related target name.
RecordedFuture.IP.relatedEntities.RelatedTarget.type string Recorded Future related target type.
RecordedFuture.IP.relatedEntities.RelatedThreatActor.count number Recorded Future related threat actor count.
RecordedFuture.IP.relatedEntities.RelatedThreatActor.id string Recorded Future related threat actor ID.
RecordedFuture.IP.relatedEntities.RelatedThreatActor.name string Recorded Future related threat actor name.
RecordedFuture.IP.relatedEntities.RelatedThreatActor.type string Recorded Future related threat actor type.
RecordedFuture.IP.relatedEntities.RelatedMalware.count number Recorded Future related malware count.
RecordedFuture.IP.relatedEntities.RelatedMalware.id string Recorded Future related malware ID.
RecordedFuture.IP.relatedEntities.RelatedMalware.name string Recorded Future related malware name.
RecordedFuture.IP.relatedEntities.RelatedMalware.type string Recorded Future related malware type.
RecordedFuture.IP.relatedEntities.RelatedCyberVulnerability.count number Recorded Future related vulnerability count.
RecordedFuture.IP.relatedEntities.RelatedCyberVulnerability.id string Recorded Future related vulnerability ID.
RecordedFuture.IP.relatedEntities.RelatedCyberVulnerability.name string Recorded Future related vulnerability name.
RecordedFuture.IP.relatedEntities.RelatedCyberVulnerability.type string Recorded Future related vulnerability type.
RecordedFuture.IP.relatedEntities.RelatedIpAddress.count number Recorded Future related IP address count.
RecordedFuture.IP.relatedEntities.RelatedIpAddress.id string Recorded Future related IP address ID.
RecordedFuture.IP.relatedEntities.RelatedIpAddress.name string Recorded Future related IP address name.
RecordedFuture.IP.relatedEntities.RelatedIpAddress.type string Recorded Future related IP address type.
RecordedFuture.IP.relatedEntities.RelatedInternetDomainName.count number Recorded Future related domain name count.
RecordedFuture.IP.relatedEntities.RelatedInternetDomainName.id string Recorded Future related domain name ID.
RecordedFuture.IP.relatedEntities.RelatedInternetDomainName.name string Recorded Future related domain name name.
RecordedFuture.IP.relatedEntities.RelatedInternetDomainName.type string Recorded Future related domain name type.
RecordedFuture.IP.relatedEntities.RelatedProduct.count number Recorded Future related product count.
RecordedFuture.IP.relatedEntities.RelatedProduct.id string Recorded Future related product ID.
RecordedFuture.IP.relatedEntities.RelatedProduct.name string Recorded Future related product name.
RecordedFuture.IP.relatedEntities.RelatedProduct.type string Recorded Future related product type.
RecordedFuture.IP.relatedEntities.RelatedCountries.count number Recorded Future related countries count.
RecordedFuture.IP.relatedEntities.RelatedCountries.id string Recorded Future related countries ID.
RecordedFuture.IP.relatedEntities.RelatedCountries.name string Recorded Future related countries name.
RecordedFuture.IP.relatedEntities.RelatedCountries.type string Recorded Future related countries type.
RecordedFuture.IP.relatedEntities.RelatedHash.count number Recorded Future related hash count.
RecordedFuture.IP.relatedEntities.RelatedHash.id string Recorded Future related hash ID.
RecordedFuture.IP.relatedEntities.RelatedHash.name string Recorded Future related hash name.
RecordedFuture.IP.relatedEntities.RelatedHash.type string Recorded Future related hash type.
RecordedFuture.IP.relatedEntities.RelatedTechnology.count number Recorded Future related technology count.
RecordedFuture.IP.relatedEntities.RelatedTechnology.id string Recorded Future related technology ID.
RecordedFuture.IP.relatedEntities.RelatedTechnology.name string Recorded Future related technology name.
RecordedFuture.IP.relatedEntities.RelatedTechnology.type string Recorded Future related technology type.
RecordedFuture.IP.relatedEntities.RelatedEmailAddress.count number Recorded Future related email address count.
RecordedFuture.IP.relatedEntities.RelatedEmailAddress.id string Recorded Future related email address ID.
RecordedFuture.IP.relatedEntities.RelatedEmailAddress.name string Recorded Future related email address name.
RecordedFuture.IP.relatedEntities.RelatedEmailAddress.type string Recorded Future related email address type.
RecordedFuture.IP.relatedEntities.RelatedAttackVector.count number Recorded Future related attack vector count.
RecordedFuture.IP.relatedEntities.RelatedAttackVector.id string Recorded Future related attack vector ID.
RecordedFuture.IP.relatedEntities.RelatedAttackVector.name string Recorded Future related attack vector name.
RecordedFuture.IP.relatedEntities.RelatedAttackVector.type string Recorded Future related attack vector type.
RecordedFuture.IP.relatedEntities.RelatedMalwareCategory.count number Recorded Future related malware category count.
RecordedFuture.IP.relatedEntities.RelatedMalwareCategory.id string Recorded Future related malware category ID.
RecordedFuture.IP.relatedEntities.RelatedMalwareCategory.name string Recorded Future related malware category name.
RecordedFuture.IP.relatedEntities.RelatedMalwareCategory.type string Recorded Future related malware category type.
RecordedFuture.IP.relatedEntities.RelatedOperations.count number Recorded Future related operations count.
RecordedFuture.IP.relatedEntities.RelatedOperations.id string Recorded Future related operations ID.
RecordedFuture.IP.relatedEntities.RelatedOperations.name string Recorded Future related operations name.
RecordedFuture.IP.relatedEntities.RelatedOperations.type string Recorded Future related operations type.
RecordedFuture.IP.relatedEntities.RelatedCompany.count number Recorded Future related company count.
RecordedFuture.IP.relatedEntities.RelatedCompany.id string Recorded Future related company ID.
RecordedFuture.IP.relatedEntities.RelatedCompany.name string Recorded Future related company name.
RecordedFuture.IP.relatedEntities.RelatedCompany.type string Recorded Future related company type.
RecordedFuture.IP.analystNotes.attributes.context_entities.id string Recorded Future analyst note context entity ID.
RecordedFuture.IP.analystNotes.attributes.context_entities.name string Recorded Future analyst note context entity name.
RecordedFuture.IP.analystNotes.attributes.context_entities.type string Recorded Future analyst note context entity type.
RecordedFuture.IP.analystNotes.attributes.note_entities.id string Recorded Future analyst note entity ID.
RecordedFuture.IP.analystNotes.attributes.note_entities.name string Recorded Future analyst note entity name.
RecordedFuture.IP.analystNotes.attributes.note_entities.type string Recorded Future analyst note entity type.
RecordedFuture.IP.analystNotes.attributes.published date Recorded Future analyst note publishing time.
RecordedFuture.IP.analystNotes.attributes.validated_on date Recorded Future analyst note validation time.
RecordedFuture.IP.analystNotes.attributes.text string Recorded Future analyst note content.
RecordedFuture.IP.analystNotes.attributes.title string Recorded Future analyst note title.
RecordedFuture.IP.analystNotes.attributes.topic.description string Recorded Future analyst note topic description.
RecordedFuture.IP.analystNotes.attributes.topic.id string Recorded Future analyst note topic ID.
RecordedFuture.IP.analystNotes.attributes.topic.name string Recorded Future analyst note topic name.
RecordedFuture.IP.analystNotes.attributes.topic.type string Recorded Future analyst note topic type.
RecordedFuture.IP.analystNotes.attributes.validation_urls.id string Recorded Future analyst note validation URL ID.
RecordedFuture.IP.analystNotes.attributes.validation_urls.name string Recorded Future analyst note validation URL.
RecordedFuture.IP.analystNotes.attributes.validation_urls.type string Recorded Future analyst note validation URL entity type.
RecordedFuture.IP.analystNotes.id string Recorded Future analyst note ID.
RecordedFuture.IP.analystNotes.source.id string Recorded Future analyst note source ID.
RecordedFuture.IP.analystNotes.source.name string Recorded Future analyst note source name.
RecordedFuture.IP.analystNotes.source.type string Recorded Future analyst note source type.
RecordedFuture.Domain.criticality number Risk criticality.
RecordedFuture.Domain.criticalityLabel string Risk criticality label.
RecordedFuture.Domain.riskString string Risk string.
RecordedFuture.Domain.riskSummary string Risk summary.
RecordedFuture.Domain.rules string Risk rules.
RecordedFuture.Domain.concatRules string All risk rules concatenated by comma.
RecordedFuture.Domain.score number Risk score.
RecordedFuture.Domain.firstSeen date Evidence first seen date.
RecordedFuture.Domain.lastSeen date Evidence last seen.
RecordedFuture.Domain.intelCard string Recorded Future intelligence card URL.
RecordedFuture.Domain.type string Recorded Future entity type.
RecordedFuture.Domain.name string Recorded Future entity name.
RecordedFuture.Domain.id string Recorded Future entity ID.
RecordedFuture.Domain.metrics.type string Recorded Future metrics type.
RecordedFuture.Domain.metrics.value number Recorded Future metrics value.
RecordedFuture.Domain.threatLists.description string Recorded Future threat list description.
RecordedFuture.Domain.threatLists.id string Recorded Future threat list ID.
RecordedFuture.Domain.threatLists.name string Recorded Future threat list name.
RecordedFuture.Domain.threatLists.type string Recorded Future threat list type.
RecordedFuture.Domain.relatedEntities.RelatedAttacker.count number Recorded Future related attacker count.
RecordedFuture.Domain.relatedEntities.RelatedAttacker.id string Recorded Future related attacker ID.
RecordedFuture.Domain.relatedEntities.RelatedAttacker.name string Recorded Future related attacker name.
RecordedFuture.Domain.relatedEntities.RelatedAttacker.type string Recorded Future related attacker type.
RecordedFuture.Domain.relatedEntities.RelatedTarget.count number Recorded Future related target count.
RecordedFuture.Domain.relatedEntities.RelatedTarget.id string Recorded Future related target ID.
RecordedFuture.Domain.relatedEntities.RelatedTarget.name string Recorded Future related target name.
RecordedFuture.Domain.relatedEntities.RelatedTarget.type string Recorded Future related target type.
RecordedFuture.Domain.relatedEntities.RelatedThreatActor.count number Recorded Future related threat actor count.
RecordedFuture.Domain.relatedEntities.RelatedThreatActor.id string Recorded Future related threat actor ID.
RecordedFuture.Domain.relatedEntities.RelatedThreatActor.name string Recorded Future related threat actor name.
RecordedFuture.Domain.relatedEntities.RelatedThreatActor.type string Recorded Future related threat actor type.
RecordedFuture.Domain.relatedEntities.RelatedMalware.count number Recorded Future related malware count.
RecordedFuture.Domain.relatedEntities.RelatedMalware.id string Recorded Future related malware ID.
RecordedFuture.Domain.relatedEntities.RelatedMalware.name string Recorded Future related malware name.
RecordedFuture.Domain.relatedEntities.RelatedMalware.type string Recorded Future related malware type.
RecordedFuture.Domain.relatedEntities.RelatedCyberVulnerability.count number Recorded Future related vulnerability count.
RecordedFuture.Domain.relatedEntities.RelatedCyberVulnerability.id string Recorded Future related vulnerability ID.
RecordedFuture.Domain.relatedEntities.RelatedCyberVulnerability.name string Recorded Future related vulnerability name.
RecordedFuture.Domain.relatedEntities.RelatedCyberVulnerability.type string Recorded Future related vulnerability type.
RecordedFuture.Domain.relatedEntities.RelatedIpAddress.count number Recorded Future related IP address count.
RecordedFuture.Domain.relatedEntities.RelatedIpAddress.id string Recorded Future related IP address ID.
RecordedFuture.Domain.relatedEntities.RelatedIpAddress.name string Recorded Future related IP address name.
RecordedFuture.Domain.relatedEntities.RelatedIpAddress.type string Recorded Future related IP address type.
RecordedFuture.Domain.relatedEntities.RelatedInternetDomainName.count number Recorded Future related domain name count.
RecordedFuture.Domain.relatedEntities.RelatedInternetDomainName.id string Recorded Future related domain name ID.
RecordedFuture.Domain.relatedEntities.RelatedInternetDomainName.name string Recorded Future related domain name name.
RecordedFuture.Domain.relatedEntities.RelatedInternetDomainName.type string Recorded Future related domain name type.
RecordedFuture.Domain.relatedEntities.RelatedProduct.count number Recorded Future related product count.
RecordedFuture.Domain.relatedEntities.RelatedProduct.id string Recorded Future related product ID.
RecordedFuture.Domain.relatedEntities.RelatedProduct.name string Recorded Future related product name.
RecordedFuture.Domain.relatedEntities.RelatedProduct.type string Recorded Future related product type.
RecordedFuture.Domain.relatedEntities.RelatedCountries.count number Recorded Future related countries count.
RecordedFuture.Domain.relatedEntities.RelatedCountries.id string Recorded Future related countries ID.
RecordedFuture.Domain.relatedEntities.RelatedCountries.name string Recorded Future related countries name.
RecordedFuture.Domain.relatedEntities.RelatedCountries.type string Recorded Future related countries type.
RecordedFuture.Domain.relatedEntities.RelatedHash.count number Recorded Future related hash count.
RecordedFuture.Domain.relatedEntities.RelatedHash.id string Recorded Future related hash ID.
RecordedFuture.Domain.relatedEntities.RelatedHash.name string Recorded Future related hash name.
RecordedFuture.Domain.relatedEntities.RelatedHash.type string Recorded Future related hash type.
RecordedFuture.Domain.relatedEntities.RelatedTechnology.count number Recorded Future related technology count.
RecordedFuture.Domain.relatedEntities.RelatedTechnology.id string Recorded Future related technology ID.
RecordedFuture.Domain.relatedEntities.RelatedTechnology.name string Recorded Future related technology name.
RecordedFuture.Domain.relatedEntities.RelatedTechnology.type string Recorded Future related technology type.
RecordedFuture.Domain.relatedEntities.RelatedEmailAddress.count number Recorded Future related email address count.
RecordedFuture.Domain.relatedEntities.RelatedEmailAddress.id string Recorded Future related email address ID.
RecordedFuture.Domain.relatedEntities.RelatedEmailAddress.name string Recorded Future related email address name.
RecordedFuture.Domain.relatedEntities.RelatedEmailAddress.type string Recorded Future related email address type.
RecordedFuture.Domain.relatedEntities.RelatedAttackVector.count number Recorded Future related attack vector count.
RecordedFuture.Domain.relatedEntities.RelatedAttackVector.id string Recorded Future related attack vector ID.
RecordedFuture.Domain.relatedEntities.RelatedAttackVector.name string Recorded Future related attack vector name.
RecordedFuture.Domain.relatedEntities.RelatedAttackVector.type string Recorded Future related attack vector type.
RecordedFuture.Domain.relatedEntities.RelatedMalwareCategory.count number Recorded Future related malware category count.
RecordedFuture.Domain.relatedEntities.RelatedMalwareCategory.id string Recorded Future related malware category ID.
RecordedFuture.Domain.relatedEntities.RelatedMalwareCategory.name string Recorded Future related malware category name.
RecordedFuture.Domain.relatedEntities.RelatedMalwareCategory.type string Recorded Future related malware category type.
RecordedFuture.Domain.relatedEntities.RelatedOperations.count number Recorded Future related operations count.
RecordedFuture.Domain.relatedEntities.RelatedOperations.id string Recorded Future related operations ID.
RecordedFuture.Domain.relatedEntities.RelatedOperations.name string Recorded Future related operations name.
RecordedFuture.Domain.relatedEntities.RelatedOperations.type string Recorded Future related operations type.
RecordedFuture.Domain.relatedEntities.RelatedCompany.count number Recorded Future related company count.
RecordedFuture.Domain.relatedEntities.RelatedCompany.id string Recorded Future related company ID.
RecordedFuture.Domain.relatedEntities.RelatedCompany.name string Recorded Future related company name.
RecordedFuture.Domain.relatedEntities.RelatedCompany.type string Recorded Future related company type.
RecordedFuture.Domain.analystNotes.attributes.context_entities.id string Recorded Future analyst note context entity ID.
RecordedFuture.Domain.analystNotes.attributes.context_entities.name string Recorded Future analyst note context entity name.
RecordedFuture.Domain.analystNotes.attributes.context_entities.type string Recorded Future analyst note context entity type.
RecordedFuture.Domain.analystNotes.attributes.note_entities.id string Recorded Future analyst note entity ID.
RecordedFuture.Domain.analystNotes.attributes.note_entities.name string Recorded Future analyst note entity name.
RecordedFuture.Domain.analystNotes.attributes.note_entities.type string Recorded Future analyst note entity type.
RecordedFuture.Domain.analystNotes.attributes.published date Recorded Future analyst note publishing time.
RecordedFuture.Domain.analystNotes.attributes.validated_on date Recorded Future analyst note validation time.
RecordedFuture.Domain.analystNotes.attributes.text string Recorded Future analyst note content.
RecordedFuture.Domain.analystNotes.attributes.title string Recorded Future analyst note title.
RecordedFuture.Domain.analystNotes.attributes.topic.description string Recorded Future analyst note topic description.
RecordedFuture.Domain.analystNotes.attributes.topic.id string Recorded Future analyst note topic ID.
RecordedFuture.Domain.analystNotes.attributes.topic.name string Recorded Future analyst note topic name.
RecordedFuture.Domain.analystNotes.attributes.topic.type string Recorded Future analyst note topic type.
RecordedFuture.Domain.analystNotes.attributes.validation_urls.id string Recorded Future analyst note validation URL ID.
RecordedFuture.Domain.analystNotes.attributes.validation_urls.name string Recorded Future analyst note validation URL.
RecordedFuture.Domain.analystNotes.attributes.validation_urls.type string Recorded Future analyst note validation URL entity type.
RecordedFuture.Domain.analystNotes.id string Recorded Future analyst note ID.
RecordedFuture.Domain.analystNotes.source.id string Recorded Future analyst note source ID.
RecordedFuture.Domain.analystNotes.source.name string Recorded Future analyst note source name.
RecordedFuture.Domain.analystNotes.source.type string Recorded Future analyst note source type.
RecordedFuture.CVE.criticality number Risk criticality.
RecordedFuture.CVE.criticalityLabel string Risk criticality label.
RecordedFuture.CVE.riskString string Risk string.
RecordedFuture.CVE.riskSummary string Risk summary.
RecordedFuture.CVE.rules string Risk rules.
RecordedFuture.CVE.concatRules string All risk rules concatenated by comma.
RecordedFuture.CVE.score number Risk score.
RecordedFuture.CVE.firstSeen date Evidence first seen.
RecordedFuture.CVE.lastSeen date Evidence last seen.
RecordedFuture.CVE.intelCard string Recorded Future intelligence card URL.
RecordedFuture.CVE.hashAlgorithm string Hash algorithm.
RecordedFuture.CVE.type string Recorded Future entity type.
RecordedFuture.CVE.name string Recorded Future entity name.
RecordedFuture.CVE.id string Recorded Future entity ID.
RecordedFuture.CVE.metrics.type string Recorded Future metrics type.
RecordedFuture.CVE.metrics.value number Recorded Future metrics value.
RecordedFuture.CVE.threatLists.description string Recorded Future threat list description.
RecordedFuture.CVE.threatLists.id string Recorded Future threat list ID.
RecordedFuture.CVE.threatLists.name string Recorded Future threat list name.
RecordedFuture.CVE.threatLists.type string Recorded Future threat list type.
RecordedFuture.CVE.relatedEntities.RelatedAttacker.count number Recorded Future related attacker count.
RecordedFuture.CVE.relatedEntities.RelatedAttacker.id string Recorded Future related attacker ID.
RecordedFuture.CVE.relatedEntities.RelatedAttacker.name string Recorded Future related attacker name.
RecordedFuture.CVE.relatedEntities.RelatedAttacker.type string Recorded Future related attacker type.
RecordedFuture.CVE.relatedEntities.RelatedTarget.count number Recorded Future related target count.
RecordedFuture.CVE.relatedEntities.RelatedTarget.id string Recorded Future related target ID.
RecordedFuture.CVE.relatedEntities.RelatedTarget.name string Recorded Future related target name.
RecordedFuture.CVE.relatedEntities.RelatedTarget.type string Recorded Future related target type.
RecordedFuture.CVE.relatedEntities.RelatedThreatActor.count number Recorded Future related threat actor count.
RecordedFuture.CVE.relatedEntities.RelatedThreatActor.id string Recorded Future related threat actor ID.
RecordedFuture.CVE.relatedEntities.RelatedThreatActor.name string Recorded Future related threat actor name.
RecordedFuture.CVE.relatedEntities.RelatedThreatActor.type string Recorded Future related threat actor type.
RecordedFuture.CVE.relatedEntities.RelatedMalware.count number Recorded Future related malware count.
RecordedFuture.CVE.relatedEntities.RelatedMalware.id string Recorded Future related malware ID.
RecordedFuture.CVE.relatedEntities.RelatedMalware.name string Recorded Future related malware name.
RecordedFuture.CVE.relatedEntities.RelatedMalware.type string Recorded Future related malware type.
RecordedFuture.CVE.relatedEntities.RelatedCyberVulnerability.count number Recorded Future related vulnerability count.
RecordedFuture.CVE.relatedEntities.RelatedCyberVulnerability.id string Recorded Future related vulnerability ID.
RecordedFuture.CVE.relatedEntities.RelatedCyberVulnerability.name string Recorded Future related vulnerability name.
RecordedFuture.CVE.relatedEntities.RelatedCyberVulnerability.type string Recorded Future related vulnerability type.
RecordedFuture.CVE.relatedEntities.RelatedIpAddress.count number Recorded Future related IP address count.
RecordedFuture.CVE.relatedEntities.RelatedIpAddress.id string Recorded Future related IP address ID.
RecordedFuture.CVE.relatedEntities.RelatedIpAddress.name string Recorded Future related IP address name.
RecordedFuture.CVE.relatedEntities.RelatedIpAddress.type string Recorded Future related IP address type.
RecordedFuture.CVE.relatedEntities.RelatedInternetDomainName.count number Recorded Future related domain name count.
RecordedFuture.CVE.relatedEntities.RelatedInternetDomainName.id string Recorded Future related domain name ID.
RecordedFuture.CVE.relatedEntities.RelatedInternetDomainName.name string Recorded Future related domain name name.
RecordedFuture.CVE.relatedEntities.RelatedInternetDomainName.type string Recorded Future related domain name type.
RecordedFuture.CVE.relatedEntities.RelatedProduct.count number Recorded Future related product count.
RecordedFuture.CVE.relatedEntities.RelatedProduct.id string Recorded Future related product ID.
RecordedFuture.CVE.relatedEntities.RelatedProduct.name string Recorded Future related product name.
RecordedFuture.CVE.relatedEntities.RelatedProduct.type string Recorded Future related product type.
RecordedFuture.CVE.relatedEntities.RelatedCountries.count number Recorded Future related countries count.
RecordedFuture.CVE.relatedEntities.RelatedCountries.id string Recorded Future related countries ID.
RecordedFuture.CVE.relatedEntities.RelatedCountries.name string Recorded Future related countries name.
RecordedFuture.CVE.relatedEntities.RelatedCountries.type string Recorded Future related countries type.
RecordedFuture.CVE.relatedEntities.RelatedHash.count number Recorded Future related hash count.
RecordedFuture.CVE.relatedEntities.RelatedHash.id string Recorded Future related hash ID.
RecordedFuture.CVE.relatedEntities.RelatedHash.name string Recorded Future related hash name.
RecordedFuture.CVE.relatedEntities.RelatedHash.type string Recorded Future related hash type.
RecordedFuture.CVE.relatedEntities.RelatedTechnology.count number Recorded Future related technology count.
RecordedFuture.CVE.relatedEntities.RelatedTechnology.id string Recorded Future related technology ID.
RecordedFuture.CVE.relatedEntities.RelatedTechnology.name string Recorded Future related technology name.
RecordedFuture.CVE.relatedEntities.RelatedTechnology.type string Recorded Future related technology type.
RecordedFuture.CVE.relatedEntities.RelatedEmailAddress.count number Recorded Future related email address count.
RecordedFuture.CVE.relatedEntities.RelatedEmailAddress.id string Recorded Future related email address ID.
RecordedFuture.CVE.relatedEntities.RelatedEmailAddress.name string Recorded Future related email address name.
RecordedFuture.CVE.relatedEntities.RelatedEmailAddress.type string Recorded Future related email address type.
RecordedFuture.CVE.relatedEntities.RelatedAttackVector.count number Recorded Future related attack vector count.
RecordedFuture.CVE.relatedEntities.RelatedAttackVector.id string Recorded Future related attack vector ID.
RecordedFuture.CVE.relatedEntities.RelatedAttackVector.name string Recorded Future related attack vector name.
RecordedFuture.CVE.relatedEntities.RelatedAttackVector.type string Recorded Future related attack vector type.
RecordedFuture.CVE.relatedEntities.RelatedMalwareCategory.count number Recorded Future related malware category count.
RecordedFuture.CVE.relatedEntities.RelatedMalwareCategory.id string Recorded Future related malware category ID.
RecordedFuture.CVE.relatedEntities.RelatedMalwareCategory.name string Recorded Future related malware category name.
RecordedFuture.CVE.relatedEntities.RelatedMalwareCategory.type string Recorded Future related malware category type.
RecordedFuture.CVE.relatedEntities.RelatedOperations.count number Recorded Future related operations count.
RecordedFuture.CVE.relatedEntities.RelatedOperations.id string Recorded Future related operations ID.
RecordedFuture.CVE.relatedEntities.RelatedOperations.name string Recorded Future related operations name.
RecordedFuture.CVE.relatedEntities.RelatedOperations.type string Recorded Future related operations type.
RecordedFuture.CVE.relatedEntities.RelatedCompany.count number Recorded Future related company count.
RecordedFuture.CVE.relatedEntities.RelatedCompany.id string Recorded Future related company ID.
RecordedFuture.CVE.relatedEntities.RelatedCompany.name string Recorded Future related company name.
RecordedFuture.CVE.relatedEntities.RelatedCompany.type string Recorded Future related company type.
RecordedFuture.CVE.relatedLinks string Recorded Future CVE related links.
RecordedFuture.CVE.analystNotes.attributes.context_entities.id string Recorded Future analyst note context entity ID.
RecordedFuture.CVE.analystNotes.attributes.context_entities.name string Recorded Future analyst note context entity name.
RecordedFuture.CVE.analystNotes.attributes.context_entities.type string Recorded Future analyst note context entity type.
RecordedFuture.CVE.analystNotes.attributes.note_entities.id string Recorded Future analyst note entity ID.
RecordedFuture.CVE.analystNotes.attributes.note_entities.name string Recorded Future analyst note entity name.
RecordedFuture.CVE.analystNotes.attributes.note_entities.type string Recorded Future analyst note entity type.
RecordedFuture.CVE.analystNotes.attributes.published date Recorded Future analyst note publishing time.
RecordedFuture.CVE.analystNotes.attributes.validated_on date Recorded Future analyst note validation time.
RecordedFuture.CVE.analystNotes.attributes.text string Recorded Future analyst note content.
RecordedFuture.CVE.analystNotes.attributes.title string Recorded Future analyst note title.
RecordedFuture.CVE.analystNotes.attributes.topic.description string Recorded Future analyst note topic description.
RecordedFuture.CVE.analystNotes.attributes.topic.id string Recorded Future analyst note topic ID.
RecordedFuture.CVE.analystNotes.attributes.topic.name string Recorded Future analyst note topic name.
RecordedFuture.CVE.analystNotes.attributes.topic.type string Recorded Future analyst note topic type.
RecordedFuture.CVE.analystNotes.attributes.validation_urls.id string Recorded Future analyst note validation URL ID.
RecordedFuture.CVE.analystNotes.attributes.validation_urls.name string Recorded Future analyst note validation URL.
RecordedFuture.CVE.analystNotes.attributes.validation_urls.type string Recorded Future analyst note validation URL entity type.
RecordedFuture.CVE.analystNotes.id string Recorded Future analyst note ID.
RecordedFuture.CVE.analystNotes.source.id string Recorded Future analyst note source ID.
RecordedFuture.CVE.analystNotes.source.name string Recorded Future analyst note source name.
RecordedFuture.CVE.analystNotes.source.type string Recorded Future analyst note source type.
RecordedFuture.CVE.cpe string Recorded Future CPE information.
RecordedFuture.File.criticality number Risk criticality.
RecordedFuture.File.criticalityLabel string Risk criticality label.
RecordedFuture.File.riskString string Risk string.
RecordedFuture.File.riskSummary string Risk summary.
RecordedFuture.File.rules string Risk rules.
RecordedFuture.File.concatRules string All risk rules concatenated by comma.
RecordedFuture.File.score number Risk score.
RecordedFuture.File.firstSeen date Evidence first seen.
RecordedFuture.File.lastSeen date Evidence last seen.
RecordedFuture.File.intelCard string Recorded Future intelligence card URL.
RecordedFuture.File.hashAlgorithm string Hash algorithm.
RecordedFuture.File.type string Recorded Future entity type.
RecordedFuture.File.name string Recorded Future entity name.
