Recorded Future v2

Unique threat intel technology that automatically serves up relevant insights in real time.

Data Enrichment & Threat Intelligence · Recorded Future Intelligence

Details

IDRecorded Future v2
ProviderMastercard
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Unique threat intel technology that automatically serves up relevant insights in real time.
This integration was integrated and tested with version 2.4.3 of Recorded Future v2

Some changes have been made that might affect your existing content.
If you are upgrading from a previous version of this integration, see Breaking Changes.

Configure Recorded Future v2 in Cortex

Parameter Description Required
Server URL (e.g., https://api.recordedfuture.com/gw/xsoar/)   True
API Token   True
File Suspicious Threshold Minimum risk score from Recorded Future to consider the file suspicious. False
File Malicious Threshold Minimum risk score from Recorded Future to consider the file malicious. False
CVE Suspicious Threshold Minimum risk score from Recorded Future to consider the CVE suspicious. False
CVE Malicious Threshold Minimum risk score from Recorded Future to consider the CVE malicious. False
IP Suspicious Threshold Minimum risk score from Recorded Future to consider the IP suspicious. False
IP Malicious Threshold Minimum risk score from Recorded Future to consider the IP malicious. False
Domain Suspicious Threshold Minimum risk score from Recorded Future to consider the domain suspicious. False
Domain Malicious Threshold Minimum risk score from Recorded Future to consider the domain malicious. False
URL Suspicious Threshold Minimum risk score from Recorded Future to consider the URL suspicious. False
URL Malicious Threshold Minimum risk score from Recorded Future to consider the URL malicious. False
Vulnerability Threshold Minimum risk score from Recorded Future to consider the vulnerability critical. False
Collective Insights The Recorded Future Intelligence Cloud aggregates data related to indicators, driving collective insights to better identify threats. Anonymized data is collected for analytical purposes to identify trends and insights with the Intelligence Cloud. Go to the Recorded Future support site to learn more about Collective Insights. True
Trust any certificate (not secure)   False
Use system proxy settings   False
Fetch incidents   False
Rule names to fetch alerts by Rule names to fetch alerts by, separated by semicolon. If empty, all alerts will be fetched. False
Alert Statuses to include in the fetch Comma-separated alert statuses (e.g. “unassigned,assigned,pending,actionable,no-action,tuning”). If empty, the default value of “no-action” will be used. False
Update alert status on fetch. If selected, alerts with a status of ‘no-action’ will be updated to ‘pending’ once fetched by the integration. False
First fetch time Format: <number> <time unit>, e.g., “12 hours”, “7 days”, “3 months”, “1 year”. False
Incident type   False
Maximum number of incidents per fetch   False
Source Reliability Reliability of the source providing the intelligence data. False
    False
Incidents Fetch Interval   False
Incidents Fetch Interval   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

domain

Gets a quick indicator of the risk associated with a domain.

Base Command

domain

Input

Argument Name Description Required
domain The domain for which to get the reputation. Required

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
Domain.Malicious.Vendor string For malicious domains, the vendor that made the decision.
Domain.Malicious.Description string For malicious Domains, the reason that the vendor made the decision.
Domain.Name string Domain name.
RecordedFuture.Domain.riskScore number Recorded Future domain risk score.
RecordedFuture.Domain.riskLevel string Recorded Future domain risk level.
RecordedFuture.Domain.Evidence.rule string Recorded Future risk rule name.
RecordedFuture.Domain.Evidence.mitigation string Recorded Future risk rule mitigation.
RecordedFuture.Domain.Evidence.description string Recorded Future risk rule description.
RecordedFuture.Domain.Evidence.timestamp date Recorded Future risk rule timestamp.
RecordedFuture.Domain.Evidence.level number Recorded Future risk rule level.
RecordedFuture.Domain.Evidence.ruleid string Recorded Future risk rule ID.
RecordedFuture.Domain.name string Domain name.
RecordedFuture.Domain.maxRules number Maximum number of Recorded Future domain risk rules.
RecordedFuture.Domain.rules string All the rules concatenated by comma.
RecordedFuture.Domain.ruleCount number Number of triggered Recorded Future domain risk rules.

ip

Gets a quick indicator of the risk associated with an IP address.

Base Command

ip

Input

Argument Name Description Required
ip IP address for which to get the reputation. Required

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
IP.Malicious.Vendor string For malicious IP addresses, the vendor that made the decision.
IP.Malicious.Description string For malicious IP addresses, the reason that the vendor made the decision.
IP.Address string IP address.
RecordedFuture.IP.riskScore number Recorded Future IP risk score.
RecordedFuture.IP.riskLevel string Recorded Future IP risk level.
RecordedFuture.IP.Evidence.rule string Recorded Future risk rule name.
RecordedFuture.IP.Evidence.mitigation string Recorded Future risk rule mitigation.
RecordedFuture.IP.Evidence.description string Recorded Future risk rule description.
RecordedFuture.IP.Evidence.timestamp date Recorded Future risk rule timestamp.
RecordedFuture.IP.Evidence.level number Recorded Future risk rule level.
RecordedFuture.IP.Evidence.ruleid string Recorded Future risk rule ID.
RecordedFuture.IP.name string IP address.
RecordedFuture.IP.maxRules number Maximum number of Recorded Future IP risk rules.
RecordedFuture.IP.rules string All the rules concatenated by comma.
RecordedFuture.IP.ruleCount number Number of triggered Recorded Future IP risk rules.

file

Gets a quick indicator of the risk associated with a file.