RecordedFuture.File.id string Recorded Future entity ID.
RecordedFuture.File.metrics.type string Recorded Future metrics type.
RecordedFuture.File.metrics.value number Recorded Future metrics value.
RecordedFuture.File.threatLists.description string Recorded Future threat list description.
RecordedFuture.File.threatLists.id string Recorded Future threat list ID.
RecordedFuture.File.threatLists.name string Recorded Future threat list name.
RecordedFuture.File.threatLists.type string Recorded Future threat list type.
RecordedFuture.File.relatedEntities.RelatedAttacker.count number Recorded Future related attacker count.
RecordedFuture.File.relatedEntities.RelatedAttacker.id string Recorded Future related attacker ID.
RecordedFuture.File.relatedEntities.RelatedAttacker.name string Recorded Future related attacker name.
RecordedFuture.File.relatedEntities.RelatedAttacker.type string Recorded Future related attacker type.
RecordedFuture.File.relatedEntities.RelatedTarget.count number Recorded Future related target count.
RecordedFuture.File.relatedEntities.RelatedTarget.id string Recorded Future related target ID.
RecordedFuture.File.relatedEntities.RelatedTarget.name string Recorded Future related target name.
RecordedFuture.File.relatedEntities.RelatedTarget.type string Recorded Future related target type.
RecordedFuture.File.relatedEntities.RelatedThreatActor.count number Recorded Future related threat actor count.
RecordedFuture.File.relatedEntities.RelatedThreatActor.id string Recorded Future related threat actor ID.
RecordedFuture.File.relatedEntities.RelatedThreatActor.name string Recorded Future related threat actor name.
RecordedFuture.File.relatedEntities.RelatedThreatActor.type string Recorded Future related threat actor type.
RecordedFuture.File.relatedEntities.RelatedMalware.count number Recorded Future related malware count.
RecordedFuture.File.relatedEntities.RelatedMalware.id string Recorded Future related malware ID.
RecordedFuture.File.relatedEntities.RelatedMalware.name string Recorded Future related malware name.
RecordedFuture.File.relatedEntities.RelatedMalware.type string Recorded Future related malware type.
RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.count number Recorded Future related vulnerability count.
RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.id string Recorded Future related vulnerability ID.
RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.name string Recorded Future related vulnerability name.
RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.type string Recorded Future related vulnerability type.
RecordedFuture.File.relatedEntities.RelatedIpAddress.count number Recorded Future related IP address count.
RecordedFuture.File.relatedEntities.RelatedIpAddress.id string Recorded Future related IP address ID.
RecordedFuture.File.relatedEntities.RelatedIpAddress.name string Recorded Future related IP address name.
RecordedFuture.File.relatedEntities.RelatedIpAddress.type string Recorded Future related IP address type.
RecordedFuture.File.relatedEntities.RelatedInternetDomainName.count number Recorded Future related domain name count.
RecordedFuture.File.relatedEntities.RelatedInternetDomainName.id string Recorded Future related domain name ID.
RecordedFuture.File.relatedEntities.RelatedInternetDomainName.name string Recorded Future related domain name name.
RecordedFuture.File.relatedEntities.RelatedInternetDomainName.type string Recorded Future related domain name type.
RecordedFuture.File.relatedEntities.RelatedProduct.count number Recorded Future related product count.
RecordedFuture.File.relatedEntities.RelatedProduct.id string Recorded Future related product ID.
RecordedFuture.File.relatedEntities.RelatedProduct.name string Recorded Future related product name.
RecordedFuture.File.relatedEntities.RelatedProduct.type string Recorded Future related product type.
RecordedFuture.File.relatedEntities.RelatedCountries.count number Recorded Future related countries count.
RecordedFuture.File.relatedEntities.RelatedCountries.id string Recorded Future related countries ID.
RecordedFuture.File.relatedEntities.RelatedCountries.name string Recorded Future related countries name.
RecordedFuture.File.relatedEntities.RelatedCountries.type string Recorded Future related countries type.
RecordedFuture.File.relatedEntities.RelatedHash.count number Recorded Future related hash count.
RecordedFuture.File.relatedEntities.RelatedHash.id string Recorded Future related hash ID.
RecordedFuture.File.relatedEntities.RelatedHash.name string Recorded Future related hash name.
RecordedFuture.File.relatedEntities.RelatedHash.type string Recorded Future related hash type.
RecordedFuture.File.relatedEntities.RelatedTechnology.count number Recorded Future related technology count.
RecordedFuture.File.relatedEntities.RelatedTechnology.id string Recorded Future related technology ID.
RecordedFuture.File.relatedEntities.RelatedTechnology.name string Recorded Future related technology name.
RecordedFuture.File.relatedEntities.RelatedTechnology.type string Recorded Future related technology type.
RecordedFuture.File.relatedEntities.RelatedEmailAddress.count number Recorded Future related email address count.
RecordedFuture.File.relatedEntities.RelatedEmailAddress.id string Recorded Future related email address ID.
RecordedFuture.File.relatedEntities.RelatedEmailAddress.name string Recorded Future related email address name.
RecordedFuture.File.relatedEntities.RelatedEmailAddress.type string Recorded Future related email address type.
RecordedFuture.File.relatedEntities.RelatedAttackVector.count number Recorded Future related attack vector count.
RecordedFuture.File.relatedEntities.RelatedAttackVector.id string Recorded Future related attack vector ID.
RecordedFuture.File.relatedEntities.RelatedAttackVector.name string Recorded Future related attack vector name.
RecordedFuture.File.relatedEntities.RelatedAttackVector.type string Recorded Future related attack vector type.
RecordedFuture.File.relatedEntities.RelatedMalwareCategory.count number Recorded Future related malware category count.
RecordedFuture.File.relatedEntities.RelatedMalwareCategory.id string Recorded Future related malware category ID.
RecordedFuture.File.relatedEntities.RelatedMalwareCategory.name string Recorded Future related malware category name.
RecordedFuture.File.relatedEntities.RelatedMalwareCategory.type string Recorded Future related malware category type.
RecordedFuture.File.relatedEntities.RelatedOperations.count number Recorded Future related operations count.
RecordedFuture.File.relatedEntities.RelatedOperations.id string Recorded Future related operations ID.
RecordedFuture.File.relatedEntities.RelatedOperations.name string Recorded Future related operations name.
RecordedFuture.File.relatedEntities.RelatedOperations.type string Recorded Future related operations type.
RecordedFuture.File.relatedEntities.RelatedCompany.count number Recorded Future related company count.
RecordedFuture.File.relatedEntities.RelatedCompany.id string Recorded Future related company ID.
RecordedFuture.File.relatedEntities.RelatedCompany.name string Recorded Future related company name.
RecordedFuture.File.relatedEntities.RelatedCompany.type string Recorded Future related company type.
RecordedFuture.File.analystNotes.attributes.context_entities.id string Recorded Future analyst note context entity ID.
RecordedFuture.File.analystNotes.attributes.context_entities.name string Recorded Future analyst note context entity name.
RecordedFuture.File.analystNotes.attributes.context_entities.type string Recorded Future analyst note context entity type.
RecordedFuture.File.analystNotes.attributes.note_entities.id string Recorded Future analyst note entity ID.
RecordedFuture.File.analystNotes.attributes.note_entities.name string Recorded Future analyst note entity name.
RecordedFuture.File.analystNotes.attributes.note_entities.type string Recorded Future analyst note entity type.
RecordedFuture.File.analystNotes.attributes.published date Recorded Future analyst note publishing time.
RecordedFuture.File.analystNotes.attributes.validated_on date Recorded Future analyst note validation time.
RecordedFuture.File.analystNotes.attributes.text string Recorded Future analyst note content.
RecordedFuture.File.analystNotes.attributes.title string Recorded Future analyst note title.
RecordedFuture.File.analystNotes.attributes.topic.description string Recorded Future analyst note topic description.
RecordedFuture.File.analystNotes.attributes.topic.id string Recorded Future analyst note topic ID.
RecordedFuture.File.analystNotes.attributes.topic.name string Recorded Future analyst note topic name.
RecordedFuture.File.analystNotes.attributes.topic.type string Recorded Future analyst note topic type.
RecordedFuture.File.analystNotes.attributes.validation_urls.id string Recorded Future analyst note validation URL ID.
RecordedFuture.File.analystNotes.attributes.validation_urls.name string Recorded Future analyst note validation URL.
RecordedFuture.File.analystNotes.attributes.validation_urls.type string Recorded Future analyst note validation URL entity type.
RecordedFuture.File.analystNotes.id string Recorded Future analyst note ID.
RecordedFuture.File.analystNotes.source.id string Recorded Future analyst note source ID.
RecordedFuture.File.analystNotes.source.name string Recorded Future analyst note source name.
RecordedFuture.File.analystNotes.source.type string Recorded Future analyst note source type.
RecordedFuture.URL.criticality number Risk criticality.
RecordedFuture.URL.criticalityLabel string Risk criticality label.
RecordedFuture.URL.riskString string Risk string.
RecordedFuture.URL.riskSummary string Risk summary.
RecordedFuture.URL.rules string Risk rules.
RecordedFuture.URL.concatRules string All risk rules concatenated by comma.
RecordedFuture.URL.score number Risk score.
RecordedFuture.URL.firstSeen date Evidence first seen.
RecordedFuture.URL.lastSeen date Evidence last seen.
RecordedFuture.URL.intelCard string Recorded Future intelligence card URL.
RecordedFuture.URL.type string Recorded Future entity type.
RecordedFuture.URL.name string Recorded Future entity name.
RecordedFuture.URL.id string Recorded Future entity ID.
RecordedFuture.URL.metrics.type string Recorded Future metrics type.
RecordedFuture.URL.metrics.value number Recorded Future metrics value.
RecordedFuture.URL.threatLists.description string Recorded Future threat list description.
RecordedFuture.URL.threatLists.id string Recorded Future threat list ID.
RecordedFuture.URL.threatLists.name string Recorded Future threat list name.
RecordedFuture.URL.threatLists.type string Recorded Future threat list type.
RecordedFuture.URL.relatedEntities.RelatedAttacker.count number Recorded Future related attacker count.
RecordedFuture.URL.relatedEntities.RelatedAttacker.id string Recorded Future related attacker ID.
RecordedFuture.URL.relatedEntities.RelatedAttacker.name string Recorded Future related attacker name.
RecordedFuture.URL.relatedEntities.RelatedAttacker.type string Recorded Future related attacker type.
RecordedFuture.URL.relatedEntities.RelatedTarget.count number Recorded Future related target count.
RecordedFuture.URL.relatedEntities.RelatedTarget.id string Recorded Future related target ID.
RecordedFuture.URL.relatedEntities.RelatedTarget.name string Recorded Future related target name.
RecordedFuture.URL.relatedEntities.RelatedTarget.type string Recorded Future related target type.
RecordedFuture.URL.relatedEntities.RelatedThreatActor.count number Recorded Future related threat actor count.
RecordedFuture.URL.relatedEntities.RelatedThreatActor.id string Recorded Future related threat actor ID.
RecordedFuture.URL.relatedEntities.RelatedThreatActor.name string Recorded Future related threat actor name.
RecordedFuture.URL.relatedEntities.RelatedThreatActor.type string Recorded Future related threat actor type.
RecordedFuture.URL.relatedEntities.RelatedMalware.count number Recorded Future related malware count.
RecordedFuture.URL.relatedEntities.RelatedMalware.id string Recorded Future related malware ID.
RecordedFuture.URL.relatedEntities.RelatedMalware.name string Recorded Future related malware name.
RecordedFuture.URL.relatedEntities.RelatedMalware.type string Recorded Future related malware type.
RecordedFuture.URL.relatedEntities.RelatedCyberVulnerability.count number Recorded Future related vulnerability count.
RecordedFuture.URL.relatedEntities.RelatedCyberVulnerability.id string Recorded Future related vulnerability ID.
RecordedFuture.URL.relatedEntities.RelatedCyberVulnerability.name string Recorded Future related vulnerability name.
RecordedFuture.URL.relatedEntities.RelatedCyberVulnerability.type string Recorded Future related vulnerability type.
RecordedFuture.URL.relatedEntities.RelatedIpAddress.count number Recorded Future related IP address count.
RecordedFuture.URL.relatedEntities.RelatedIpAddress.id string Recorded Future related IP address ID.
RecordedFuture.URL.relatedEntities.RelatedIpAddress.name string Recorded Future related IP address name.
RecordedFuture.URL.relatedEntities.RelatedIpAddress.type string Recorded Future related IP address type.
RecordedFuture.URL.relatedEntities.RelatedInternetDomainName.count number Recorded Future related domain name count.
RecordedFuture.URL.relatedEntities.RelatedInternetDomainName.id string Recorded Future related domain name ID.
RecordedFuture.URL.relatedEntities.RelatedInternetDomainName.name string Recorded Future related domain name name.
RecordedFuture.URL.relatedEntities.RelatedInternetDomainName.type string Recorded Future related domain name type.
RecordedFuture.URL.relatedEntities.RelatedProduct.count number Recorded Future related product count.
RecordedFuture.URL.relatedEntities.RelatedProduct.id string Recorded Future related product ID.
RecordedFuture.URL.relatedEntities.RelatedProduct.name string Recorded Future related product name.
RecordedFuture.URL.relatedEntities.RelatedProduct.type string Recorded Future related product type.
RecordedFuture.URL.relatedEntities.RelatedCountries.count number Recorded Future related countries count.
RecordedFuture.URL.relatedEntities.RelatedCountries.id string Recorded Future related countries ID.
RecordedFuture.URL.relatedEntities.RelatedCountries.name string Recorded Future related countries name.
RecordedFuture.URL.relatedEntities.RelatedCountries.type string Recorded Future related countries type.
RecordedFuture.URL.relatedEntities.RelatedHash.count number Recorded Future related hash count.
RecordedFuture.URL.relatedEntities.RelatedHash.id string Recorded Future related hash ID.
RecordedFuture.URL.relatedEntities.RelatedHash.name string Recorded Future related hash name.
RecordedFuture.URL.relatedEntities.RelatedHash.type string Recorded Future related hash type.
RecordedFuture.URL.relatedEntities.RelatedTechnology.count number Recorded Future related technology count.
RecordedFuture.URL.relatedEntities.RelatedTechnology.id string Recorded Future related technology ID.
RecordedFuture.URL.relatedEntities.RelatedTechnology.name string Recorded Future related technology name.
RecordedFuture.URL.relatedEntities.RelatedTechnology.type string Recorded Future related technology type.
RecordedFuture.URL.relatedEntities.RelatedEmailAddress.count number Recorded Future related email address count.
RecordedFuture.URL.relatedEntities.RelatedEmailAddress.id string Recorded Future related email address ID.
RecordedFuture.URL.relatedEntities.RelatedEmailAddress.name string Recorded Future related email address name.
RecordedFuture.URL.relatedEntities.RelatedEmailAddress.type string Recorded Future related email address type.
RecordedFuture.URL.relatedEntities.RelatedAttackVector.count number Recorded Future related attack vector count.
RecordedFuture.URL.relatedEntities.RelatedAttackVector.id string Recorded Future related attack vector ID.
RecordedFuture.URL.relatedEntities.RelatedAttackVector.name string Recorded Future related attack vector name.
RecordedFuture.URL.relatedEntities.RelatedAttackVector.type string Recorded Future related attack vector type.
RecordedFuture.URL.relatedEntities.RelatedMalwareCategory.count number Recorded Future related malware category count.
RecordedFuture.URL.relatedEntities.RelatedMalwareCategory.id string Recorded Future related malware category ID.
RecordedFuture.URL.relatedEntities.RelatedMalwareCategory.name string Recorded Future related malware category name.
RecordedFuture.URL.relatedEntities.RelatedMalwareCategory.type string Recorded Future related malware category type.
RecordedFuture.URL.relatedEntities.RelatedOperations.count number Recorded Future related operations count.
RecordedFuture.URL.relatedEntities.RelatedOperations.id string Recorded Future related operations ID.
RecordedFuture.URL.relatedEntities.RelatedOperations.name string Recorded Future related operations name.
RecordedFuture.URL.relatedEntities.RelatedOperations.type string Recorded Future related operations type.
RecordedFuture.URL.relatedEntities.RelatedCompany.count number Recorded Future related company count.
RecordedFuture.URL.relatedEntities.RelatedCompany.id string Recorded Future related company ID.
RecordedFuture.URL.relatedEntities.RelatedCompany.name string Recorded Future related company name.
RecordedFuture.URL.relatedEntities.RelatedCompany.type string Recorded Future related company type.
RecordedFuture.URL.analystNotes.attributes.context_entities.id string Recorded Future analyst note context entity ID.
RecordedFuture.URL.analystNotes.attributes.context_entities.name string Recorded Future analyst note context entity name.
RecordedFuture.URL.analystNotes.attributes.context_entities.type string Recorded Future analyst note context entity type.
RecordedFuture.URL.analystNotes.attributes.note_entities.id string Recorded Future analyst note entity ID.
RecordedFuture.URL.analystNotes.attributes.note_entities.name string Recorded Future analyst note entity name.
RecordedFuture.URL.analystNotes.attributes.note_entities.type string Recorded Future analyst note entity type.
RecordedFuture.URL.analystNotes.attributes.published date Recorded Future analyst note publishing time.
RecordedFuture.URL.analystNotes.attributes.validated_on date Recorded Future analyst note validation time.
RecordedFuture.URL.analystNotes.attributes.text string Recorded Future analyst note content.
RecordedFuture.URL.analystNotes.attributes.title string Recorded Future analyst note title.
RecordedFuture.URL.analystNotes.attributes.topic.description string Recorded Future analyst note topic description.
RecordedFuture.URL.analystNotes.attributes.topic.id string Recorded Future analyst note topic ID.
RecordedFuture.URL.analystNotes.attributes.topic.name string Recorded Future analyst note topic name.
RecordedFuture.URL.analystNotes.attributes.topic.type string Recorded Future analyst note topic type.
RecordedFuture.URL.analystNotes.attributes.validation_urls.id string Recorded Future analyst note validation URL ID.
RecordedFuture.URL.analystNotes.attributes.validation_urls.name string Recorded Future analyst note validation URL.
RecordedFuture.URL.analystNotes.attributes.validation_urls.type string Recorded Future analyst note validation URL entity type.
RecordedFuture.URL.analystNotes.id string Recorded Future analyst note ID.
RecordedFuture.URL.analystNotes.source.id string Recorded Future analyst note source ID.
RecordedFuture.URL.analystNotes.source.name string Recorded Future analyst note source name.
RecordedFuture.URL.analystNotes.source.type string Recorded Future analyst note source type.
RecordedFuture.Malware.metrics.type string Recorded Future metrics type.
RecordedFuture.Malware.metrics.value number Recorded Future metrics value.
RecordedFuture.Malware.intelCard date Recorded Future intelligence card URL.
RecordedFuture.Malware.firstSeen date Evidence first seen.
RecordedFuture.Malware.lastSeen date Evidence last seen.
RecordedFuture.Malware.name date Recorded Future entity name.
RecordedFuture.Malware.type string Recorded Future entity type (always = “Malware”).
RecordedFuture.Malware.id string Recorded Future malware ID.
RecordedFuture.Malware.categories.id string Recorded Future malware category ID.
RecordedFuture.Malware.categories.name string Recorded Future malware category name.
RecordedFuture.Malware.categories.type string Recorded Future malware category type (always = “MalwareCategory”).
RecordedFuture.Malware.relatedEntities.RelatedAttacker.count number Recorded Future related attacker count.
RecordedFuture.Malware.relatedEntities.RelatedAttacker.id string Recorded Future related attacker ID.
RecordedFuture.Malware.relatedEntities.RelatedAttacker.name string Recorded Future related attacker name.
RecordedFuture.Malware.relatedEntities.RelatedAttacker.type string Recorded Future related attacker type.
RecordedFuture.Malware.relatedEntities.RelatedTarget.count number Recorded Future related target count.
RecordedFuture.Malware.relatedEntities.RelatedTarget.id string Recorded Future related target ID.
RecordedFuture.Malware.relatedEntities.RelatedTarget.name string Recorded Future related target name.
RecordedFuture.Malware.relatedEntities.RelatedTarget.type string Recorded Future related target type.
RecordedFuture.Malware.relatedEntities.RelatedThreatActor.count number Recorded Future related threat actor count.
RecordedFuture.Malware.relatedEntities.RelatedThreatActor.id string Recorded Future related threat actor ID.
RecordedFuture.Malware.relatedEntities.RelatedThreatActor.name string Recorded Future related threat actor name.
RecordedFuture.Malware.relatedEntities.RelatedThreatActor.type string Recorded Future related threat actor type.
RecordedFuture.Malware.relatedEntities.RelatedMalware.count number Recorded Future related malware count.
RecordedFuture.Malware.relatedEntities.RelatedMalware.id string Recorded Future related malware ID.
RecordedFuture.Malware.relatedEntities.RelatedMalware.name string Recorded Future related malware name.
RecordedFuture.Malware.relatedEntities.RelatedMalware.type string Recorded Future related malware type.
RecordedFuture.Malware.relatedEntities.RelatedCyberVulnerability.count number Recorded Future related vulnerability count.
RecordedFuture.Malware.relatedEntities.RelatedCyberVulnerability.id string Recorded Future related vulnerability ID.
RecordedFuture.Malware.relatedEntities.RelatedCyberVulnerability.name string Recorded Future related vulnerability name.
RecordedFuture.Malware.relatedEntities.RelatedCyberVulnerability.type string Recorded Future related vulnerability type.
RecordedFuture.Malware.relatedEntities.RelatedIpAddress.count number Recorded Future related IP address count.
RecordedFuture.Malware.relatedEntities.RelatedIpAddress.id string Recorded Future related IP address ID.
RecordedFuture.Malware.relatedEntities.RelatedIpAddress.name string Recorded Future related IP address name.
RecordedFuture.Malware.relatedEntities.RelatedIpAddress.type string Recorded Future related IP address type.
RecordedFuture.Malware.relatedEntities.RelatedInternetDomainName.count number Recorded Future related domain name count.
RecordedFuture.Malware.relatedEntities.RelatedInternetDomainName.id string Recorded Future related domain name ID.
RecordedFuture.Malware.relatedEntities.RelatedInternetDomainName.name string Recorded Future related domain name name.
RecordedFuture.Malware.relatedEntities.RelatedInternetDomainName.type string Recorded Future related domain name type.
RecordedFuture.Malware.relatedEntities.RelatedProduct.count number Recorded Future related product count.
RecordedFuture.Malware.relatedEntities.RelatedProduct.id string Recorded Future related product ID.
RecordedFuture.Malware.relatedEntities.RelatedProduct.name string Recorded Future related product name.
RecordedFuture.Malware.relatedEntities.RelatedProduct.type string Recorded Future related product type.
RecordedFuture.Malware.relatedEntities.RelatedCountries.count number Recorded Future related countries count.
RecordedFuture.Malware.relatedEntities.RelatedCountries.id string Recorded Future related countries ID.
RecordedFuture.Malware.relatedEntities.RelatedCountries.name string Recorded Future related countries name.
RecordedFuture.Malware.relatedEntities.RelatedCountries.type string Recorded Future related countries type.
RecordedFuture.Malware.relatedEntities.RelatedHash.count number Recorded Future related hash count.
RecordedFuture.Malware.relatedEntities.RelatedHash.id string Recorded Future related hash ID.
RecordedFuture.Malware.relatedEntities.RelatedHash.name string Recorded Future related hash name.
RecordedFuture.Malware.relatedEntities.RelatedHash.type string Recorded Future related hash type.
RecordedFuture.Malware.relatedEntities.RelatedTechnology.count number Recorded Future related technology count.
RecordedFuture.Malware.relatedEntities.RelatedTechnology.id string Recorded Future related technology ID.
RecordedFuture.Malware.relatedEntities.RelatedTechnology.name string Recorded Future related technology name.
RecordedFuture.Malware.relatedEntities.RelatedTechnology.type string Recorded Future related technology type.
RecordedFuture.Malware.relatedEntities.RelatedEmailAddress.count number Recorded Future related email address count.
RecordedFuture.Malware.relatedEntities.RelatedEmailAddress.id string Recorded Future related email address ID.
RecordedFuture.Malware.relatedEntities.RelatedEmailAddress.name string Recorded Future related email address name.
RecordedFuture.Malware.relatedEntities.RelatedEmailAddress.type string Recorded Future related email address type.
RecordedFuture.Malware.relatedEntities.RelatedAttackVector.count number Recorded Future related attack vector count.
RecordedFuture.Malware.relatedEntities.RelatedAttackVector.id string Recorded Future related attack vector ID.
RecordedFuture.Malware.relatedEntities.RelatedAttackVector.name string Recorded Future related attack vector name.
RecordedFuture.Malware.relatedEntities.RelatedAttackVector.type string Recorded Future related attack vector type.
RecordedFuture.Malware.relatedEntities.RelatedMalwareCategory.count number Recorded Future related malware category count.
RecordedFuture.Malware.relatedEntities.RelatedMalwareCategory.id string Recorded Future related malware category ID.
RecordedFuture.Malware.relatedEntities.RelatedMalwareCategory.name string Recorded Future related malware category name.
RecordedFuture.Malware.relatedEntities.RelatedMalwareCategory.type string Recorded Future related malware category type.
RecordedFuture.Malware.relatedEntities.RelatedOperations.count number Recorded Future related operations count.
RecordedFuture.Malware.relatedEntities.RelatedOperations.id string Recorded Future related operations ID.
RecordedFuture.Malware.relatedEntities.RelatedOperations.name string Recorded Future related operations name.
RecordedFuture.Malware.relatedEntities.RelatedOperations.type string Recorded Future related operations type.
RecordedFuture.Malware.relatedEntities.RelatedCompany.count number Recorded Future related company count.
RecordedFuture.Malware.relatedEntities.RelatedCompany.id string Recorded Future related company ID.
RecordedFuture.Malware.relatedEntities.RelatedCompany.name string Recorded Future related company name.
RecordedFuture.Malware.relatedEntities.RelatedCompany.type string Recorded Future related company type.
RecordedFuture.Malware.analystNotes.attributes.context_entities.id string Recorded Future analyst note context entity ID.
RecordedFuture.Malware.analystNotes.attributes.context_entities.name string Recorded Future analyst note context entity name.
RecordedFuture.Malware.analystNotes.attributes.context_entities.type string Recorded Future analyst note context entity type.
RecordedFuture.Malware.analystNotes.attributes.note_entities.id string Recorded Future analyst note entity ID.
RecordedFuture.Malware.analystNotes.attributes.note_entities.name string Recorded Future analyst note entity name.
RecordedFuture.Malware.analystNotes.attributes.note_entities.type string Recorded Future analyst note entity type.
RecordedFuture.Malware.analystNotes.attributes.published date Recorded Future analyst note publishing time.
RecordedFuture.Malware.analystNotes.attributes.validated_on date Recorded Future analyst note validation time.
RecordedFuture.Malware.analystNotes.attributes.text string Recorded Future analyst note content.
RecordedFuture.Malware.analystNotes.attributes.title string Recorded Future analyst note title.
RecordedFuture.Malware.analystNotes.attributes.topic.description string Recorded Future analyst note topic description.
RecordedFuture.Malware.analystNotes.attributes.topic.id string Recorded Future analyst note topic ID.
RecordedFuture.Malware.analystNotes.attributes.topic.name string Recorded Future analyst note topic name.
RecordedFuture.Malware.analystNotes.attributes.topic.type string Recorded Future analyst note topic type.
RecordedFuture.Malware.analystNotes.attributes.validation_urls.id string Recorded Future analyst note validation URL ID.
RecordedFuture.Malware.analystNotes.attributes.validation_urls.name string Recorded Future analyst note validation URL.
RecordedFuture.Malware.analystNotes.attributes.validation_urls.type string Recorded Future analyst note validation URL entity type.
RecordedFuture.Malware.analystNotes.id string Recorded Future analyst note ID.
RecordedFuture.Malware.analystNotes.source.id string Recorded Future analyst note source ID.
RecordedFuture.Malware.analystNotes.source.name string Recorded Future analyst note source name.
RecordedFuture.Malware.analystNotes.source.type string Recorded Future analyst note source type.

recordedfuture-links

Get Insikt Group Research Links for an IP, Domain, CVE, URL, File, or Malware.

Base Command

recordedfuture-links

Input

Argument Name Description Required
entity_type The type of entity for which to fetch context. Should be provided with its value in entityValue argument. Can be “domain”, “ip”, “file”, “url”, “cve”, or “malware”. Possible values are: domain, ip, file, url, cve, malware. Required
entity The value of the entity for which to fetch context. Should be provided with its type in entity_type argument. Supported hash types: MD5, SHA1, SHA256, SHA512, CRC32, and CTPH. Vulnerability supports CVEs. Required

Context Output

Path Type Description
RecordedFuture.Links.category String Recorded Future links category.
RecordedFuture.Links.type String Recorded Future links type.
RecordedFuture.Links.lists.entity_type String Recorded Future links entity list type.
RecordedFuture.Links.lists.entities.type String Recorded Future link entity type.
RecordedFuture.Links.lists.entities.name String Recorded Future link entity name.
RecordedFuture.Links.lists.entities.score Number Recorded Future link entity risk score.

recordedfuture-single-alert

Get detailed information from vulnerability, typosquat and credential alerts.

Base Command

recordedfuture-single-alert

Input

Argument Name Description Required
id Alert ID. Required

Context Output

Path Type Description
RecordedFuture.SingleAlert.id string Recorded Future alert ID.
RecordedFuture.SingleAlert.flat_entities.fragment string Recorded Future fragment of the entity.
RecordedFuture.SingleAlert.flat_entities.name string Recorded Future name of the entity.
RecordedFuture.SingleAlert.flat_entities.type string Recorded Future type of the entity.
RecordedFuture.SingleAlert.flat_entities.id string Recorded Future ID of the entity.

recordedfuture-alerts

Gets details on alerts configured and generated by Recorded Future by alert rule ID and/or time range.

Base Command

recordedfuture-alerts

Input

Argument Name Description Required
rule_id Alert rule ID. Optional
limit Maximum number of alerts to return. Default is 10. Default is 10. Optional
triggered_time Alert triggered time, e.g., “1 hour” or “2 days”. Optional
assignee Alert assignee’s email address. Optional
status Alert review status. Can be “unassigned”, “assigned”, “pending”, “actionable”, “no-action”, or “tuning”. Possible values are: unassigned, assigned, pending, actionable, no-action, tuning. Optional
freetext Free text search. Optional
offset Alerts from offset. Optional
orderby Alerts sort order. Possible values are: triggered. Optional
direction The direction by which to sort alerts. Can be “asc” or “desc”. Possible values are: asc, desc. Optional

Context Output

Path Type Description
RecordedFuture.Alert.id string Alert ID.
RecordedFuture.Alert.name string Alert name.
RecordedFuture.Alert.type string Alert type.
RecordedFuture.Alert.triggered date Alert triggered time.
RecordedFuture.Alert.status string Alert status.
RecordedFuture.Alert.assignee string Alert assignee.
RecordedFuture.Alert.rule string Alert rule name.

recordedfuture-alert-rules

Search for alert rule IDs.

Base Command

recordedfuture-alert-rules

Input

Argument Name Description Required
rule_name Rule name to search. Can be a partial name. Optional
limit Maximum number of rules to return. Default is 10. Default is 10. Optional

Context Output

Path Type Description
RecordedFuture.AlertRule.id string Alert rule ID.
RecordedFuture.AlertRule.name string Alert rule name.

recordedfuture-alert-set-status

Set alert into predefined status.

Base Command

recordedfuture-alert-set-status

Input

Argument Name Description Required
alert_id Alert id. Required
status The status we want to set for the alert in Recorded Future. Possible values are: unassigned, assigned, pending, dismiss, no-action, actionable, tuning. Required

Context Output

Path Type Description
RecordedFuture.Alerts.id String Recorded Future alert ID.
RecordedFuture.Alerts.status String Recorded Future alert status.
RecordedFuture.Alerts.note.text String Recorded Future alert note text.
RecordedFuture.Alerts.note.author String Recorded Future alert note author.
RecordedFuture.Alerts.note.date date Recorded Future alert note date.
RecordedFuture.Alerts.reviewDate date Recorded Future alert get date.

recordedfuture-alert-set-note

Set a note for the alert in Recorded Future.

Base Command

recordedfuture-alert-set-note

Input

Argument Name Description Required
alert_id Alert ID. Required
note The note of the ID we want to set. Required

Context Output

Path Type Description
RecordedFuture.Alerts.id String Recorded Future alert ID.
RecordedFuture.Alerts.status String Recorded Future alert status.
RecordedFuture.Alerts.note.text String Recorded Future alert note text.
RecordedFuture.Alerts.note.author String Recorded Future alert note author.
RecordedFuture.Alerts.note.date date Recorded Future alert note date.
RecordedFuture.Alerts.reviewDate date Recorded Future alert get date.

recordedfuture-malware-search

Search for a malware by specified filters.

Base Command

recordedfuture-malware-search

Input

Argument Name Description Required
freetext Part of malware name or ID to search for. Optional
limit How many records to retrieve (default = 10). Optional

Context Output

Path Type Description
RecordedFuture.Malware.id string Recorded Future malware ID.
RecordedFuture.Malware.name string Recorded Future entity name.
RecordedFuture.Malware.type string Recorded Future entity type (always = “Malware”).
RecordedFuture.Malware.intelCard date Recorded Future intelligence card URL.

Base Command

recordedfuture-threat-map

Input

Argument Name Description Required
actors_ids Actors IDs for which to get the threat map Optional
actor_name Actors name for which to get the threat map Optional
include_links Fetch links to threat actor or not Optional

Context Output

Path Type Description
RecordedFuture.ThreatMap.id string Recorded Future threat actor ID.
RecordedFuture.ThreatMap.name string Recorded Future entity name.
RecordedFuture.ThreatMap.alias array Recorded Future threat actor alias.
RecordedFuture.ThreatMap.intent number Recorded Future threat actor intent.
RecordedFuture.ThreatMap.id string Recorded Future threat actor ID.
RecordedFuture.ThreatMap.opportunity number Recorded Future threat actor opportunity.
RecordedFuture.ThreatMap.log_entries array Recorded Future threat actor log entries.
RecordedFuture.ThreatMap.links array Recorded Future threat actor links.

Base Command

recordedfuture-threat-links

Input

Argument Name Description Required
entity_type Type of the entity to fetch links for. E.g. “domain”, “ip”, “file”, “url”, “cve”, “malware”, “organization, “person”. Should be provided along with the entity in entity_name argument. Optional
entity_name Name of the entity to fetch links for Optional
entity_id ID of entity to fetch links for Optional
source_type Source of the links to be fetched. Can be “insikt” or “technical” Optional
timeframe Time range of the links to be fetched. Eg. “-1d” for last 1 day Optional
technical_type Type of technical source to fetch links from. Can be “type:MalwareAnalysis”, “type:InfrastructureAnalysis”, “type:NetworkTrafficAnalysis” or “type:TTPAnalysis” Optional

Context Output

Path Type Description
RecordedFuture.Links.entity.id string Recorded Future Entity id.
RecordedFuture.Links.entity.type string Recorded Future Entity type
RecordedFuture.Links.links.type string Recorded Future link type.
RecordedFuture.Links.links.id string Recorded Future link id.
RecordedFuture.Links.links.name string Recorded Future link name.
RecordedFuture.Links.links.source string Recorded Future link source.
RecordedFuture.Links.links.section string Recorded Future link section.
RecordedFuture.Links.links.attributes string Recorded Future link attributes.

Base Command

recordedfuture-detection-rules

Input

Argument Name Description Required
entity_type Type of the entity to fetch links for Optional
entity_name Name of the entity to fetch links for Optional
entity_id ID of entity to fetch links for Optional
rule_types Rule type. Can be “yara”, “sigma”, “snort” Optional
title Rule title Optional

Context Output

Path Type Description
RecordedFuture.DetectionRules.id string Recorded Future Detection rule id.
RecordedFuture.DetectionRules.type string Recorded Future Detection rule type.
RecordedFuture.DetectionRules.title string Recorded Future Detection rule title.
RecordedFuture.DetectionRules.description string Recorded Future Detection rule description.
RecordedFuture.DetectionRules.created string Recorded Future link name.
RecordedFuture.DetectionRules.updated string Recorded Future link source.
RecordedFuture.DetectionRules.rules array Recorded Future link section.
RecordedFuture.DetectionRules.rules.entities array Recorded Future link attributes.
RecordedFuture.DetectionRules.rules.entities.id string Recorded Future link attributes.
RecordedFuture.DetectionRules.rules.entities.type string Recorded Future link attributes.
RecordedFuture.DetectionRules.rules.entities.name string Recorded Future link attributes.
RecordedFuture.DetectionRules.rules.content string Recorded Future link attributes.
RecordedFuture.DetectionRules.rules.file_name string Recorded Future link attributes.

Base Command

recordedfuture-collective-insight

Input

Input

Argument Name Description Required
entity_type Value that can contain one of the enumerated list of values (ip, hash, domain, vulnerability, url). Required
entity_name Value of the IOC itself Required
entity_source_type Used to describe what log source the IOC came from Optional
incident_name Title of the incident related to the IOC Optional
incident_id ID of the incident related to the IOC Optional
incident_type Attack vector associated with the incident (C2, Phishing.. etc) Optional
mitre_codes List contains one or more MITRE codes associated with the IOC Optional
malware List contains all known malware associated with the IOCs Optional

Context Output

Path Type Description
RecordedFuture.CollectiveInsight.status string Request status

Breaking changes from the previous version of this integration - Recorded Future v2

Renamed the integration setting “Incident Sharing” to “Collective Insights”, resetting any previous configuration to this setting.

Configuration parameters

  • server_url — Server URL (e.g., https://api.recordedfuture.com/gw/xsoar/) (required)
  • token — API Token
  • token_credential —
  • file_threshold_suspicious — File Suspicious Threshold
  • file_threshold — File Malicious Threshold
  • cve_threshold_suspicious — CVE Suspicious Threshold
  • cve_threshold — CVE Malicious Threshold
  • ip_threshold_suspicious — IP Suspicious Threshold
  • ip_threshold — IP Malicious Threshold
  • domain_threshold_suspicious — Domain Suspicious Threshold
  • domain_threshold — Domain Malicious Threshold
  • url_threshold_suspicious — URL Suspicious Threshold
  • url_threshold — URL Malicious Threshold
  • vulnerability_threshold — Vulnerability Threshold
  • collective_insights — Collective Insights (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • rule_names — Rule names to fetch alerts by
  • fetch_statuses — Alert Statuses to include in the fetch
  • update_status — Update alert status on fetch.
  • first_fetch — First fetch time
  • incidentType — Incident type
  • max_fetch — Maximum number of incidents per fetch
  • integrationReliability — Source Reliability
  • feedExpirationPolicy —
  • feedExpirationInterval — Incidents Fetch Interval
  • incidentFetchInterval — Incidents Fetch Interval

Commands (18)

  • cve

    Gets a quick indicator of the risk associated with a CVE.

  • domain

    Gets a quick indicator of the risk associated with a domain.

  • file

    Gets a quick indicator of the risk associated with a file.

  • ip

    Gets a quick indicator of the risk associated with an IP address.

  • recordedfuture-alert-rules Deprecated

    Search for alert rule IDs. Deprecated: use rf-alerts from "Recorded Future Alerts" integration in "Recorded Future" pack instead.

  • recordedfuture-alert-set-note Deprecated

    Set a note for the alert in Recorded Future. Deprecated: use rf-alert-update from "Recorded Future Alerts" integration in "Recorded Future" pack instead.

  • recordedfuture-alert-set-status Deprecated

    Set alert into predefined status. Deprecated: use rf-alert-update from "Recorded Future Alerts" integration in "Recorded Future" pack instead.

  • recordedfuture-alerts Deprecated

    Gets details on alerts configured and generated by Recorded Future by alert rule ID and/or time range. Deprecated: use rf-alerts from "Recorded Future Alerts" integration in "Recorded Future" pack instead.

  • recordedfuture-collective-insight

    Post detection to collective insight.

  • recordedfuture-detection-rules

    Search detection rules.

  • recordedfuture-intelligence

    Get threat intelligence for an IP, Domain, CVE, URL, File or Malware.

  • recordedfuture-links

    Get Insikt Group Research Links for an IP, Domain, CVE, URL, File, or Malware.

  • recordedfuture-malware-search

    Search for a malware by specified filters.

  • recordedfuture-single-alert Deprecated

    Get detailed information from vulnerability, typosquat and credential alerts. Deprecated in favor of "Recorded Future Alerts" integration in "Recorded Future" pack.

  • recordedfuture-threat-assessment

    Get an indicator of the risk based on context.

  • recordedfuture-threat-links

    Search links.

  • recordedfuture-threat-map

    Get threat actors map.

  • url

    Gets a quick indicator of the risk associated with a URL.