Base Command

file

Input

Argument Name Description Required
file File hash for which to check the reputation. Can be an MD5, SHA1, SHA256, SHA512, CRC32 or CTPH. Required

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
File.SHA256 string SHA-256 hash of the file.
File.SHA512 string SHA-512 hash of the file.
File.SHA1 string SHA-1 hash of the file.
File.MD5 string MD5 hash of the file.
File.CRC32 string CRC32 hash of the file.
File.CTPH string CTPH hash of the file.
File.Malicious.Vendor string For malicious files, the vendor that made the decision.
File.Malicious.Description string For malicious files, the reason that the vendor made the decision.
RecordedFuture.File.riskScore number Recorded Future hash risk score.
RecordedFuture.File.riskLevel string Recorded Future hash risk level.
RecordedFuture.File.Evidence.rule string Recorded Future risk rule name.
RecordedFuture.File.Evidence.mitigation string Recorded Future risk rule mitigation.
RecordedFuture.File.Evidence.description string Recorded Future risk rule description.
RecordedFuture.File.Evidence.timestamp date Recorded Future risk rule timestamp.
RecordedFuture.File.Evidence.level number Recorded Future risk rule level.
RecordedFuture.File.Evidence.ruleid string Recorded Future risk rule ID.
RecordedFuture.File.name string File name.
RecordedFuture.File.maxRules number Maximum number of Recorded Future hash risk rules.
RecordedFuture.File.rules string All the rules concatenated by comma.
RecordedFuture.File.ruleCount number Number of triggered Recorded Future hash risk rules.

cve

Gets a quick indicator of the risk associated with a CVE.

Base Command

cve

Input

Argument Name Description Required
cve CVE for which to get the reputation. Required

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
CVE.ID string Vulnerability name.
RecordedFuture.CVE.riskScore number Recorded Future vulnerability risk score.
RecordedFuture.CVE.riskLevel string Recorded Future vulnerability risk level.
RecordedFuture.CVE.Evidence.rule string Recorded Future risk rule name.
RecordedFuture.CVE.Evidence.mitigation string Recorded Future risk rule mitigation.
RecordedFuture.CVE.Evidence.description string Recorded Future risk rule description.
RecordedFuture.CVE.Evidence.timestamp date Recorded Future risk rule timestamp.
RecordedFuture.CVE.Evidence.level number Recorded Future risk rule level.
RecordedFuture.CVE.Evidence.ruleid string Recorded Future risk rule ID.
RecordedFuture.CVE.name string CVE name.
RecordedFuture.CVE.maxRules number Maximum number of Recorded Future vulnerability risk rules.
RecordedFuture.CVE.rules string All the rules concatenated by comma.
RecordedFuture.CVE.ruleCount number Number of triggered Recorded Future vulnerability risk rules.

url

Gets a quick indicator of the risk associated with a URL.

Base Command

url

Input

Argument Name Description Required
url URL for which to get the reputation. Required

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
URL.Malicious.Vendor string For malicious URLs, the vendor that made the decision.
URL.Malicious.Description string For malicious URLs, the reason that the vendor made the decision.
URL.Data string URL name.
RecordedFuture.URL.riskScore number Recorded Future URL risk score.
RecordedFuture.URL.riskLevel string Recorded Future URL risk level.
RecordedFuture.URL.Evidence.rule string Recorded Risk rule name.
RecordedFuture.URL.Evidence.mitigation string Recorded Risk rule mitigation.
RecordedFuture.URL.Evidence.description string Recorded Risk rule description.
RecordedFuture.URL.Evidence.timestamp date Recorded Risk rule timestamp.
RecordedFuture.URL.Evidence.level number Recorded Risk rule level.
RecordedFuture.URL.Evidence.ruleid string Recorded Risk rule ID.
RecordedFuture.URL.name string URL name.
RecordedFuture.URL.maxRules number Maximum number of Recorded Future URL risk rules.
RecordedFuture.URL.rules string All the rules concatenated by comma.
RecordedFuture.URL.ruleCount number Number of triggered Recorded Future URL risk rules.

recordedfuture-threat-assessment

Get an indicator of the risk based on context.

Base Command

recordedfuture-threat-assessment

Input

Argument Name Description Required
context Context to use for the assessment. This is used by Recorded Future to calculate the relevant score and verdict. Can be “c2”, “malware”, or “phishing”. Possible values are: c2, malware, phishing. Required
ip IP addresses to check if they are related to the selected context. Optional
domain Domains to check if they are related to the selected context. Optional
file File hashes to check if they are related to the selected context. Optional
url URLs to check if they are related to the selected context. Optional
cve CVEs to check if they are related to the selected context. Optional
filter Will filter out entities that have zero as score. Possible values are: yes, no. Optional

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string Indicator type.
DBotScore.Vendor string Vendor used to calculate the score.
DBotScore.Score number The actual score.
File.SHA256 string SHA-256 hash of the file.
File.SHA512 string SHA-512 hash of the file.
File.SHA1 string SHA-1 hash of the file.
File.MD5 string MD5 hash of the file.
File.CRC32 string CRC32 hash of the file.
File.CTPH string CTPH hash of the file.
IP.Address string IP address.
IP.ASN string ASN.
IP.Geo.Country string IP address geolocation country.
Domain.Name string Domain name.
URL.Data string URL name.
CVE.ID string Vulnerability name.
RecordedFuture.verdict boolean Recorded Future verdict.
RecordedFuture.context string Threat assessment context.
RecordedFuture.riskScore number Recorded Future maximum risk score.
RecordedFuture.Entities.id string Recorded Future entity ID.
RecordedFuture.Entities.name string Recorded Future entity name.
RecordedFuture.Entities.type string Recorded Future entity type.
RecordedFuture.Entities.score string Recorded Future entity score.
RecordedFuture.Entities.context string Contains the current context if there is evidence.
RecordedFuture.Entities.Evidence.ruleid string Recorded Future risk rule ID.
RecordedFuture.Entities.Evidence.timestamp date Recorded Future evidence timestamp.
RecordedFuture.Entities.Evidence.mitigation string Recorded Future evidence mitigation.
RecordedFuture.Entities.Evidence.description string Recorded Future evidence description.
RecordedFuture.Entities.Evidence.rule string Recorded Future risk rule.
RecordedFuture.Entities.Evidence.level number Recorded Future risk rule level.

recordedfuture-intelligence

Get threat intelligence for an IP, Domain, CVE, URL, File or Malware.