Source

RecordedFuture.py RecordedFuture_test.py RecordedFuture.yml RecordedFuture_description.md command_examples.txt
Download History Raw 
commonfields:
  id: Recorded Future v2
  version: -1
name: Recorded Future v2
display: Recorded Future v2
category: Data Enrichment & Threat Intelligence
provider: Mastercard
description: Unique threat intel technology that automatically serves up relevant insights in real time.
sectionorder:
  - Connect
  - Collect
configuration:
- display: Server URL (e.g., https://api.recordedfuture.com/gw/xsoar/)
  name: server_url
  defaultvalue: https://api.recordedfuture.com/gw/xsoar/
  type: 0
  required: true
  section: Connect
- display: API Token
  name: token
  type: 4
  required: false
  section: Connect
  displaypassword: API Token
  hiddenusername: true
  hidden: true
- display: ''
  name: token_credential
  type: 9
  required: false
  displaypassword: API Token
  hiddenusername: true
  section: Connect
- display: File Suspicious Threshold
  additionalinfo: Minimum risk score from Recorded Future to consider the file suspicious.
  name: file_threshold_suspicious
  defaultvalue: "25"
  type: 0
  required: false
  section: Collect
- display: File Malicious Threshold
  additionalinfo: Minimum risk score from Recorded Future to consider the file malicious.
  name: file_threshold
  defaultvalue: "65"
  type: 0
  required: false
  section: Collect
- display: CVE Suspicious Threshold
  additionalinfo: Minimum risk score from Recorded Future to consider the CVE suspicious.
  name: cve_threshold_suspicious
  defaultvalue: "25"
  type: 0
  required: false
  section: Collect
- display: CVE Malicious Threshold
  additionalinfo: Minimum risk score from Recorded Future to consider the CVE malicious.
  name: cve_threshold
  defaultvalue: "65"
  type: 0
  required: false
  section: Collect
- display: IP Suspicious Threshold
  additionalinfo: Minimum risk score from Recorded Future to consider the IP suspicious.
  name: ip_threshold_suspicious
  defaultvalue: "25"
  type: 0
  required: false
  section: Collect
- display: IP Malicious Threshold
  additionalinfo: Minimum risk score from Recorded Future to consider the IP malicious.
  name: ip_threshold
  defaultvalue: "65"
  type: 0
  required: false
  section: Collect
- display: Domain Suspicious Threshold
  additionalinfo: Minimum risk score from Recorded Future to consider the domain suspicious.
  name: domain_threshold_suspicious
  defaultvalue: "25"
  type: 0
  required: false
  section: Collect
- display: Domain Malicious Threshold
  additionalinfo: Minimum risk score from Recorded Future to consider the domain malicious.
  name: domain_threshold
  defaultvalue: "65"
  type: 0
  required: false
  section: Collect
- display: URL Suspicious Threshold
  additionalinfo: Minimum risk score from Recorded Future to consider the URL suspicious.
  name: url_threshold_suspicious
  defaultvalue: "25"
  type: 0
  required: false
  section: Collect
- display: URL Malicious Threshold
  additionalinfo: Minimum risk score from Recorded Future to consider the URL malicious.
  name: url_threshold
  defaultvalue: "65"
  type: 0
  required: false
  section: Collect
- display: Vulnerability Threshold
  name: vulnerability_threshold
  defaultvalue: '65'
  type: 0
  required: false
  section: Collect
  additionalinfo: Minimum risk score from Recorded Future to consider the vulnerability critical.
- display: Collective Insights
  name: collective_insights
  defaultvalue: "On"
  type: 15
  required: true
  section: Collect
  additionalinfo: The Recorded Future Platform tracks trends and facilitates new insights on detections to better identify threats. See trends and track metrics over time using the Recorded Future Platform. This feature will store XSOAR enrichments based on playbooks. This feature permits additional analytics to track trends and identify new insights with the Recorded Future Intelligence Cloud. Please refer to the Help section for information about fields collected for Collective Insights.
  options:
  - On
  - Off
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  defaultvalue: "false"
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  defaultvalue: 'false'
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Rule names to fetch alerts by
  name: rule_names
  type: 12
  additionalinfo: 'Rule names to fetch alerts by, separated by semicolon. If empty, all alerts will be fetched.'
  required: false
  section: Collect
- display: Alert Statuses to include in the fetch
  name: fetch_statuses
  defaultvalue: "no-action"
  type: 0
  section: Collect
  additionalinfo: Comma-separated alert statuses (e.g. "unassigned,assigned,pending,actionable,no-action,tuning"). If empty, the default value of "no-action" will be used.
  required: false
- display: Update alert status on fetch.
  additionalinfo: 'If selected, alerts with a status of ''no-action'' will be updated to ''pending'' once fetched by the integration.'
  defaultvalue: 'true'
  name: update_status
  type: 8
  required: false
  section: Collect
- name: first_fetch
  display: 'First fetch time'
  type: 0
  defaultvalue: 24 hours
  required: false
  section: Collect
  additionalinfo: 'Format: <number> <time unit>, e.g., "12 hours", "7 days", "3 months", "1 year".'
- display: Incident type
  name: incidentType
  defaultvalue: "Recorded Future Alert"
  type: 13
  required: false
  section: Collect
- display: Maximum number of incidents per fetch
  name: max_fetch
  defaultvalue: '50'
  type: 0
  required: false
  section: Collect
- name: integrationReliability
  display: 'Source Reliability'
  defaultvalue: B - Usually reliable
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
  additionalinfo: Reliability of the source providing the intelligence data.
  section: Collect
- display: ''
  name: feedExpirationPolicy
  defaultvalue: "indicatorType"
  type: 17
  required: false
  section: Collect
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
- display: Incidents Fetch Interval
  name: feedExpirationInterval
  defaultvalue: '20160'
  type: 1
  required: false
  section: Collect
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  required: false
  type: 19
  section: Collect
script:
  script: ''
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  commands:
  - name: domain
    description: Gets a quick indicator of the risk associated with a domain.
    arguments:
    - name: domain
      required: true
      default: true
      isArray: true
      description: The domain for which to get the reputation.
    - name: collective_insights
      description: Save IOC to Collective Insights? If not specified - uses demisto param setting value.
      required: false
      default: false
      auto: PREDEFINED
      predefined:
        - on
        - off
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domains, the vendor that made the decision.
      type: string
    - contextPath: Domain.Malicious.Description
      description: For malicious Domains, the reason that the vendor made the decision.
      type: string
    - contextPath: Domain.Name
      description: Domain name.
      type: string
    - contextPath: RecordedFuture.Domain.riskScore
      description: Recorded Future domain risk score.
      type: number
    - contextPath: RecordedFuture.Domain.riskLevel
      description: Recorded Future domain risk level.
      type: string
    - contextPath: RecordedFuture.Domain.Evidence.rule
      description: Recorded Future risk rule name.
      type: string
    - contextPath: RecordedFuture.Domain.Evidence.mitigation
      description: Recorded Future risk rule mitigation.
      type: string
    - contextPath: RecordedFuture.Domain.Evidence.description
      description: Recorded Future risk rule description.
      type: string
    - contextPath: RecordedFuture.Domain.Evidence.timestamp
      description: Recorded Future risk rule timestamp.
      type: date
    - contextPath: RecordedFuture.Domain.Evidence.level
      description: Recorded Future risk rule level.
      type: number
    - contextPath: RecordedFuture.Domain.Evidence.ruleid
      description: Recorded Future risk rule ID.
      type: string
    - contextPath: RecordedFuture.Domain.name
      description: Domain name.
      type: string
    - contextPath: RecordedFuture.Domain.maxRules
      description: Maximum number of Recorded Future domain risk rules.
      type: number
    - contextPath: RecordedFuture.Domain.rules
      description: All the rules concatenated by comma.
      type: string
    - contextPath: RecordedFuture.Domain.ruleCount
      description: Number of triggered Recorded Future domain risk rules.
      type: number

  - name: ip
    description: Gets a quick indicator of the risk associated with an IP address.
    arguments:
    - name: ip
      required: true
      default: true
      isArray: true
      description: IP address for which to get the reputation.
    - name: collective_insights
      description: Save IOC to Collective Insights? If not specified - uses demisto param setting value.
      required: false
      default: false
      auto: PREDEFINED
      predefined:
        - on
        - off
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: IP.Malicious.Vendor
      description: For malicious IP addresses, the vendor that made the decision.
      type: string
    - contextPath: IP.Malicious.Description
      description: For malicious IP addresses, the reason that the vendor made the decision.
      type: string
    - contextPath: IP.Address
      description: IP address.
      type: string
    - contextPath: RecordedFuture.IP.riskScore
      description: Recorded Future IP risk score.
      type: number
    - contextPath: RecordedFuture.IP.riskLevel
      description: Recorded Future IP risk level.
      type: string
    - contextPath: RecordedFuture.IP.Evidence.rule
      description: Recorded Future risk rule name.
      type: string
    - contextPath: RecordedFuture.IP.Evidence.mitigation
      description: Recorded Future risk rule mitigation.
      type: string
    - contextPath: RecordedFuture.IP.Evidence.description
      description: Recorded Future risk rule description.
      type: string
    - contextPath: RecordedFuture.IP.Evidence.timestamp
      description: Recorded Future risk rule timestamp.
      type: date
    - contextPath: RecordedFuture.IP.Evidence.level
      description: Recorded Future risk rule level.
      type: number
    - contextPath: RecordedFuture.IP.Evidence.ruleid
      description: Recorded Future risk rule ID.
      type: string
    - contextPath: RecordedFuture.IP.name
      description: IP address.
      type: string
    - contextPath: RecordedFuture.IP.maxRules
      description: Maximum number of Recorded Future IP risk rules.
      type: number
    - contextPath: RecordedFuture.IP.rules
      description: All the rules concatenated by comma.
      type: string
    - contextPath: RecordedFuture.IP.ruleCount
      description: Number of triggered Recorded Future IP risk rules.
      type: number

  - name: file
    description: Gets a quick indicator of the risk associated with a file.
    arguments:
    - name: file
      required: true
      isArray: true
      default: true
      description: File hash for which to check the reputation. Can be an MD5, SHA1, SHA256, SHA512, CRC32 or CTPH.
    - name: collective_insights
      description: Save IOC to Collective Insights? If not specified - uses demisto param setting value.
      required: false
      default: false
      auto: PREDEFINED
      predefined:
        - on
        - off
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: File.SHA256
      description: SHA-256 hash of the file.
      type: string
    - contextPath: File.SHA512
      description: SHA-512 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: SHA-1 hash of the file.
      type: string
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: File.CRC32
      description: CRC32 hash of the file.
      type: string
    - contextPath: File.CTPH
      description: CTPH hash of the file.
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the reason that the vendor made the decision.
      type: string
    - contextPath: RecordedFuture.File.riskScore
      description: Recorded Future hash risk score.
      type: number
    - contextPath: RecordedFuture.File.riskLevel
      description: Recorded Future hash risk level.
      type: string
    - contextPath: RecordedFuture.File.Evidence.rule
      description: Recorded Future risk rule name.
      type: string
    - contextPath: RecordedFuture.File.Evidence.mitigation
      description: Recorded Future risk rule mitigation.
      type: string
    - contextPath: RecordedFuture.File.Evidence.description
      description: Recorded Future risk rule description.
      type: string
    - contextPath: RecordedFuture.File.Evidence.timestamp
      description: Recorded Future risk rule timestamp.
      type: date
    - contextPath: RecordedFuture.File.Evidence.level
      description: Recorded Future risk rule level.
      type: number
    - contextPath: RecordedFuture.File.Evidence.ruleid
      description: Recorded Future risk rule ID.
      type: string
    - contextPath: RecordedFuture.File.name
      description: File name.
      type: string
    - contextPath: RecordedFuture.File.maxRules
      description: Maximum number of Recorded Future hash risk rules.
      type: number
    - contextPath: RecordedFuture.File.rules
      description: All the rules concatenated by comma.
      type: string
    - contextPath: RecordedFuture.File.ruleCount
      description: Number of triggered Recorded Future hash risk rules.
      type: number

  - name: cve
    description: Gets a quick indicator of the risk associated with a CVE.
    arguments:
    - name: cve
      required: true
      default: true
      isArray: true
      description: CVE for which to get the reputation.
    - name: collective_insights
      description: Save IOC to Collective Insights? If not specified - uses demisto param setting value.
      required: false
      default: false
      auto: PREDEFINED
      predefined:
        - on
        - off
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: CVE.ID
      description: Vulnerability name.
      type: string
    - contextPath: RecordedFuture.CVE.riskScore
      description: Recorded Future vulnerability risk score.
      type: number
    - contextPath: RecordedFuture.CVE.riskLevel
      description: Recorded Future vulnerability risk level.
      type: string
    - contextPath: RecordedFuture.CVE.Evidence.rule
      description: Recorded Future risk rule name.
      type: string
    - contextPath: RecordedFuture.CVE.Evidence.mitigation
      description: Recorded Future risk rule mitigation.
      type: string
    - contextPath: RecordedFuture.CVE.Evidence.description
      description: Recorded Future risk rule description.
      type: string
    - contextPath: RecordedFuture.CVE.Evidence.timestamp
      description: Recorded Future risk rule timestamp.
      type: date
    - contextPath: RecordedFuture.CVE.Evidence.level
      description: Recorded Future risk rule level.
      type: number
    - contextPath: RecordedFuture.CVE.Evidence.ruleid
      description: Recorded Future risk rule ID.
      type: string
    - contextPath: RecordedFuture.CVE.name
      description: CVE name.
      type: string
    - contextPath: RecordedFuture.CVE.maxRules
      description: Maximum number of Recorded Future vulnerability risk rules.
      type: number
    - contextPath: RecordedFuture.CVE.rules
      description: All the rules concatenated by comma.
      type: string
    - contextPath: RecordedFuture.CVE.ruleCount
      description: Number of triggered Recorded Future vulnerability risk rules.
      type: number

  - name: url
    description: Gets a quick indicator of the risk associated with a URL.
    arguments:
    - name: url
      required: true
      default: true
      isArray: true
      description: URL for which to get the reputation.
    - name: collective_insights
      description: Save IOC to Collective Insights? If not specified - uses demisto param setting value.
      required: false
      default: false
      auto: PREDEFINED
      predefined:
        - on
        - off
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: string
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason that the vendor made the decision.
      type: string
    - contextPath: URL.Data
      description: URL name.
      type: string
    - contextPath: RecordedFuture.URL.riskScore
      description: Recorded Future URL risk score.
      type: number
    - contextPath: RecordedFuture.URL.riskLevel
      description: Recorded Future URL risk level.
      type: string
    - contextPath: RecordedFuture.URL.Evidence.rule
      description: Recorded Risk rule name.
      type: string
    - contextPath: RecordedFuture.URL.Evidence.mitigation
      description: Recorded Risk rule mitigation.
      type: string
    - contextPath: RecordedFuture.URL.Evidence.description
      description: Recorded Risk rule description.
      type: string
    - contextPath: RecordedFuture.URL.Evidence.timestamp
      description: Recorded Risk rule timestamp.
      type: date
    - contextPath: RecordedFuture.URL.Evidence.level
      description: Recorded Risk rule level.
      type: number
    - contextPath: RecordedFuture.URL.Evidence.ruleid
      description: Recorded Risk rule ID.
      type: string
    - contextPath: RecordedFuture.URL.name
      description: URL name.
      type: string
    - contextPath: RecordedFuture.URL.maxRules
      description: Maximum number of Recorded Future URL risk rules.
      type: number
    - contextPath: RecordedFuture.URL.rules
      description: All the rules concatenated by comma.
      type: string
    - contextPath: RecordedFuture.URL.ruleCount
      description: Number of triggered Recorded Future URL risk rules.
      type: number

  - name: recordedfuture-threat-assessment
    description: Get an indicator of the risk based on context.
    arguments:
    - name: context
      auto: PREDEFINED
      predefined:
      - c2
      - malware
      - phishing
      description: Context to use for the assessment. This is used by Recorded Future to calculate the relevant score and verdict. Can be "c2", "malware", or "phishing".
      required: true
    - name: ip
      isArray: true
      description: IP addresses to check if they are related to the selected context.
    - name: domain
      isArray: true
      description: Domains to check if they are related to the selected context.
    - name: file
      isArray: true
      description: File hashes to check if they are related to the selected context.
    - name: url
      isArray: true
      description: URLs to check if they are related to the selected context.
    - name: cve
      isArray: true
      description: CVEs to check if they are related to the selected context.
    - name: filter
      description: Will filter out entities that have zero as score.
      auto: PREDEFINED
      predefined:
      - yes
      - no
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: Indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: File.SHA256
      description: SHA-256 hash of the file.
      type: string
    - contextPath: File.SHA512
      description: SHA-512 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: SHA-1 hash of the file.
      type: string
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: File.CRC32
      description: CRC32 hash of the file.
      type: string
    - contextPath: File.CTPH
      description: CTPH hash of the file.
      type: string
    - contextPath: IP.Address
      description: IP address.
      type: string
    - contextPath: IP.ASN
      description: ASN.
      type: string
    - contextPath: IP.Geo.Country
      description: IP address geolocation country.
      type: string
    - contextPath: Domain.Name
      description: Domain name.
      type: string
    - contextPath: URL.Data
      description: URL name.
      type: string
    - contextPath: CVE.ID
      description: Vulnerability name.
      type: string
    - contextPath: RecordedFuture.verdict
      description: Recorded Future verdict.
      type: boolean
    - contextPath: RecordedFuture.context
      description: Threat assessment context.
      type: string
    - contextPath: RecordedFuture.riskScore
      description: Recorded Future maximum risk score.
      type: number
    - contextPath: RecordedFuture.Entities.id
      description: Recorded Future entity ID.
      type: string
    - contextPath: RecordedFuture.Entities.name
      description: Recorded Future entity name.
      type: string
    - contextPath: RecordedFuture.Entities.type
      description: Recorded Future entity type.
      type: string
    - contextPath: RecordedFuture.Entities.score
      description: Recorded Future entity score.
      type: string
    - contextPath: RecordedFuture.Entities.context
      description: Contains the current context if there is evidence.
      type: string
    - contextPath: RecordedFuture.Entities.Evidence.ruleid
      description: Recorded Future risk rule ID.
      type: string
    - contextPath: RecordedFuture.Entities.Evidence.timestamp
      description: Recorded Future evidence timestamp.
      type: date
    - contextPath: RecordedFuture.Entities.Evidence.mitigation
      description: Recorded Future evidence mitigation.
      type: string
    - contextPath: RecordedFuture.Entities.Evidence.description
      description: Recorded Future evidence description.
      type: string
    - contextPath: RecordedFuture.Entities.Evidence.rule
      description: Recorded Future risk rule.
      type: string
    - contextPath: RecordedFuture.Entities.Evidence.level
      description: Recorded Future risk rule level.
      type: number

  - name: recordedfuture-intelligence
    description: Get threat intelligence for an IP, Domain, CVE, URL, File or Malware.
    arguments:
    - name: profile
      description: Depending on what profile you choose you will get different related entities matching the given profile.
      auto: PREDEFINED
      defaultValue: "All"
      predefined:
      - "All"
      - "Threat Hunter"
      - "SecOp Analyst"
      - "TI Analyst"
      - "Vulnerability Analyst"
    - name: entity_type
      description: The type of entity for which to fetch context. Should be provided with its value in entityValue argument. Can be "domain", "ip", "file", "url", "cve", or "malware".
      required: true
      auto: PREDEFINED
      predefined:
      - domain
      - ip
      - file
      - url
      - cve
      - malware
    - name: entity
      required: true
      description: 'The value of the entity for which to fetch context. Should be provided with its type in entity_type argument. Supported hash types: MD5, SHA1, SHA256, SHA512, CRC32, and CTPH. Vulnerability supports CVEs.'
    - name: fetch_related_entities
      auto: PREDEFINED
      predefined:
      - yes
      - no
      description: Whether to fetch related entity data. Can be "yes" or "no".
    - name: fetch_analyst_notes
      auto: PREDEFINED
      predefined:
      - yes
      - no
      description: Whether to fetch analyst notes. Can be "yes" or "no".
      defaultValue: "no"
    - name: fetch_riskyCIDRips
      auto: PREDEFINED
      predefined:
      - no
      - yes
      defaultValue: "no"
      description: Whether risk scores for other IP addresses within the same CIDR should be fetched (only for IP intelligence). Can be "yes" or "no".
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: Indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: File.SHA256
      description: SHA-256 hash of the file.
      type: string
    - contextPath: File.SHA512
      description: SHA-512 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: SHA-1 hash of the file.
      type: string
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: File.CRC32
      description: CRC32 hash of the file.
      type: string
    - contextPath: File.CTPH
      description: CTPH hash of the file.
      type: string
    - contextPath: IP.Address
      description: IP address.
      type: string
    - contextPath: IP.ASN
      description: ASN.
      type: string
    - contextPath: IP.Geo.Country
      description: IP address geolocation country.
      type: string
    - contextPath: Domain.Name
      description: Domain name.
      type: string
    - contextPath: URL.Data
      description: URL name.
      type: string
    - contextPath: CVE.ID
      description: Vulnerability name.
      type: string
    - contextPath: RecordedFuture.IP.criticality
      description: Risk criticality.
      type: number
    - contextPath: RecordedFuture.IP.criticalityLabel
      description: Risk criticality label.
      type: string
    - contextPath: RecordedFuture.IP.riskString
      description: Risk string.
      type: string
    - contextPath: RecordedFuture.IP.riskSummary
      description: Risk summary.
      type: string
    - contextPath: RecordedFuture.IP.rules
      description: Risk rules.
      type: string
    - contextPath: RecordedFuture.Ip.concatRules
      description: All risk rules concatenated by comma.
      type: string
    - contextPath: RecordedFuture.IP.score
      description: Risk score.
      type: number
    - contextPath: RecordedFuture.IP.firstSeen
      description: Evidence first seen date.
      type: date
    - contextPath: RecordedFuture.IP.lastSeen
      description: Evidence last seen date.
      type: date
    - contextPath: RecordedFuture.IP.intelCard
      description: Recorded Future intelligence card URL.
      type: string
    - contextPath: RecordedFuture.IP.type
      description: Recorded Future entity type.
      type: string
    - contextPath: RecordedFuture.IP.name
      description: Recorded Future entity name.
      type: string
    - contextPath: RecordedFuture.IP.id
      description: Recorded Future entity ID.
      type: string
    - contextPath: RecordedFuture.IP.location.asn
      description: ASN number.
      type: string
    - contextPath: RecordedFuture.IP.location.cidr.id
      description: Recorded Future CIDR ID.
      type: string
    - contextPath: RecordedFuture.IP.location.cidr.name
      description: CIDR name.
      type: string
    - contextPath: RecordedFuture.IP.location.cidr.type
      description: CIDR type.
      type: string
    - contextPath: RecordedFuture.IP.location.location.city
      description: IP address geolocation city.
      type: string
    - contextPath: RecordedFuture.IP.location.location.continent
      description: IP address geolocation continent.
      type: string
    - contextPath: RecordedFuture.IP.location.location.country
      description: IP address geolocation country.
      type: string
    - contextPath: RecordedFuture.IP.location.organization
      description: IP address geolocation organization.
      type: string
    - contextPath: RecordedFuture.IP.metrics.type
      description: Recorded Future metrics type.
      type: string
    - contextPath: RecordedFuture.IP.metrics.value
      description: Recorded Future metrics value.
      type: number
    - contextPath: RecordedFuture.IP.threatLists.description
      description: Recorded Future threat list description.
      type: string
    - contextPath: RecordedFuture.IP.threatLists.id
      description: Recorded Future threat list ID.
      type: string
    - contextPath: RecordedFuture.IP.threatLists.name
      description: Recorded Future threat list name.
      type: string
    - contextPath: RecordedFuture.IP.threatLists.type
      description: Recorded Future threat list type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedAttacker.count
      description: Recorded Future related attacker count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedAttacker.id
      description: Recorded Future related attacker ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedAttacker.name
      description: Recorded Future related attacker name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedAttacker.type
      description: Recorded Future related attacker type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedTarget.count
      description: Recorded Future related target count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedTarget.id
      description: Recorded Future related target ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedTarget.name
      description: Recorded Future related target name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedTarget.type
      description: Recorded Future related target type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedThreatActor.count
      description: Recorded Future related threat actor count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedThreatActor.id
      description: Recorded Future related threat actor ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedThreatActor.name
      description: Recorded Future related threat actor name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedThreatActor.type
      description: Recorded Future related threat actor type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedMalware.count
      description: Recorded Future related malware count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedMalware.id
      description: Recorded Future related malware ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedMalware.name
      description: Recorded Future related malware name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedMalware.type
      description: Recorded Future related malware type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCyberVulnerability.count
      description: Recorded Future related vulnerability count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCyberVulnerability.id
      description: Recorded Future related vulnerability ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCyberVulnerability.name
      description: Recorded Future related vulnerability name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCyberVulnerability.type
      description: Recorded Future related vulnerability type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedIpAddress.count
      description: Recorded Future related IP address count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedIpAddress.id
      description: Recorded Future related IP address ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedIpAddress.name
      description: Recorded Future related IP address name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedIpAddress.type
      description: Recorded Future related IP address type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedInternetDomainName.count
      description: Recorded Future related domain name count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedInternetDomainName.id
      description: Recorded Future related domain name ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedInternetDomainName.name
      description: Recorded Future related domain name name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedInternetDomainName.type
      description: Recorded Future related domain name type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedProduct.count
      description: Recorded Future related product count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedProduct.id
      description: Recorded Future related product ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedProduct.name
      description: Recorded Future related product name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedProduct.type
      description: Recorded Future related product type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCountries.count
      description: Recorded Future related countries count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCountries.id
      description: Recorded Future related countries ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCountries.name
      description: Recorded Future related countries name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCountries.type
      description: Recorded Future related countries type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedHash.count
      description: Recorded Future related hash count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedHash.id
      description: Recorded Future related hash ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedHash.name
      description: Recorded Future related hash name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedHash.type
      description: Recorded Future related hash type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedTechnology.count
      description: Recorded Future related technology count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedTechnology.id
      description: Recorded Future related technology ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedTechnology.name
      description: Recorded Future related technology name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedTechnology.type
      description: Recorded Future related technology type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedEmailAddress.count
      description: Recorded Future related email address count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedEmailAddress.id
      description: Recorded Future related email address ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedEmailAddress.name
      description: Recorded Future related email address name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedEmailAddress.type
      description: Recorded Future related email address type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedAttackVector.count
      description: Recorded Future related attack vector count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedAttackVector.id
      description: Recorded Future related attack vector ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedAttackVector.name
      description: Recorded Future related attack vector name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedAttackVector.type
      description: Recorded Future related attack vector type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedMalwareCategory.count
      description: Recorded Future related malware category count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedMalwareCategory.id
      description: Recorded Future related malware category ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedMalwareCategory.name
      description: Recorded Future related malware category name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedMalwareCategory.type
      description: Recorded Future related malware category type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedOperations.count
      description: Recorded Future related operations count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedOperations.id
      description: Recorded Future related operations ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedOperations.name
      description: Recorded Future related operations name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedOperations.type
      description: Recorded Future related operations type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCompany.count
      description: Recorded Future related company count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCompany.id
      description: Recorded Future related company ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCompany.name
      description: Recorded Future related company name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCompany.type
      description: Recorded Future related company type.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.context_entities.id
      description: Recorded Future analyst note context entity ID.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.context_entities.name
      description: Recorded Future analyst note context entity name.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.context_entities.type
      description: Recorded Future analyst note context entity type.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.note_entities.id
      description: Recorded Future analyst note entity ID.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.note_entities.name
      description: Recorded Future analyst note entity name.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.note_entities.type
      description: Recorded Future analyst note entity type.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.published
      description: Recorded Future analyst note publishing time.
      type: date
    - contextPath: RecordedFuture.IP.analystNotes.attributes.validated_on
      description: Recorded Future analyst note validation time.
      type: date
    - contextPath: RecordedFuture.IP.analystNotes.attributes.text
      description: Recorded Future analyst note content.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.title
      description: Recorded Future analyst note title.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.topic.description
      description: Recorded Future analyst note topic description.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.topic.id
      description: Recorded Future analyst note topic ID.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.topic.name
      description: Recorded Future analyst note topic name.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.topic.type
      description: Recorded Future analyst note topic type.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.validation_urls.id
      description: Recorded Future analyst note validation URL ID.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.validation_urls.name
      description: Recorded Future analyst note validation URL.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.validation_urls.type
      description: Recorded Future analyst note validation URL entity type.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.id
      description: Recorded Future analyst note ID.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.source.id
      description: Recorded Future analyst note source ID.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.source.name
      description: Recorded Future analyst note source name.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.source.type
      description: Recorded Future analyst note source type.
      type: string
    - contextPath: RecordedFuture.Domain.criticality
      description: Risk criticality.
      type: number
    - contextPath: RecordedFuture.Domain.criticalityLabel
      description: Risk criticality label.
      type: string
    - contextPath: RecordedFuture.Domain.riskString
      description: Risk string.
      type: string
    - contextPath: RecordedFuture.Domain.riskSummary
      description: Risk summary.
      type: string
    - contextPath: RecordedFuture.Domain.rules
      description: Risk rules.
      type: string
    - contextPath: RecordedFuture.Domain.concatRules
      description: All risk rules concatenated by comma.
      type: string
    - contextPath: RecordedFuture.Domain.score
      description: Risk score.
      type: number
    - contextPath: RecordedFuture.Domain.firstSeen
      description: Evidence first seen date.
      type: date
    - contextPath: RecordedFuture.Domain.lastSeen
      description: Evidence last seen.
      type: date
    - contextPath: RecordedFuture.Domain.intelCard
      description: Recorded Future intelligence card URL.
      type: string
    - contextPath: RecordedFuture.Domain.type
      description: Recorded Future entity type.
      type: string
    - contextPath: RecordedFuture.Domain.name
      description: Recorded Future entity name.
      type: string
    - contextPath: RecordedFuture.Domain.id
      description: Recorded Future entity ID.
      type: string
    - contextPath: RecordedFuture.Domain.metrics.type
      description: Recorded Future metrics type.
      type: string
    - contextPath: RecordedFuture.Domain.metrics.value
      description: Recorded Future metrics value.
      type: number
    - contextPath: RecordedFuture.Domain.threatLists.description
      description: Recorded Future threat list description.
      type: string
    - contextPath: RecordedFuture.Domain.threatLists.id
      description: Recorded Future threat list ID.
      type: string
    - contextPath: RecordedFuture.Domain.threatLists.name
      description: Recorded Future threat list name.
      type: string
    - contextPath: RecordedFuture.Domain.threatLists.type
      description: Recorded Future threat list type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedAttacker.count
      description: Recorded Future related attacker count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedAttacker.id
      description: Recorded Future related attacker ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedAttacker.name
      description: Recorded Future related attacker name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedAttacker.type
      description: Recorded Future related attacker type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedTarget.count
      description: Recorded Future related target count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedTarget.id
      description: Recorded Future related target ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedTarget.name
      description: Recorded Future related target name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedTarget.type
      description: Recorded Future related target type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedThreatActor.count
      description: Recorded Future related threat actor count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedThreatActor.id
      description: Recorded Future related threat actor ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedThreatActor.name
      description: Recorded Future related threat actor name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedThreatActor.type
      description: Recorded Future related threat actor type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedMalware.count
      description: Recorded Future related malware count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedMalware.id
      description: Recorded Future related malware ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedMalware.name
      description: Recorded Future related malware name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedMalware.type
      description: Recorded Future related malware type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCyberVulnerability.count
      description: Recorded Future related vulnerability count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCyberVulnerability.id
      description: Recorded Future related vulnerability ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCyberVulnerability.name
      description: Recorded Future related vulnerability name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCyberVulnerability.type
      description: Recorded Future related vulnerability type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedIpAddress.count
      description: Recorded Future related IP address count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedIpAddress.id
      description: Recorded Future related IP address ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedIpAddress.name
      description: Recorded Future related IP address name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedIpAddress.type
      description: Recorded Future related IP address type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedInternetDomainName.count
      description: Recorded Future related domain name count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedInternetDomainName.id
      description: Recorded Future related domain name ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedInternetDomainName.name
      description: Recorded Future related domain name name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedInternetDomainName.type
      description: Recorded Future related domain name type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedProduct.count
      description: Recorded Future related product count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedProduct.id
      description: Recorded Future related product ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedProduct.name
      description: Recorded Future related product name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedProduct.type
      description: Recorded Future related product type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCountries.count
      description: Recorded Future related countries count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCountries.id
      description: Recorded Future related countries ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCountries.name
      description: Recorded Future related countries name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCountries.type
      description: Recorded Future related countries type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedHash.count
      description: Recorded Future related hash count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedHash.id
      description: Recorded Future related hash ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedHash.name
      description: Recorded Future related hash name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedHash.type
      description: Recorded Future related hash type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedTechnology.count
      description: Recorded Future related technology count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedTechnology.id
      description: Recorded Future related technology ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedTechnology.name
      description: Recorded Future related technology name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedTechnology.type
      description: Recorded Future related technology type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedEmailAddress.count
      description: Recorded Future related email address count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedEmailAddress.id
      description: Recorded Future related email address ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedEmailAddress.name
      description: Recorded Future related email address name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedEmailAddress.type
      description: Recorded Future related email address type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedAttackVector.count
      description: Recorded Future related attack vector count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedAttackVector.id
      description: Recorded Future related attack vector ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedAttackVector.name
      description: Recorded Future related attack vector name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedAttackVector.type
      description: Recorded Future related attack vector type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedMalwareCategory.count
      description: Recorded Future related malware category count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedMalwareCategory.id
      description: Recorded Future related malware category ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedMalwareCategory.name
      description: Recorded Future related malware category name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedMalwareCategory.type
      description: Recorded Future related malware category type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedOperations.count
      description: Recorded Future related operations count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedOperations.id
      description: Recorded Future related operations ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedOperations.name
      description: Recorded Future related operations name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedOperations.type
      description: Recorded Future related operations type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCompany.count
      description: Recorded Future related company count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCompany.id
      description: Recorded Future related company ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCompany.name
      description: Recorded Future related company name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCompany.type
      description: Recorded Future related company type.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.context_entities.id
      description: Recorded Future analyst note context entity ID.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.context_entities.name
      description: Recorded Future analyst note context entity name.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.context_entities.type
      description: Recorded Future analyst note context entity type.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.note_entities.id
      description: Recorded Future analyst note entity ID.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.note_entities.name
      description: Recorded Future analyst note entity name.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.note_entities.type
      description: Recorded Future analyst note entity type.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.published
      description: Recorded Future analyst note publishing time.
      type: date
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.validated_on
      description: Recorded Future analyst note validation time.
      type: date
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.text
      description: Recorded Future analyst note content.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.title
      description: Recorded Future analyst note title.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.topic.description
      description: Recorded Future analyst note topic description.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.topic.id
      description: Recorded Future analyst note topic ID.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.topic.name
      description: Recorded Future analyst note topic name.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.topic.type
      description: Recorded Future analyst note topic type.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.validation_urls.id
      description: Recorded Future analyst note validation URL ID.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.validation_urls.name
      description: Recorded Future analyst note validation URL.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.validation_urls.type
      description: Recorded Future analyst note validation URL entity type.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.id
      description: Recorded Future analyst note ID.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.source.id
      description: Recorded Future analyst note source ID.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.source.name
      description: Recorded Future analyst note source name.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.source.type
      description: Recorded Future analyst note source type.
      type: string
    - contextPath: RecordedFuture.CVE.criticality
      description: Risk criticality.
      type: number
    - contextPath: RecordedFuture.CVE.criticalityLabel
      description: Risk criticality label.
      type: string
    - contextPath: RecordedFuture.CVE.riskString
      description: Risk string.
      type: string
    - contextPath: RecordedFuture.CVE.riskSummary
      description: Risk summary.
      type: string
    - contextPath: RecordedFuture.CVE.rules
      description: Risk rules.
      type: string
    - contextPath: RecordedFuture.CVE.concatRules
      description: All risk rules concatenated by comma.
      type: string
    - contextPath: RecordedFuture.CVE.score
      description: Risk score.
      type: number
    - contextPath: RecordedFuture.CVE.firstSeen
      description: Evidence first seen.
      type: date
    - contextPath: RecordedFuture.CVE.lastSeen
      description: Evidence last seen.
      type: date
    - contextPath: RecordedFuture.CVE.intelCard
      description: Recorded Future intelligence card URL.
      type: string
    - contextPath: RecordedFuture.CVE.hashAlgorithm
      description: Hash algorithm.
      type: string
    - contextPath: RecordedFuture.CVE.type
      description: Recorded Future entity type.
      type: string
    - contextPath: RecordedFuture.CVE.name
      description: Recorded Future entity name.
      type: string
    - contextPath: RecordedFuture.CVE.id
      description: Recorded Future entity ID.
      type: string
    - contextPath: RecordedFuture.CVE.metrics.type
      description: Recorded Future metrics type.
      type: string
    - contextPath: RecordedFuture.CVE.metrics.value
      description: Recorded Future metrics value.
      type: number
    - contextPath: RecordedFuture.CVE.threatLists.description
      description: Recorded Future threat list description.
      type: string
    - contextPath: RecordedFuture.CVE.threatLists.id
      description: Recorded Future threat list ID.
      type: string
    - contextPath: RecordedFuture.CVE.threatLists.name
      description: Recorded Future threat list name.
      type: string
    - contextPath: RecordedFuture.CVE.threatLists.type
      description: Recorded Future threat list type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedAttacker.count
      description: Recorded Future related attacker count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedAttacker.id
      description: Recorded Future related attacker ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedAttacker.name
      description: Recorded Future related attacker name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedAttacker.type
      description: Recorded Future related attacker type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedTarget.count
      description: Recorded Future related target count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedTarget.id
      description: Recorded Future related target ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedTarget.name
      description: Recorded Future related target name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedTarget.type
      description: Recorded Future related target type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedThreatActor.count
      description: Recorded Future related threat actor count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedThreatActor.id
      description: Recorded Future related threat actor ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedThreatActor.name
      description: Recorded Future related threat actor name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedThreatActor.type
      description: Recorded Future related threat actor type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedMalware.count
      description: Recorded Future related malware count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedMalware.id
      description: Recorded Future related malware ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedMalware.name
      description: Recorded Future related malware name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedMalware.type
      description: Recorded Future related malware type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCyberVulnerability.count
      description: Recorded Future related vulnerability count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCyberVulnerability.id
      description: Recorded Future related vulnerability ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCyberVulnerability.name
      description: Recorded Future related vulnerability name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCyberVulnerability.type
      description: Recorded Future related vulnerability type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedIpAddress.count
      description: Recorded Future related IP address count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedIpAddress.id
      description: Recorded Future related IP address ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedIpAddress.name
      description: Recorded Future related IP address name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedIpAddress.type
      description: Recorded Future related IP address type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedInternetDomainName.count
      description: Recorded Future related domain name count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedInternetDomainName.id
      description: Recorded Future related domain name ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedInternetDomainName.name
      description: Recorded Future related domain name name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedInternetDomainName.type
      description: Recorded Future related domain name type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedProduct.count
      description: Recorded Future related product count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedProduct.id
      description: Recorded Future related product ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedProduct.name
      description: Recorded Future related product name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedProduct.type
      description: Recorded Future related product type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCountries.count
      description: Recorded Future related countries count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCountries.id
      description: Recorded Future related countries ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCountries.name
      description: Recorded Future related countries name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCountries.type
      description: Recorded Future related countries type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedHash.count
      description: Recorded Future related hash count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedHash.id
      description: Recorded Future related hash ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedHash.name
      description: Recorded Future related hash name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedHash.type
      description: Recorded Future related hash type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedTechnology.count
      description: Recorded Future related technology count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedTechnology.id
      description: Recorded Future related technology ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedTechnology.name
      description: Recorded Future related technology name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedTechnology.type
      description: Recorded Future related technology type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedEmailAddress.count
      description: Recorded Future related email address count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedEmailAddress.id
      description: Recorded Future related email address ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedEmailAddress.name
      description: Recorded Future related email address name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedEmailAddress.type
      description: Recorded Future related email address type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedAttackVector.count
      description: Recorded Future related attack vector count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedAttackVector.id
      description: Recorded Future related attack vector ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedAttackVector.name
      description: Recorded Future related attack vector name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedAttackVector.type
      description: Recorded Future related attack vector type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedMalwareCategory.count
      description: Recorded Future related malware category count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedMalwareCategory.id
      description: Recorded Future related malware category ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedMalwareCategory.name
      description: Recorded Future related malware category name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedMalwareCategory.type
      description: Recorded Future related malware category type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedOperations.count
      description: Recorded Future related operations count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedOperations.id
      description: Recorded Future related operations ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedOperations.name
      description: Recorded Future related operations name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedOperations.type
      description: Recorded Future related operations type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCompany.count
      description: Recorded Future related company count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCompany.id
      description: Recorded Future related company ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCompany.name
      description: Recorded Future related company name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCompany.type
      description: Recorded Future related company type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedLinks
      description: Recorded Future CVE related links.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.context_entities.id
      description: Recorded Future analyst note context entity ID.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.context_entities.name
      description: Recorded Future analyst note context entity name.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.context_entities.type
      description: Recorded Future analyst note context entity type.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.note_entities.id