Base Command

recordedfuture-intelligence

Input

Argument Name Description Required
profile Depending on what profile you choose you will get different related entities matching the given profile. Possible values are: All, Threat Hunter, SecOp Analyst, TI Analyst, Vulnerability Analyst. Default is All. Optional
entity_type The type of entity for which to fetch context. Should be provided with its value in entityValue argument. Can be “domain”, “ip”, “file”, “url”, “cve”, or “malware”. Possible values are: domain, ip, file, url, cve, malware. Required
entity The value of the entity for which to fetch context. Should be provided with its type in entity_type argument. Supported hash types: MD5, SHA1, SHA256, SHA512, CRC32, and CTPH. Vulnerability supports CVEs. Required
fetch_related_entities Whether to fetch related entity data. Can be “yes” or “no”. Possible values are: yes, no. Optional
fetch_analyst_notes Whether to fetch analyst notes. Can be “yes” or “no”. Possible values are: yes, no. Default is no. Optional
fetch_riskyCIDRips Whether risk scores for other IP addresses within the same CIDR should be fetched (only for IP intelligence). Can be “yes” or “no”. Possible values are: no, yes. Default is no. Optional

Context Output

Path Type Description
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string Indicator type.
DBotScore.Vendor string Vendor used to calculate the score.
DBotScore.Score number The actual score.
File.SHA256 string SHA-256 hash of the file.
File.SHA512 string SHA-512 hash of the file.
File.SHA1 string SHA-1 hash of the file.
File.MD5 string MD5 hash of the file.
File.CRC32 string CRC32 hash of the file.
File.CTPH string CTPH hash of the file.
IP.Address string IP address.
IP.ASN string ASN.
IP.Geo.Country string IP address geolocation country.
Domain.Name string Domain name.
URL.Data string URL name.
CVE.ID string Vulnerability name.
RecordedFuture.IP.criticality number Risk criticality.
RecordedFuture.IP.criticalityLabel string Risk criticality label.
RecordedFuture.IP.riskString string Risk string.
RecordedFuture.IP.riskSummary string Risk summary.
RecordedFuture.IP.rules string Risk rules.
RecordedFuture.Ip.concatRules string All risk rules concatenated by comma.
RecordedFuture.IP.score number Risk score.
RecordedFuture.IP.firstSeen date Evidence first seen date.
RecordedFuture.IP.lastSeen date Evidence last seen date.
RecordedFuture.IP.intelCard string Recorded Future intelligence card URL.
RecordedFuture.IP.type string Recorded Future entity type.
RecordedFuture.IP.name string Recorded Future entity name.
RecordedFuture.IP.id string Recorded Future entity ID.
RecordedFuture.IP.location.asn string ASN number.
RecordedFuture.IP.location.cidr.id string Recorded Future CIDR ID.
RecordedFuture.IP.location.cidr.name string CIDR name.
RecordedFuture.IP.location.cidr.type string CIDR type.
RecordedFuture.IP.location.location.city string IP address geolocation city.
RecordedFuture.IP.location.location.continent string IP address geolocation continent.
RecordedFuture.IP.location.location.country string IP address geolocation country.
RecordedFuture.IP.location.organization string IP address geolocation organization.
RecordedFuture.IP.metrics.type string Recorded Future metrics type.
RecordedFuture.IP.metrics.value number Recorded Future metrics value.
RecordedFuture.IP.threatLists.description string Recorded Future threat list description.
RecordedFuture.IP.threatLists.id string Recorded Future threat list ID.
RecordedFuture.IP.threatLists.name string Recorded Future threat list name.
RecordedFuture.IP.threatLists.type string Recorded Future threat list type.
RecordedFuture.IP.relatedEntities.RelatedAttacker.count number Recorded Future related attacker count.
RecordedFuture.IP.relatedEntities.RelatedAttacker.id string Recorded Future related attacker ID.
RecordedFuture.IP.relatedEntities.RelatedAttacker.name string Recorded Future related attacker name.
RecordedFuture.IP.relatedEntities.RelatedAttacker.type string Recorded Future related attacker type.
RecordedFuture.IP.relatedEntities.RelatedTarget.count number Recorded Future related target count.
RecordedFuture.IP.relatedEntities.RelatedTarget.id string Recorded Future related target ID.
RecordedFuture.IP.relatedEntities.RelatedTarget.name string Recorded Future related target name.
RecordedFuture.IP.relatedEntities.RelatedTarget.type string Recorded Future related target type.
RecordedFuture.IP.relatedEntities.RelatedThreatActor.count number Recorded Future related threat actor count.
RecordedFuture.IP.relatedEntities.RelatedThreatActor.id string Recorded Future related threat actor ID.
RecordedFuture.IP.relatedEntities.RelatedThreatActor.name string Recorded Future related threat actor name.
RecordedFuture.IP.relatedEntities.RelatedThreatActor.type string Recorded Future related threat actor type.
RecordedFuture.IP.relatedEntities.RelatedMalware.count number Recorded Future related malware count.
RecordedFuture.IP.relatedEntities.RelatedMalware.id string Recorded Future related malware ID.
RecordedFuture.IP.relatedEntities.RelatedMalware.name string Recorded Future related malware name.
RecordedFuture.IP.relatedEntities.RelatedMalware.type string Recorded Future related malware type.
RecordedFuture.IP.relatedEntities.RelatedCyberVulnerability.count number Recorded Future related vulnerability count.
RecordedFuture.IP.relatedEntities.RelatedCyberVulnerability.id string Recorded Future related vulnerability ID.
RecordedFuture.IP.relatedEntities.RelatedCyberVulnerability.name string Recorded Future related vulnerability name.
RecordedFuture.IP.relatedEntities.RelatedCyberVulnerability.type string Recorded Future related vulnerability type.
RecordedFuture.IP.relatedEntities.RelatedIpAddress.count number Recorded Future related IP address count.
RecordedFuture.IP.relatedEntities.RelatedIpAddress.id string Recorded Future related IP address ID.
RecordedFuture.IP.relatedEntities.RelatedIpAddress.name string Recorded Future related IP address name.
RecordedFuture.IP.relatedEntities.RelatedIpAddress.type string Recorded Future related IP address type.