      description: Recorded Future analyst note entity ID.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.note_entities.name
      description: Recorded Future analyst note entity name.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.note_entities.type
      description: Recorded Future analyst note entity type.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.published
      description: Recorded Future analyst note publishing time.
      type: date
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.validated_on
      description: Recorded Future analyst note validation time.
      type: date
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.text
      description: Recorded Future analyst note content.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.title
      description: Recorded Future analyst note title.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.topic.description
      description: Recorded Future analyst note topic description.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.topic.id
      description: Recorded Future analyst note topic ID.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.topic.name
      description: Recorded Future analyst note topic name.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.topic.type
      description: Recorded Future analyst note topic type.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.validation_urls.id
      description: Recorded Future analyst note validation URL ID.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.validation_urls.name
      description: Recorded Future analyst note validation URL.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.validation_urls.type
      description: Recorded Future analyst note validation URL entity type.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.id
      description: Recorded Future analyst note ID.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.source.id
      description: Recorded Future analyst note source ID.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.source.name
      description: Recorded Future analyst note source name.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.source.type
      description: Recorded Future analyst note source type.
      type: string
    - contextPath: RecordedFuture.CVE.cpe
      description: Recorded Future CPE information.
      type: string
    - contextPath: RecordedFuture.File.criticality
      description: Risk criticality.
      type: number
    - contextPath: RecordedFuture.File.criticalityLabel
      description: Risk criticality label.
      type: string
    - contextPath: RecordedFuture.File.riskString
      description: Risk string.
      type: string
    - contextPath: RecordedFuture.File.riskSummary
      description: Risk summary.
      type: string
    - contextPath: RecordedFuture.File.rules
      description: Risk rules.
      type: string
    - contextPath: RecordedFuture.File.concatRules
      description: All risk rules concatenated by comma.
      type: string
    - contextPath: RecordedFuture.File.score
      description: Risk score.
      type: number
    - contextPath: RecordedFuture.File.firstSeen
      description: Evidence first seen.
      type: date
    - contextPath: RecordedFuture.File.lastSeen
      description: Evidence last seen.
      type: date
    - contextPath: RecordedFuture.File.intelCard
      description: Recorded Future intelligence card URL.
      type: string
    - contextPath: RecordedFuture.File.hashAlgorithm
      description: Hash algorithm.
      type: string
    - contextPath: RecordedFuture.File.type
      description: Recorded Future entity type.
      type: string
    - contextPath: RecordedFuture.File.name
      description: Recorded Future entity name.
      type: string
    - contextPath: RecordedFuture.File.id
      description: Recorded Future entity ID.
      type: string
    - contextPath: RecordedFuture.File.metrics.type
      description: Recorded Future metrics type.
      type: string
    - contextPath: RecordedFuture.File.metrics.value
      description: Recorded Future metrics value.
      type: number
    - contextPath: RecordedFuture.File.threatLists.description
      description: Recorded Future threat list description.
      type: string
    - contextPath: RecordedFuture.File.threatLists.id
      description: Recorded Future threat list ID.
      type: string
    - contextPath: RecordedFuture.File.threatLists.name
      description: Recorded Future threat list name.
      type: string
    - contextPath: RecordedFuture.File.threatLists.type
      description: Recorded Future threat list type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedAttacker.count
      description: Recorded Future related attacker count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedAttacker.id
      description: Recorded Future related attacker ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedAttacker.name
      description: Recorded Future related attacker name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedAttacker.type
      description: Recorded Future related attacker type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedTarget.count
      description: Recorded Future related target count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedTarget.id
      description: Recorded Future related target ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedTarget.name
      description: Recorded Future related target name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedTarget.type
      description: Recorded Future related target type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedThreatActor.count
      description: Recorded Future related threat actor count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedThreatActor.id
      description: Recorded Future related threat actor ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedThreatActor.name
      description: Recorded Future related threat actor name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedThreatActor.type
      description: Recorded Future related threat actor type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedMalware.count
      description: Recorded Future related malware count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedMalware.id
      description: Recorded Future related malware ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedMalware.name
      description: Recorded Future related malware name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedMalware.type
      description: Recorded Future related malware type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.count
      description: Recorded Future related vulnerability count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.id
      description: Recorded Future related vulnerability ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.name
      description: Recorded Future related vulnerability name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.type
      description: Recorded Future related vulnerability type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedIpAddress.count
      description: Recorded Future related IP address count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedIpAddress.id
      description: Recorded Future related IP address ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedIpAddress.name
      description: Recorded Future related IP address name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedIpAddress.type
      description: Recorded Future related IP address type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedInternetDomainName.count
      description: Recorded Future related domain name count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedInternetDomainName.id
      description: Recorded Future related domain name ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedInternetDomainName.name
      description: Recorded Future related domain name name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedInternetDomainName.type
      description: Recorded Future related domain name type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedProduct.count
      description: Recorded Future related product count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedProduct.id
      description: Recorded Future related product ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedProduct.name
      description: Recorded Future related product name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedProduct.type
      description: Recorded Future related product type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCountries.count
      description: Recorded Future related countries count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCountries.id
      description: Recorded Future related countries ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCountries.name
      description: Recorded Future related countries name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCountries.type
      description: Recorded Future related countries type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedHash.count
      description: Recorded Future related hash count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedHash.id
      description: Recorded Future related hash ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedHash.name
      description: Recorded Future related hash name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedHash.type
      description: Recorded Future related hash type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedTechnology.count
      description: Recorded Future related technology count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedTechnology.id
      description: Recorded Future related technology ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedTechnology.name
      description: Recorded Future related technology name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedTechnology.type
      description: Recorded Future related technology type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedEmailAddress.count
      description: Recorded Future related email address count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedEmailAddress.id
      description: Recorded Future related email address ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedEmailAddress.name
      description: Recorded Future related email address name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedEmailAddress.type
      description: Recorded Future related email address type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedAttackVector.count
      description: Recorded Future related attack vector count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedAttackVector.id
      description: Recorded Future related attack vector ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedAttackVector.name
      description: Recorded Future related attack vector name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedAttackVector.type
      description: Recorded Future related attack vector type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedMalwareCategory.count
      description: Recorded Future related malware category count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedMalwareCategory.id
      description: Recorded Future related malware category ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedMalwareCategory.name
      description: Recorded Future related malware category name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedMalwareCategory.type
      description: Recorded Future related malware category type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedOperations.count
      description: Recorded Future related operations count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedOperations.id
      description: Recorded Future related operations ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedOperations.name
      description: Recorded Future related operations name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedOperations.type
      description: Recorded Future related operations type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCompany.count
      description: Recorded Future related company count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCompany.id
      description: Recorded Future related company ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCompany.name
      description: Recorded Future related company name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCompany.type
      description: Recorded Future related company type.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.context_entities.id
      description: Recorded Future analyst note context entity ID.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.context_entities.name
      description: Recorded Future analyst note context entity name.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.context_entities.type
      description: Recorded Future analyst note context entity type.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.note_entities.id
      description: Recorded Future analyst note entity ID.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.note_entities.name
      description: Recorded Future analyst note entity name.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.note_entities.type
      description: Recorded Future analyst note entity type.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.published
      description: Recorded Future analyst note publishing time.
      type: date
    - contextPath: RecordedFuture.File.analystNotes.attributes.validated_on
      description: Recorded Future analyst note validation time.
      type: date
    - contextPath: RecordedFuture.File.analystNotes.attributes.text
      description: Recorded Future analyst note content.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.title
      description: Recorded Future analyst note title.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.topic.description
      description: Recorded Future analyst note topic description.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.topic.id
      description: Recorded Future analyst note topic ID.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.topic.name
      description: Recorded Future analyst note topic name.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.topic.type
      description: Recorded Future analyst note topic type.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.validation_urls.id
      description: Recorded Future analyst note validation URL ID.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.validation_urls.name
      description: Recorded Future analyst note validation URL.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.validation_urls.type
      description: Recorded Future analyst note validation URL entity type.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.id
      description: Recorded Future analyst note ID.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.source.id
      description: Recorded Future analyst note source ID.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.source.name
      description: Recorded Future analyst note source name.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.source.type
      description: Recorded Future analyst note source type.
      type: string
    - contextPath: RecordedFuture.URL.criticality
      description: Risk criticality.
      type: number
    - contextPath: RecordedFuture.URL.criticalityLabel
      description: Risk criticality label.
      type: string
    - contextPath: RecordedFuture.URL.riskString
      description: Risk string.
      type: string
    - contextPath: RecordedFuture.URL.riskSummary
      description: Risk summary.
      type: string
    - contextPath: RecordedFuture.URL.rules
      description: Risk rules.
      type: string
    - contextPath: RecordedFuture.URL.concatRules
      description: All risk rules concatenated by comma.
      type: string
    - contextPath: RecordedFuture.URL.score
      description: Risk score.
      type: number
    - contextPath: RecordedFuture.URL.firstSeen
      description: Evidence first seen.
      type: date
    - contextPath: RecordedFuture.URL.lastSeen
      description: Evidence last seen.
      type: date
    - contextPath: RecordedFuture.URL.intelCard
      description: Recorded Future intelligence card URL.
      type: string
    - contextPath: RecordedFuture.URL.type
      description: Recorded Future entity type.
      type: string
    - contextPath: RecordedFuture.URL.name
      description: Recorded Future entity name.
      type: string
    - contextPath: RecordedFuture.URL.id
      description: Recorded Future entity ID.
      type: string
    - contextPath: RecordedFuture.URL.metrics.type
      description: Recorded Future metrics type.
      type: string
    - contextPath: RecordedFuture.URL.metrics.value
      description: Recorded Future metrics value.
      type: number
    - contextPath: RecordedFuture.URL.threatLists.description
      description: Recorded Future threat list description.
      type: string
    - contextPath: RecordedFuture.URL.threatLists.id
      description: Recorded Future threat list ID.
      type: string
    - contextPath: RecordedFuture.URL.threatLists.name
      description: Recorded Future threat list name.
      type: string
    - contextPath: RecordedFuture.URL.threatLists.type
      description: Recorded Future threat list type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedAttacker.count
      description: Recorded Future related attacker count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedAttacker.id
      description: Recorded Future related attacker ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedAttacker.name
      description: Recorded Future related attacker name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedAttacker.type
      description: Recorded Future related attacker type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedTarget.count
      description: Recorded Future related target count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedTarget.id
      description: Recorded Future related target ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedTarget.name
      description: Recorded Future related target name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedTarget.type
      description: Recorded Future related target type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedThreatActor.count
      description: Recorded Future related threat actor count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedThreatActor.id
      description: Recorded Future related threat actor ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedThreatActor.name
      description: Recorded Future related threat actor name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedThreatActor.type
      description: Recorded Future related threat actor type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedMalware.count
      description: Recorded Future related malware count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedMalware.id
      description: Recorded Future related malware ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedMalware.name
      description: Recorded Future related malware name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedMalware.type
      description: Recorded Future related malware type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCyberVulnerability.count
      description: Recorded Future related vulnerability count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCyberVulnerability.id
      description: Recorded Future related vulnerability ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCyberVulnerability.name
      description: Recorded Future related vulnerability name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCyberVulnerability.type
      description: Recorded Future related vulnerability type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedIpAddress.count
      description: Recorded Future related IP address count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedIpAddress.id
      description: Recorded Future related IP address ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedIpAddress.name
      description: Recorded Future related IP address name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedIpAddress.type
      description: Recorded Future related IP address type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedInternetDomainName.count
      description: Recorded Future related domain name count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedInternetDomainName.id
      description: Recorded Future related domain name ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedInternetDomainName.name
      description: Recorded Future related domain name name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedInternetDomainName.type
      description: Recorded Future related domain name type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedProduct.count
      description: Recorded Future related product count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedProduct.id
      description: Recorded Future related product ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedProduct.name
      description: Recorded Future related product name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedProduct.type
      description: Recorded Future related product type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCountries.count
      description: Recorded Future related countries count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCountries.id
      description: Recorded Future related countries ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCountries.name
      description: Recorded Future related countries name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCountries.type
      description: Recorded Future related countries type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedHash.count
      description: Recorded Future related hash count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedHash.id
      description: Recorded Future related hash ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedHash.name
      description: Recorded Future related hash name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedHash.type
      description: Recorded Future related hash type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedTechnology.count
      description: Recorded Future related technology count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedTechnology.id
      description: Recorded Future related technology ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedTechnology.name
      description: Recorded Future related technology name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedTechnology.type
      description: Recorded Future related technology type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedEmailAddress.count
      description: Recorded Future related email address count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedEmailAddress.id
      description: Recorded Future related email address ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedEmailAddress.name
      description: Recorded Future related email address name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedEmailAddress.type
      description: Recorded Future related email address type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedAttackVector.count
      description: Recorded Future related attack vector count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedAttackVector.id
      description: Recorded Future related attack vector ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedAttackVector.name
      description: Recorded Future related attack vector name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedAttackVector.type
      description: Recorded Future related attack vector type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedMalwareCategory.count
      description: Recorded Future related malware category count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedMalwareCategory.id
      description: Recorded Future related malware category ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedMalwareCategory.name
      description: Recorded Future related malware category name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedMalwareCategory.type
      description: Recorded Future related malware category type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedOperations.count
      description: Recorded Future related operations count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedOperations.id
      description: Recorded Future related operations ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedOperations.name
      description: Recorded Future related operations name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedOperations.type
      description: Recorded Future related operations type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCompany.count
      description: Recorded Future related company count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCompany.id
      description: Recorded Future related company ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCompany.name
      description: Recorded Future related company name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCompany.type
      description: Recorded Future related company type.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.context_entities.id
      description: Recorded Future analyst note context entity ID.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.context_entities.name
      description: Recorded Future analyst note context entity name.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.context_entities.type
      description: Recorded Future analyst note context entity type.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.note_entities.id
      description: Recorded Future analyst note entity ID.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.note_entities.name
      description: Recorded Future analyst note entity name.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.note_entities.type
      description: Recorded Future analyst note entity type.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.published
      description: Recorded Future analyst note publishing time.
      type: date
    - contextPath: RecordedFuture.URL.analystNotes.attributes.validated_on
      description: Recorded Future analyst note validation time.
      type: date
    - contextPath: RecordedFuture.URL.analystNotes.attributes.text
      description: Recorded Future analyst note content.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.title
      description: Recorded Future analyst note title.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.topic.description
      description: Recorded Future analyst note topic description.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.topic.id
      description: Recorded Future analyst note topic ID.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.topic.name
      description: Recorded Future analyst note topic name.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.topic.type
      description: Recorded Future analyst note topic type.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.validation_urls.id
      description: Recorded Future analyst note validation URL ID.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.validation_urls.name
      description: Recorded Future analyst note validation URL.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.validation_urls.type
      description: Recorded Future analyst note validation URL entity type.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.id
      description: Recorded Future analyst note ID.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.source.id
      description: Recorded Future analyst note source ID.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.source.name
      description: Recorded Future analyst note source name.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.source.type
      description: Recorded Future analyst note source type.
      type: string
    - contextPath: RecordedFuture.Malware.metrics.type
      description: Recorded Future metrics type.
      type: string
    - contextPath: RecordedFuture.Malware.metrics.value
      description: Recorded Future metrics value.
      type: number
    - contextPath: RecordedFuture.Malware.intelCard
      description: Recorded Future intelligence card URL.
      type: date
    - contextPath: RecordedFuture.Malware.firstSeen
      description: Evidence first seen.
      type: date
    - contextPath: RecordedFuture.Malware.lastSeen
      description: Evidence last seen.
      type: date
    - contextPath: RecordedFuture.Malware.name
      description: Recorded Future entity name.
      type: date
    - contextPath: RecordedFuture.Malware.type
      description: Recorded Future entity type (always = "Malware").
      type: string
    - contextPath: RecordedFuture.Malware.id
      description: Recorded Future malware ID.
      type: string
    - contextPath: RecordedFuture.Malware.categories.id
      description: Recorded Future malware category ID.
      type: string
    - contextPath: RecordedFuture.Malware.categories.name
      description: Recorded Future malware category name.
      type: string
    - contextPath: RecordedFuture.Malware.categories.type
      description: Recorded Future malware category type (always = "MalwareCategory").
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedAttacker.count
      description: Recorded Future related attacker count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedAttacker.id
      description: Recorded Future related attacker ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedAttacker.name
      description: Recorded Future related attacker name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedAttacker.type
      description: Recorded Future related attacker type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedTarget.count
      description: Recorded Future related target count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedTarget.id
      description: Recorded Future related target ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedTarget.name
      description: Recorded Future related target name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedTarget.type
      description: Recorded Future related target type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedThreatActor.count
      description: Recorded Future related threat actor count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedThreatActor.id
      description: Recorded Future related threat actor ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedThreatActor.name
      description: Recorded Future related threat actor name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedThreatActor.type
      description: Recorded Future related threat actor type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedMalware.count
      description: Recorded Future related malware count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedMalware.id
      description: Recorded Future related malware ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedMalware.name
      description: Recorded Future related malware name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedMalware.type
      description: Recorded Future related malware type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCyberVulnerability.count
      description: Recorded Future related vulnerability count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCyberVulnerability.id
      description: Recorded Future related vulnerability ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCyberVulnerability.name
      description: Recorded Future related vulnerability name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCyberVulnerability.type
      description: Recorded Future related vulnerability type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedIpAddress.count
      description: Recorded Future related IP address count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedIpAddress.id
      description: Recorded Future related IP address ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedIpAddress.name
      description: Recorded Future related IP address name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedIpAddress.type
      description: Recorded Future related IP address type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedInternetDomainName.count
      description: Recorded Future related domain name count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedInternetDomainName.id
      description: Recorded Future related domain name ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedInternetDomainName.name
      description: Recorded Future related domain name name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedInternetDomainName.type
      description: Recorded Future related domain name type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedProduct.count
      description: Recorded Future related product count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedProduct.id
      description: Recorded Future related product ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedProduct.name
      description: Recorded Future related product name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedProduct.type
      description: Recorded Future related product type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCountries.count
      description: Recorded Future related countries count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCountries.id
      description: Recorded Future related countries ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCountries.name
      description: Recorded Future related countries name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCountries.type
      description: Recorded Future related countries type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedHash.count
      description: Recorded Future related hash count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedHash.id
      description: Recorded Future related hash ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedHash.name
      description: Recorded Future related hash name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedHash.type
      description: Recorded Future related hash type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedTechnology.count
      description: Recorded Future related technology count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedTechnology.id
      description: Recorded Future related technology ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedTechnology.name
      description: Recorded Future related technology name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedTechnology.type
      description: Recorded Future related technology type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedEmailAddress.count
      description: Recorded Future related email address count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedEmailAddress.id
      description: Recorded Future related email address ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedEmailAddress.name
      description: Recorded Future related email address name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedEmailAddress.type
      description: Recorded Future related email address type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedAttackVector.count
      description: Recorded Future related attack vector count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedAttackVector.id
      description: Recorded Future related attack vector ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedAttackVector.name
      description: Recorded Future related attack vector name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedAttackVector.type
      description: Recorded Future related attack vector type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedMalwareCategory.count
      description: Recorded Future related malware category count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedMalwareCategory.id
      description: Recorded Future related malware category ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedMalwareCategory.name
      description: Recorded Future related malware category name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedMalwareCategory.type
      description: Recorded Future related malware category type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedOperations.count
      description: Recorded Future related operations count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedOperations.id
      description: Recorded Future related operations ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedOperations.name
      description: Recorded Future related operations name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedOperations.type
      description: Recorded Future related operations type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCompany.count
      description: Recorded Future related company count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCompany.id
      description: Recorded Future related company ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCompany.name
      description: Recorded Future related company name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCompany.type
      description: Recorded Future related company type.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.context_entities.id
      description: Recorded Future analyst note context entity ID.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.context_entities.name
      description: Recorded Future analyst note context entity name.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.context_entities.type
      description: Recorded Future analyst note context entity type.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.note_entities.id
      description: Recorded Future analyst note entity ID.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.note_entities.name
      description: Recorded Future analyst note entity name.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.note_entities.type
      description: Recorded Future analyst note entity type.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.published
      description: Recorded Future analyst note publishing time.
      type: date
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.validated_on
      description: Recorded Future analyst note validation time.
      type: date
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.text
      description: Recorded Future analyst note content.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.title
      description: Recorded Future analyst note title.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.topic.description
      description: Recorded Future analyst note topic description.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.topic.id
      description: Recorded Future analyst note topic ID.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.topic.name
      description: Recorded Future analyst note topic name.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.topic.type
      description: Recorded Future analyst note topic type.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.validation_urls.id
      description: Recorded Future analyst note validation URL ID.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.validation_urls.name
      description: Recorded Future analyst note validation URL.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.validation_urls.type
      description: Recorded Future analyst note validation URL entity type.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.id
      description: Recorded Future analyst note ID.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.source.id
      description: Recorded Future analyst note source ID.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.source.name
      description: Recorded Future analyst note source name.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.source.type
      description: Recorded Future analyst note source type.
      type: string

  - name: recordedfuture-links
    description: Get Insikt Group Research Links for an IP, Domain, CVE, URL, File, or Malware.
    arguments:
    - name: entity_type
      required: true
      description: The type of entity for which to fetch context. Should be provided with its value in entityValue argument. Can be "domain", "ip", "file", "url", "cve", or "malware".
      auto: PREDEFINED
      predefined:
      - domain
      - ip
      - file
      - url
      - cve
      - malware
    - name: entity
      required: true
      description: 'The value of the entity for which to fetch context. Should be provided with its type in entity_type argument. Supported hash types: MD5, SHA1, SHA256, SHA512, CRC32, and CTPH. Vulnerability supports CVEs.'
    outputs:
    - contextPath: RecordedFuture.Links.category
      description: Recorded Future links category.
      type: String
    - contextPath: RecordedFuture.Links.type
      description: Recorded Future links type.
      type: String
    - contextPath: RecordedFuture.Links.lists.entity_type
      description: Recorded Future links entity list type.
      type: String
    - contextPath: RecordedFuture.Links.lists.entities.type
      description: Recorded Future link entity type.
      type: String
    - contextPath: RecordedFuture.Links.lists.entities.name
      description: Recorded Future link entity name.
      type: String
    - contextPath: RecordedFuture.Links.lists.entities.score
      description: Recorded Future link entity risk score.
      type: Number