RecordedFuture.IP.relatedEntities.RelatedInternetDomainName.count number Recorded Future related domain name count.
RecordedFuture.IP.relatedEntities.RelatedInternetDomainName.id string Recorded Future related domain name ID.
RecordedFuture.IP.relatedEntities.RelatedInternetDomainName.name string Recorded Future related domain name name.
RecordedFuture.IP.relatedEntities.RelatedInternetDomainName.type string Recorded Future related domain name type.
RecordedFuture.IP.relatedEntities.RelatedProduct.count number Recorded Future related product count.
RecordedFuture.IP.relatedEntities.RelatedProduct.id string Recorded Future related product ID.
RecordedFuture.IP.relatedEntities.RelatedProduct.name string Recorded Future related product name.
RecordedFuture.IP.relatedEntities.RelatedProduct.type string Recorded Future related product type.
RecordedFuture.IP.relatedEntities.RelatedCountries.count number Recorded Future related countries count.
RecordedFuture.IP.relatedEntities.RelatedCountries.id string Recorded Future related countries ID.
RecordedFuture.IP.relatedEntities.RelatedCountries.name string Recorded Future related countries name.
RecordedFuture.IP.relatedEntities.RelatedCountries.type string Recorded Future related countries type.
RecordedFuture.IP.relatedEntities.RelatedHash.count number Recorded Future related hash count.
RecordedFuture.IP.relatedEntities.RelatedHash.id string Recorded Future related hash ID.
RecordedFuture.IP.relatedEntities.RelatedHash.name string Recorded Future related hash name.
RecordedFuture.IP.relatedEntities.RelatedHash.type string Recorded Future related hash type.
RecordedFuture.IP.relatedEntities.RelatedTechnology.count number Recorded Future related technology count.
RecordedFuture.IP.relatedEntities.RelatedTechnology.id string Recorded Future related technology ID.
RecordedFuture.IP.relatedEntities.RelatedTechnology.name string Recorded Future related technology name.
RecordedFuture.IP.relatedEntities.RelatedTechnology.type string Recorded Future related technology type.
RecordedFuture.IP.relatedEntities.RelatedEmailAddress.count number Recorded Future related email address count.
RecordedFuture.IP.relatedEntities.RelatedEmailAddress.id string Recorded Future related email address ID.
RecordedFuture.IP.relatedEntities.RelatedEmailAddress.name string Recorded Future related email address name.
RecordedFuture.IP.relatedEntities.RelatedEmailAddress.type string Recorded Future related email address type.
RecordedFuture.IP.relatedEntities.RelatedAttackVector.count number Recorded Future related attack vector count.
RecordedFuture.IP.relatedEntities.RelatedAttackVector.id string Recorded Future related attack vector ID.
RecordedFuture.IP.relatedEntities.RelatedAttackVector.name string Recorded Future related attack vector name.
RecordedFuture.IP.relatedEntities.RelatedAttackVector.type string Recorded Future related attack vector type.
RecordedFuture.IP.relatedEntities.RelatedMalwareCategory.count number Recorded Future related malware category count.
RecordedFuture.IP.relatedEntities.RelatedMalwareCategory.id string Recorded Future related malware category ID.
RecordedFuture.IP.relatedEntities.RelatedMalwareCategory.name string Recorded Future related malware category name.
RecordedFuture.IP.relatedEntities.RelatedMalwareCategory.type string Recorded Future related malware category type.
RecordedFuture.IP.relatedEntities.RelatedOperations.count number Recorded Future related operations count.
RecordedFuture.IP.relatedEntities.RelatedOperations.id string Recorded Future related operations ID.
RecordedFuture.IP.relatedEntities.RelatedOperations.name string Recorded Future related operations name.
RecordedFuture.IP.relatedEntities.RelatedOperations.type string Recorded Future related operations type.
RecordedFuture.IP.relatedEntities.RelatedCompany.count number Recorded Future related company count.
RecordedFuture.IP.relatedEntities.RelatedCompany.id string Recorded Future related company ID.
RecordedFuture.IP.relatedEntities.RelatedCompany.name string Recorded Future related company name.
RecordedFuture.IP.relatedEntities.RelatedCompany.type string Recorded Future related company type.
RecordedFuture.IP.analystNotes.attributes.context_entities.id string Recorded Future analyst note context entity ID.
RecordedFuture.IP.analystNotes.attributes.context_entities.name string Recorded Future analyst note context entity name.
RecordedFuture.IP.analystNotes.attributes.context_entities.type string Recorded Future analyst note context entity type.
RecordedFuture.IP.analystNotes.attributes.note_entities.id string Recorded Future analyst note entity ID.
RecordedFuture.IP.analystNotes.attributes.note_entities.name string Recorded Future analyst note entity name.
RecordedFuture.IP.analystNotes.attributes.note_entities.type string Recorded Future analyst note entity type.
RecordedFuture.IP.analystNotes.attributes.published date Recorded Future analyst note publishing time.
RecordedFuture.IP.analystNotes.attributes.validated_on date Recorded Future analyst note validation time.
RecordedFuture.IP.analystNotes.attributes.text string Recorded Future analyst note content.
RecordedFuture.IP.analystNotes.attributes.title string Recorded Future analyst note title.
RecordedFuture.IP.analystNotes.attributes.topic.description string Recorded Future analyst note topic description.
RecordedFuture.IP.analystNotes.attributes.topic.id string Recorded Future analyst note topic ID.
RecordedFuture.IP.analystNotes.attributes.topic.name string Recorded Future analyst note topic name.
RecordedFuture.IP.analystNotes.attributes.topic.type string Recorded Future analyst note topic type.
RecordedFuture.IP.analystNotes.attributes.validation_urls.id string Recorded Future analyst note validation URL ID.
RecordedFuture.IP.analystNotes.attributes.validation_urls.name string Recorded Future analyst note validation URL.
RecordedFuture.IP.analystNotes.attributes.validation_urls.type string Recorded Future analyst note validation URL entity type.
RecordedFuture.IP.analystNotes.id string Recorded Future analyst note ID.
RecordedFuture.IP.analystNotes.source.id string Recorded Future analyst note source ID.