  - name: recordedfuture-single-alert
    description: 'Get detailed information from vulnerability, typosquat and credential alerts. Deprecated in favor of "Recorded Future Alerts" integration in "Recorded Future" pack.'
    deprecated: true
    arguments:
    - name: id
      description: Alert ID.
      required: true
    outputs:
    - contextPath: RecordedFuture.SingleAlert.id
      description: Recorded Future alert ID.
      type: string
    - contextPath: RecordedFuture.SingleAlert.flat_entities.fragment
      description: Recorded Future fragment of the entity.
      type: string
    - contextPath: RecordedFuture.SingleAlert.flat_entities.name
      description: Recorded Future name of the entity.
      type: string
    - contextPath: RecordedFuture.SingleAlert.flat_entities.type
      description: Recorded Future type of the entity.
      type: string
    - contextPath: RecordedFuture.SingleAlert.flat_entities.id
      description: Recorded Future ID of the entity.
      type: string

  - name: recordedfuture-alerts
    description: |-
      Gets details on alerts configured and generated by Recorded Future by alert rule ID and/or time range.
      
      Deprecated: use rf-alerts from "Recorded Future Alerts" integration in "Recorded Future" pack instead.
    deprecated: true
    arguments:
    - name: rule_id
      description: Alert rule ID.
    - name: limit
      description: Maximum number of alerts to return. Default is 10.
      defaultValue: "10"
    - name: triggered_time
      description: 'Alert triggered time, e.g., "1 hour" or "2 days".'
    - name: assignee
      description: 'Alert assignee''s email address.'
    - name: status
      auto: PREDEFINED
      predefined:
      - unassigned
      - assigned
      - pending
      - actionable
      - no-action
      - tuning
      description: 'Alert review status. Can be "unassigned", "assigned", "pending", "actionable", "no-action", or "tuning".'
    - name: freetext
      description: Free text search.
    - name: offset
      description: Alerts from offset.
    - name: orderby
      auto: PREDEFINED
      predefined:
      - triggered
      description: Alerts sort order.
    - name: direction
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: The direction by which to sort alerts. Can be "asc" or "desc".
    outputs:
    - contextPath: RecordedFuture.Alert.id
      description: Alert ID.
      type: string
    - contextPath: RecordedFuture.Alert.name
      description: Alert name.
      type: string
    - contextPath: RecordedFuture.Alert.type
      description: Alert type.
      type: string
    - contextPath: RecordedFuture.Alert.triggered
      description: Alert triggered time.
      type: date
    - contextPath: RecordedFuture.Alert.status
      description: Alert status.
      type: string
    - contextPath: RecordedFuture.Alert.assignee
      description: Alert assignee.
      type: string
    - contextPath: RecordedFuture.Alert.rule
      description: Alert rule name.
      type: string

  - name: recordedfuture-alert-rules
    description: |-
      Search for alert rule IDs.
      
      Deprecated: use rf-alerts from "Recorded Future Alerts" integration in "Recorded Future" pack instead.
    deprecated: true
    arguments:
    - name: rule_name
      description: Rule name to search. Can be a partial name.
    - name: limit
      description: 'Maximum number of rules to return. Default is 10.'
      defaultValue: "10"
    outputs:
    - contextPath: RecordedFuture.AlertRule.id
      description: Alert rule ID.
      type: string
    - contextPath: RecordedFuture.AlertRule.name
      description: Alert rule name.
      type: string

  - name: recordedfuture-alert-set-status
    description: |-
      Set alert into predefined status.
      
      Deprecated: use rf-alert-update from "Recorded Future Alerts" integration in "Recorded Future" pack instead.
    deprecated: true
    arguments:
    - name: alert_id
      required: true
      description: Alert id.
    - name: status
      required: true
      auto: PREDEFINED
      predefined:
      - unassigned
      - assigned
      - pending
      - dismiss
      - no-action
      - actionable
      - tuning
      description: The status we want to set for the alert in Recorded Future.
    outputs:
    - contextPath: RecordedFuture.Alerts.id
      description: Recorded Future alert ID.
      type: String
    - contextPath: RecordedFuture.Alerts.status
      description: Recorded Future alert status.
      type: String
    - contextPath: RecordedFuture.Alerts.note.text
      description: Recorded Future alert note text.
      type: String
    - contextPath: RecordedFuture.Alerts.note.author
      description: Recorded Future alert note author.
      type: String
    - contextPath: RecordedFuture.Alerts.note.date
      description: Recorded Future alert note date.
      type: date
    - contextPath: RecordedFuture.Alerts.reviewDate
      description: Recorded Future alert get date.
      type: date

  - name: recordedfuture-alert-set-note
    description: |-
      Set a note for the alert in Recorded Future.
      
      Deprecated: use rf-alert-update from "Recorded Future Alerts" integration in "Recorded Future" pack instead.
    deprecated: true
    arguments:
    - name: alert_id
      required: true
      description: Alert ID.
    - name: note
      required: true
      description: The note of the ID we want to set.
    outputs:
    - contextPath: RecordedFuture.Alerts.id
      description: Recorded Future alert ID.
      type: String
    - contextPath: RecordedFuture.Alerts.status
      description: Recorded Future alert status.
      type: String
    - contextPath: RecordedFuture.Alerts.note.text
      description: Recorded Future alert note text.
      type: String
    - contextPath: RecordedFuture.Alerts.note.author
      description: Recorded Future alert note author.
      type: String
    - contextPath: RecordedFuture.Alerts.note.date
      description: Recorded Future alert note date.
      type: date
    - contextPath: RecordedFuture.Alerts.reviewDate
      description: Recorded Future alert get date.
      type: date

  - name: recordedfuture-malware-search
    description: Search for a malware by specified filters.
    arguments:
    - name: freetext
      description: Part of malware name or ID to search for.
    - name: limit
      description: How many records to retrieve (default = 10).
    outputs:
    - contextPath: RecordedFuture.Malware.id
      description: Recorded Future malware ID.
      type: string
    - contextPath: RecordedFuture.Malware.name
      description: Recorded Future entity name.
      type: string
    - contextPath: RecordedFuture.Malware.type
      description: Recorded Future entity type (always = "Malware").
      type: string
    - contextPath: RecordedFuture.Malware.intelCard
      description: Recorded Future intelligence card URL.
      type: date

  - name: recordedfuture-threat-map
    description: Get threat actors map.
    arguments:
    - name: actors_ids
      isArray: true
      description: Actors IDs for which to get the threat map.
    - name: actor_name
      description: Actors name for which to get the threat map.
    - name: include_links
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Fetch links to threat actor or not.

    outputs:
    - contextPath: RecordedFuture.ThreatMap.id
      description: Recorded Future threat actor ID.
      type: string
    - contextPath: RecordedFuture.ThreatMap.name
      description: Recorded Future entity name.
      type: string
    - contextPath: RecordedFuture.ThreatMap.alias
      description: Recorded Future threat actor alias.
      type: array
    - contextPath: RecordedFuture.ThreatMap.intent
      description: Recorded Future threat actor intent.
      type: number
    - contextPath: RecordedFuture.ThreatMap.opportunity
      description: Recorded Future threat actor opportunity.
      type: number
    - contextPath: RecordedFuture.ThreatMap.log_entries
      description: Recorded Future threat actor log entries.
      type: array
    - contextPath: RecordedFuture.ThreatMap.links
      description: Recorded Future threat actor links by type.
      type: string

  - name: recordedfuture-threat-links
    description: Search links.
    arguments:
    - name: entity_type
      description: Type of the entity to fetch links for. E.g. "domain", "ip", "file", "url", "cve", "malware", "organization, "person". Should be provided along with the entity in entity_name argument.
      auto: PREDEFINED
      predefined:
      - IpAddress
      - URL
      - InternetDomainName
      - Hash
      - CyberVulnerability
      - CyberThreatActorCategory
      - AttackVector
      - Company
      - FileContent
      - Malware
      - MalwareCategory
      - MalwareSignature
      - MitreAttackIdentifier
      - Organization
      - Person
      - Username
    - name: entity_name
      description: Name of the entity to fetch links for.
    - name: entity_id
      description: ID of entity to fetch links for.
    - name: source_type
      description: Source of the links to be fetched. Can be "insikt" or "technical".
      auto: PREDEFINED
      predefined:
      - technical
      - insikt
    - name: timeframe
      description: Time range of the links to be fetched. Eg. "-1d" for last 1 day.
    - name: technical_type
      description: Type of technical source to fetch links from. Can be "type:MalwareAnalysis", "type:InfrastructureAnalysis", "type:NetworkTrafficAnalysis" or "type:TTPAnalysis".
    outputs:
    - contextPath: RecordedFuture.Links.entity.id
      description: Recorded Future Entity id.
      type: String
    - contextPath: RecordedFuture.Links.entity.type
      description: Recorded Future Entity type.
      type: String
    - contextPath: RecordedFuture.Links.links.type
      description: Recorded Future link type.
      type: String
    - contextPath: RecordedFuture.Links.links.id
      description: Recorded Future link id.
    - contextPath: RecordedFuture.Links.links.name
      description: Recorded Future link name.
    - contextPath: RecordedFuture.Links.links.source
      description: Recorded Future link source.
    - contextPath: RecordedFuture.Links.links.section
      description: Recorded Future link section.
    - contextPath: RecordedFuture.Links.links.attributes
      description: Recorded Future link attributes.

  - name: recordedfuture-detection-rules
    description: Search detection rules.
    arguments:
    - name: entity_type
      description: The type of entity for which to fetch context. Should be provided with its value in entity name argument. Can be "domain", "ip", "file", "url", "cve", or "malware".
      auto: PREDEFINED
      predefined:
      - IpAddress
      - URL
      - InternetDomainName
      - Hash
      - CyberVulnerability
      - CyberThreatActorCategory
      - AttackVector
      - Company
      - FileContent
      - Malware
      - MalwareCategory
      - MalwareSignature
      - MitreAttackIdentifier
      - Organization
      - Person
      - Username
    - name: entity_name
      description: Entity name.
    - name: entity_id
      description: Entity id.
    - name: rule_types
      isArray: true
      description: Rule type.
      auto: PREDEFINED
      predefined:
      - yara
      - sigma
      - snort
    - name: title
      description: Rule title.
    outputs:
    - contextPath: RecordedFuture.DetectionRules.id
      description: Recorded Future Detection rule id.
      type: String
    - contextPath: RecordedFuture.DetectionRules.type
      description: Recorded Future Detection rule type.
      type: String
    - contextPath: RecordedFuture.DetectionRules.title
      description: Recorded Future Detection rule title.
      type: String
    - contextPath: RecordedFuture.DetectionRules.description
      description: Recorded Future Detection rule description.
      type: String
    - contextPath: RecordedFuture.DetectionRules.created
      description: Recorded Future Detection rule created at.
      type: String
    - contextPath: RecordedFuture.DetectionRules.updated
      description: Recorded Future Detection rule updated at.
      type: String
    - contextPath: RecordedFuture.DetectionRules.rules
      description: Recorded Future Detection rules.
      type: array
    - contextPath: RecordedFuture.DetectionRules.rules.entities
      description: Recorded Future Detection rule entities.
      type: array
    - contextPath: RecordedFuture.DetectionRules.rules.entities.id
      description: Recorded Future Detection rule entity id.
      type: String
    - contextPath: RecordedFuture.DetectionRules.rules.entities.type
      description: Recorded Future Detection rule entity type.
      type: String
    - contextPath: RecordedFuture.DetectionRules.rules.entities.name
      description: Recorded Future Detection rule entity name.
      type: String
    - contextPath: RecordedFuture.DetectionRules.rules.content
      description: Recorded Future Detection rules content.
      type: String
    - contextPath: RecordedFuture.DetectionRules.rules.file_name
      description: Recorded Future Detection rules file_name.
      type: String

  - name: recordedfuture-collective-insight
    description: Post detection to collective insight.
    arguments:
    - name: entity_type
      required: true
      description: Value that can contain one of the enumerated list of values (ip, hash, domain, vulnerability, url).
      auto: PREDEFINED
      predefined:
      - ip
      - hash
      - domain
      - vulnerability
      - url
    - name: entity_name
      required: true
      description: Value of the IOC itself.
    - name: entity_field
      description: Used to describe characteristics about the IOC.
    - name: entity_source_type
      description: Used to describe what log source the IOC came from.
    - name: incident_name
      description: Title of the incident related to the IOC.
    - name: incident_id
      description: ID of the incident related to the IOC.
    - name: incident_type
      description: Attack vector associated with the incident (C2, Phishing.. etc).
    - name: mitre_codes
      description: List contains one or more MITRE codes associated with the IOC.
      isArray: true
    - name: malware
      description: List contains all known malware associated with the IOCs.
      isArray: true
    outputs:
    - contextPath: RecordedFuture.CollectiveInsight.status
      description: Request status.
      type: String

  isfetch: true
  runonce: false
tests:
- No tests
fromversion: 5.0.0
defaultclassifier: Recorded Future - Classifier
defaultmapperin: Recorded Future - Incoming Mapper