RecordedFuture.IP.analystNotes.source.name string Recorded Future analyst note source name.
RecordedFuture.IP.analystNotes.source.type string Recorded Future analyst note source type.
RecordedFuture.Domain.criticality number Risk criticality.
RecordedFuture.Domain.criticalityLabel string Risk criticality label.
RecordedFuture.Domain.riskString string Risk string.
RecordedFuture.Domain.riskSummary string Risk summary.
RecordedFuture.Domain.rules string Risk rules.
RecordedFuture.Domain.concatRules string All risk rules concatenated by comma.
RecordedFuture.Domain.score number Risk score.
RecordedFuture.Domain.firstSeen date Evidence first seen date.
RecordedFuture.Domain.lastSeen date Evidence last seen.
RecordedFuture.Domain.intelCard string Recorded Future intelligence card URL.
RecordedFuture.Domain.type string Recorded Future entity type.
RecordedFuture.Domain.name string Recorded Future entity name.
RecordedFuture.Domain.id string Recorded Future entity ID.
RecordedFuture.Domain.metrics.type string Recorded Future metrics type.
RecordedFuture.Domain.metrics.value number Recorded Future metrics value.
RecordedFuture.Domain.threatLists.description string Recorded Future threat list description.
RecordedFuture.Domain.threatLists.id string Recorded Future threat list ID.
RecordedFuture.Domain.threatLists.name string Recorded Future threat list name.
RecordedFuture.Domain.threatLists.type string Recorded Future threat list type.
RecordedFuture.Domain.relatedEntities.RelatedAttacker.count number Recorded Future related attacker count.
RecordedFuture.Domain.relatedEntities.RelatedAttacker.id string Recorded Future related attacker ID.
RecordedFuture.Domain.relatedEntities.RelatedAttacker.name string Recorded Future related attacker name.
RecordedFuture.Domain.relatedEntities.RelatedAttacker.type string Recorded Future related attacker type.
RecordedFuture.Domain.relatedEntities.RelatedTarget.count number Recorded Future related target count.
RecordedFuture.Domain.relatedEntities.RelatedTarget.id string Recorded Future related target ID.
RecordedFuture.Domain.relatedEntities.RelatedTarget.name string Recorded Future related target name.
RecordedFuture.Domain.relatedEntities.RelatedTarget.type string Recorded Future related target type.
RecordedFuture.Domain.relatedEntities.RelatedThreatActor.count number Recorded Future related threat actor count.
RecordedFuture.Domain.relatedEntities.RelatedThreatActor.id string Recorded Future related threat actor ID.
RecordedFuture.Domain.relatedEntities.RelatedThreatActor.name string Recorded Future related threat actor name.
RecordedFuture.Domain.relatedEntities.RelatedThreatActor.type string Recorded Future related threat actor type.
RecordedFuture.Domain.relatedEntities.RelatedMalware.count number Recorded Future related malware count.
RecordedFuture.Domain.relatedEntities.RelatedMalware.id string Recorded Future related malware ID.
RecordedFuture.Domain.relatedEntities.RelatedMalware.name string Recorded Future related malware name.
RecordedFuture.Domain.relatedEntities.RelatedMalware.type string Recorded Future related malware type.
RecordedFuture.Domain.relatedEntities.RelatedCyberVulnerability.count number Recorded Future related vulnerability count.
RecordedFuture.Domain.relatedEntities.RelatedCyberVulnerability.id string Recorded Future related vulnerability ID.
RecordedFuture.Domain.relatedEntities.RelatedCyberVulnerability.name string Recorded Future related vulnerability name.
RecordedFuture.Domain.relatedEntities.RelatedCyberVulnerability.type string Recorded Future related vulnerability type.
RecordedFuture.Domain.relatedEntities.RelatedIpAddress.count number Recorded Future related IP address count.
RecordedFuture.Domain.relatedEntities.RelatedIpAddress.id string Recorded Future related IP address ID.
RecordedFuture.Domain.relatedEntities.RelatedIpAddress.name string Recorded Future related IP address name.
RecordedFuture.Domain.relatedEntities.RelatedIpAddress.type string Recorded Future related IP address type.
RecordedFuture.Domain.relatedEntities.RelatedInternetDomainName.count number Recorded Future related domain name count.
RecordedFuture.Domain.relatedEntities.RelatedInternetDomainName.id string Recorded Future related domain name ID.
RecordedFuture.Domain.relatedEntities.RelatedInternetDomainName.name string Recorded Future related domain name name.
RecordedFuture.Domain.relatedEntities.RelatedInternetDomainName.type string Recorded Future related domain name type.
RecordedFuture.Domain.relatedEntities.RelatedProduct.count number Recorded Future related product count.
RecordedFuture.Domain.relatedEntities.RelatedProduct.id string Recorded Future related product ID.
RecordedFuture.Domain.relatedEntities.RelatedProduct.name string Recorded Future related product name.
RecordedFuture.Domain.relatedEntities.RelatedProduct.type string Recorded Future related product type.
RecordedFuture.Domain.relatedEntities.RelatedCountries.count number Recorded Future related countries count.
RecordedFuture.Domain.relatedEntities.RelatedCountries.id string Recorded Future related countries ID.
RecordedFuture.Domain.relatedEntities.RelatedCountries.name string Recorded Future related countries name.
RecordedFuture.Domain.relatedEntities.RelatedCountries.type string Recorded Future related countries type.
RecordedFuture.Domain.relatedEntities.RelatedHash.count number Recorded Future related hash count.
RecordedFuture.Domain.relatedEntities.RelatedHash.id string Recorded Future related hash ID.
RecordedFuture.Domain.relatedEntities.RelatedHash.name string Recorded Future related hash name.
RecordedFuture.Domain.relatedEntities.RelatedHash.type string Recorded Future related hash type.
RecordedFuture.Domain.relatedEntities.RelatedTechnology.count number Recorded Future related technology count.
RecordedFuture.Domain.relatedEntities.RelatedTechnology.id string Recorded Future related technology ID.
RecordedFuture.Domain.relatedEntities.RelatedTechnology.name string Recorded Future related technology name.
RecordedFuture.Domain.relatedEntities.RelatedTechnology.type string Recorded Future related technology type.
RecordedFuture.Domain.relatedEntities.RelatedEmailAddress.count number Recorded Future related email address count.
RecordedFuture.Domain.relatedEntities.RelatedEmailAddress.id string Recorded Future related email address ID.
RecordedFuture.Domain.relatedEntities.RelatedEmailAddress.name string Recorded Future related email address name.
RecordedFuture.Domain.relatedEntities.RelatedEmailAddress.type string Recorded Future related email address type.
RecordedFuture.Domain.relatedEntities.RelatedAttackVector.count number Recorded Future related attack vector count.
RecordedFuture.Domain.relatedEntities.RelatedAttackVector.id string Recorded Future related attack vector ID.
RecordedFuture.Domain.relatedEntities.RelatedAttackVector.name string Recorded Future related attack vector name.
RecordedFuture.Domain.relatedEntities.RelatedAttackVector.type string Recorded Future related attack vector type.
RecordedFuture.Domain.relatedEntities.RelatedMalwareCategory.count number Recorded Future related malware category count.
RecordedFuture.Domain.relatedEntities.RelatedMalwareCategory.id string Recorded Future related malware category ID.
RecordedFuture.Domain.relatedEntities.RelatedMalwareCategory.name string Recorded Future related malware category name.
RecordedFuture.Domain.relatedEntities.RelatedMalwareCategory.type string Recorded Future related malware category type.
RecordedFuture.Domain.relatedEntities.RelatedOperations.count number Recorded Future related operations count.
RecordedFuture.Domain.relatedEntities.RelatedOperations.id string Recorded Future related operations ID.
RecordedFuture.Domain.relatedEntities.RelatedOperations.name string Recorded Future related operations name.
RecordedFuture.Domain.relatedEntities.RelatedOperations.type string Recorded Future related operations type.
RecordedFuture.Domain.relatedEntities.RelatedCompany.count number Recorded Future related company count.
RecordedFuture.Domain.relatedEntities.RelatedCompany.id string Recorded Future related company ID.
RecordedFuture.Domain.relatedEntities.RelatedCompany.name string Recorded Future related company name.
RecordedFuture.Domain.relatedEntities.RelatedCompany.type string Recorded Future related company type.
RecordedFuture.Domain.analystNotes.attributes.context_entities.id string Recorded Future analyst note context entity ID.
RecordedFuture.Domain.analystNotes.attributes.context_entities.name string Recorded Future analyst note context entity name.
RecordedFuture.Domain.analystNotes.attributes.context_entities.type string Recorded Future analyst note context entity type.
RecordedFuture.Domain.analystNotes.attributes.note_entities.id string Recorded Future analyst note entity ID.
RecordedFuture.Domain.analystNotes.attributes.note_entities.name string Recorded Future analyst note entity name.
RecordedFuture.Domain.analystNotes.attributes.note_entities.type string Recorded Future analyst note entity type.
RecordedFuture.Domain.analystNotes.attributes.published date Recorded Future analyst note publishing time.
RecordedFuture.Domain.analystNotes.attributes.validated_on date Recorded Future analyst note validation time.
RecordedFuture.Domain.analystNotes.attributes.text string Recorded Future analyst note content.
RecordedFuture.Domain.analystNotes.attributes.title string Recorded Future analyst note title.
RecordedFuture.Domain.analystNotes.attributes.topic.description string Recorded Future analyst note topic description.
RecordedFuture.Domain.analystNotes.attributes.topic.id string Recorded Future analyst note topic ID.
RecordedFuture.Domain.analystNotes.attributes.topic.name string Recorded Future analyst note topic name.
RecordedFuture.Domain.analystNotes.attributes.topic.type string Recorded Future analyst note topic type.
RecordedFuture.Domain.analystNotes.attributes.validation_urls.id string Recorded Future analyst note validation URL ID.
RecordedFuture.Domain.analystNotes.attributes.validation_urls.name string Recorded Future analyst note validation URL.
RecordedFuture.Domain.analystNotes.attributes.validation_urls.type string Recorded Future analyst note validation URL entity type.
RecordedFuture.Domain.analystNotes.id string Recorded Future analyst note ID.
RecordedFuture.Domain.analystNotes.source.id string Recorded Future analyst note source ID.
RecordedFuture.Domain.analystNotes.source.name string Recorded Future analyst note source name.
RecordedFuture.Domain.analystNotes.source.type string Recorded Future analyst note source type.
RecordedFuture.CVE.criticality number Risk criticality.
RecordedFuture.CVE.criticalityLabel string Risk criticality label.
RecordedFuture.CVE.riskString string Risk string.
RecordedFuture.CVE.riskSummary string Risk summary.
RecordedFuture.CVE.rules string Risk rules.
RecordedFuture.CVE.concatRules string All risk rules concatenated by comma.
RecordedFuture.CVE.score number Risk score.
RecordedFuture.CVE.firstSeen date Evidence first seen.
RecordedFuture.CVE.lastSeen date Evidence last seen.
RecordedFuture.CVE.intelCard string Recorded Future intelligence card URL.
RecordedFuture.CVE.hashAlgorithm string Hash algorithm.
RecordedFuture.CVE.type string Recorded Future entity type.
RecordedFuture.CVE.name string Recorded Future entity name.
RecordedFuture.CVE.id string Recorded Future entity ID.
RecordedFuture.CVE.metrics.type string Recorded Future metrics type.
RecordedFuture.CVE.metrics.value number Recorded Future metrics value.
RecordedFuture.CVE.threatLists.description string Recorded Future threat list description.
RecordedFuture.CVE.threatLists.id string Recorded Future threat list ID.
RecordedFuture.CVE.threatLists.name string Recorded Future threat list name.
RecordedFuture.CVE.threatLists.type string Recorded Future threat list type.
RecordedFuture.CVE.relatedEntities.RelatedAttacker.count number Recorded Future related attacker count.
RecordedFuture.CVE.relatedEntities.RelatedAttacker.id string Recorded Future related attacker ID.
RecordedFuture.CVE.relatedEntities.RelatedAttacker.name string Recorded Future related attacker name.
RecordedFuture.CVE.relatedEntities.RelatedAttacker.type string Recorded Future related attacker type.
RecordedFuture.CVE.relatedEntities.RelatedTarget.count number Recorded Future related target count.
RecordedFuture.CVE.relatedEntities.RelatedTarget.id string Recorded Future related target ID.
RecordedFuture.CVE.relatedEntities.RelatedTarget.name string Recorded Future related target name.
RecordedFuture.CVE.relatedEntities.RelatedTarget.type string Recorded Future related target type.
RecordedFuture.CVE.relatedEntities.RelatedThreatActor.count number Recorded Future related threat actor count.
RecordedFuture.CVE.relatedEntities.RelatedThreatActor.id string Recorded Future related threat actor ID.
RecordedFuture.CVE.relatedEntities.RelatedThreatActor.name string Recorded Future related threat actor name.
RecordedFuture.CVE.relatedEntities.RelatedThreatActor.type string Recorded Future related threat actor type.
RecordedFuture.CVE.relatedEntities.RelatedMalware.count number Recorded Future related malware count.
RecordedFuture.CVE.relatedEntities.RelatedMalware.id string Recorded Future related malware ID.
RecordedFuture.CVE.relatedEntities.RelatedMalware.name string Recorded Future related malware name.
RecordedFuture.CVE.relatedEntities.RelatedMalware.type string Recorded Future related malware type.
RecordedFuture.CVE.relatedEntities.RelatedCyberVulnerability.count number Recorded Future related vulnerability count.
RecordedFuture.CVE.relatedEntities.RelatedCyberVulnerability.id string Recorded Future related vulnerability ID.
RecordedFuture.CVE.relatedEntities.RelatedCyberVulnerability.name string Recorded Future related vulnerability name.
RecordedFuture.CVE.relatedEntities.RelatedCyberVulnerability.type string Recorded Future related vulnerability type.
RecordedFuture.CVE.relatedEntities.RelatedIpAddress.count number Recorded Future related IP address count.
RecordedFuture.CVE.relatedEntities.RelatedIpAddress.id string Recorded Future related IP address ID.
RecordedFuture.CVE.relatedEntities.RelatedIpAddress.name string Recorded Future related IP address name.
RecordedFuture.CVE.relatedEntities.RelatedIpAddress.type string Recorded Future related IP address type.
RecordedFuture.CVE.relatedEntities.RelatedInternetDomainName.count number Recorded Future related domain name count.
RecordedFuture.CVE.relatedEntities.RelatedInternetDomainName.id string Recorded Future related domain name ID.
RecordedFuture.CVE.relatedEntities.RelatedInternetDomainName.name string Recorded Future related domain name name.
RecordedFuture.CVE.relatedEntities.RelatedInternetDomainName.type string Recorded Future related domain name type.
RecordedFuture.CVE.relatedEntities.RelatedProduct.count number Recorded Future related product count.
RecordedFuture.CVE.relatedEntities.RelatedProduct.id string Recorded Future related product ID.
RecordedFuture.CVE.relatedEntities.RelatedProduct.name string Recorded Future related product name.
RecordedFuture.CVE.relatedEntities.RelatedProduct.type string Recorded Future related product type.
RecordedFuture.CVE.relatedEntities.RelatedCountries.count number Recorded Future related countries count.
RecordedFuture.CVE.relatedEntities.RelatedCountries.id string Recorded Future related countries ID.
RecordedFuture.CVE.relatedEntities.RelatedCountries.name string Recorded Future related countries name.
RecordedFuture.CVE.relatedEntities.RelatedCountries.type string Recorded Future related countries type.
RecordedFuture.CVE.relatedEntities.RelatedHash.count number Recorded Future related hash count.
RecordedFuture.CVE.relatedEntities.RelatedHash.id string Recorded Future related hash ID.
RecordedFuture.CVE.relatedEntities.RelatedHash.name string Recorded Future related hash name.
RecordedFuture.CVE.relatedEntities.RelatedHash.type string Recorded Future related hash type.
RecordedFuture.CVE.relatedEntities.RelatedTechnology.count number Recorded Future related technology count.
RecordedFuture.CVE.relatedEntities.RelatedTechnology.id string Recorded Future related technology ID.
RecordedFuture.CVE.relatedEntities.RelatedTechnology.name string Recorded Future related technology name.
RecordedFuture.CVE.relatedEntities.RelatedTechnology.type string Recorded Future related technology type.
RecordedFuture.CVE.relatedEntities.RelatedEmailAddress.count number Recorded Future related email address count.
RecordedFuture.CVE.relatedEntities.RelatedEmailAddress.id string Recorded Future related email address ID.
RecordedFuture.CVE.relatedEntities.RelatedEmailAddress.name string Recorded Future related email address name.
RecordedFuture.CVE.relatedEntities.RelatedEmailAddress.type string Recorded Future related email address type.
RecordedFuture.CVE.relatedEntities.RelatedAttackVector.count number Recorded Future related attack vector count.
RecordedFuture.CVE.relatedEntities.RelatedAttackVector.id string Recorded Future related attack vector ID.
RecordedFuture.CVE.relatedEntities.RelatedAttackVector.name string Recorded Future related attack vector name.
RecordedFuture.CVE.relatedEntities.RelatedAttackVector.type string Recorded Future related attack vector type.
RecordedFuture.CVE.relatedEntities.RelatedMalwareCategory.count number Recorded Future related malware category count.
RecordedFuture.CVE.relatedEntities.RelatedMalwareCategory.id string Recorded Future related malware category ID.
RecordedFuture.CVE.relatedEntities.RelatedMalwareCategory.name string Recorded Future related malware category name.
RecordedFuture.CVE.relatedEntities.RelatedMalwareCategory.type string Recorded Future related malware category type.
RecordedFuture.CVE.relatedEntities.RelatedOperations.count number Recorded Future related operations count.
RecordedFuture.CVE.relatedEntities.RelatedOperations.id string Recorded Future related operations ID.
RecordedFuture.CVE.relatedEntities.RelatedOperations.name string Recorded Future related operations name.
RecordedFuture.CVE.relatedEntities.RelatedOperations.type string Recorded Future related operations type.
RecordedFuture.CVE.relatedEntities.RelatedCompany.count number Recorded Future related company count.
RecordedFuture.CVE.relatedEntities.RelatedCompany.id string Recorded Future related company ID.
RecordedFuture.CVE.relatedEntities.RelatedCompany.name string Recorded Future related company name.
RecordedFuture.CVE.relatedEntities.RelatedCompany.type string Recorded Future related company type.
RecordedFuture.CVE.relatedLinks string Recorded Future CVE related links.
RecordedFuture.CVE.analystNotes.attributes.context_entities.id string Recorded Future analyst note context entity ID.
RecordedFuture.CVE.analystNotes.attributes.context_entities.name string Recorded Future analyst note context entity name.
RecordedFuture.CVE.analystNotes.attributes.context_entities.type string Recorded Future analyst note context entity type.
RecordedFuture.CVE.analystNotes.attributes.note_entities.id string Recorded Future analyst note entity ID.
RecordedFuture.CVE.analystNotes.attributes.note_entities.name string Recorded Future analyst note entity name.
RecordedFuture.CVE.analystNotes.attributes.note_entities.type string Recorded Future analyst note entity type.
RecordedFuture.CVE.analystNotes.attributes.published date Recorded Future analyst note publishing time.
RecordedFuture.CVE.analystNotes.attributes.validated_on date Recorded Future analyst note validation time.
RecordedFuture.CVE.analystNotes.attributes.text string Recorded Future analyst note content.
RecordedFuture.CVE.analystNotes.attributes.title string Recorded Future analyst note title.
RecordedFuture.CVE.analystNotes.attributes.topic.description string Recorded Future analyst note topic description.
RecordedFuture.CVE.analystNotes.attributes.topic.id string Recorded Future analyst note topic ID.
RecordedFuture.CVE.analystNotes.attributes.topic.name string Recorded Future analyst note topic name.
RecordedFuture.CVE.analystNotes.attributes.topic.type string Recorded Future analyst note topic type.
RecordedFuture.CVE.analystNotes.attributes.validation_urls.id string Recorded Future analyst note validation URL ID.
RecordedFuture.CVE.analystNotes.attributes.validation_urls.name string Recorded Future analyst note validation URL.
RecordedFuture.CVE.analystNotes.attributes.validation_urls.type string Recorded Future analyst note validation URL entity type.
RecordedFuture.CVE.analystNotes.id string Recorded Future analyst note ID.
RecordedFuture.CVE.analystNotes.source.id string Recorded Future analyst note source ID.
RecordedFuture.CVE.analystNotes.source.name string Recorded Future analyst note source name.
RecordedFuture.CVE.analystNotes.source.type string Recorded Future analyst note source type.
RecordedFuture.CVE.cpe string Recorded Future CPE information.
RecordedFuture.File.criticality number Risk criticality.
RecordedFuture.File.criticalityLabel string Risk criticality label.
RecordedFuture.File.riskString string Risk string.
RecordedFuture.File.riskSummary string Risk summary.
RecordedFuture.File.rules string Risk rules.
RecordedFuture.File.concatRules string All risk rules concatenated by comma.
RecordedFuture.File.score number Risk score.
RecordedFuture.File.firstSeen date Evidence first seen.
RecordedFuture.File.lastSeen date Evidence last seen.
RecordedFuture.File.intelCard string Recorded Future intelligence card URL.
RecordedFuture.File.hashAlgorithm string Hash algorithm.
RecordedFuture.File.type string Recorded Future entity type.
RecordedFuture.File.name string Recorded Future entity name.
RecordedFuture.File.id string Recorded Future entity ID.
RecordedFuture.File.metrics.type string Recorded Future metrics type.
RecordedFuture.File.metrics.value number Recorded Future metrics value.
RecordedFuture.File.threatLists.description string Recorded Future threat list description.
RecordedFuture.File.threatLists.id string Recorded Future threat list ID.
RecordedFuture.File.threatLists.name string Recorded Future threat list name.
RecordedFuture.File.threatLists.type string Recorded Future threat list type.
RecordedFuture.File.relatedEntities.RelatedAttacker.count number Recorded Future related attacker count.
RecordedFuture.File.relatedEntities.RelatedAttacker.id string Recorded Future related attacker ID.
RecordedFuture.File.relatedEntities.RelatedAttacker.name string Recorded Future related attacker name.
RecordedFuture.File.relatedEntities.RelatedAttacker.type string Recorded Future related attacker type.
RecordedFuture.File.relatedEntities.RelatedTarget.count number Recorded Future related target count.
RecordedFuture.File.relatedEntities.RelatedTarget.id string Recorded Future related target ID.
RecordedFuture.File.relatedEntities.RelatedTarget.name string Recorded Future related target name.
RecordedFuture.File.relatedEntities.RelatedTarget.type string Recorded Future related target type.
RecordedFuture.File.relatedEntities.RelatedThreatActor.count number Recorded Future related threat actor count.
RecordedFuture.File.relatedEntities.RelatedThreatActor.id string Recorded Future related threat actor ID.
RecordedFuture.File.relatedEntities.RelatedThreatActor.name string Recorded Future related threat actor name.
RecordedFuture.File.relatedEntities.RelatedThreatActor.type string Recorded Future related threat actor type.
RecordedFuture.File.relatedEntities.RelatedMalware.count number Recorded Future related malware count.
RecordedFuture.File.relatedEntities.RelatedMalware.id string Recorded Future related malware ID.
RecordedFuture.File.relatedEntities.RelatedMalware.name string Recorded Future related malware name.
RecordedFuture.File.relatedEntities.RelatedMalware.type string Recorded Future related malware type.
RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.count number Recorded Future related vulnerability count.
RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.id string Recorded Future related vulnerability ID.
RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.name string Recorded Future related vulnerability name.
RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.type string Recorded Future related vulnerability type.
RecordedFuture.File.relatedEntities.RelatedIpAddress.count number Recorded Future related IP address count.
RecordedFuture.File.relatedEntities.RelatedIpAddress.id string Recorded Future related IP address ID.
RecordedFuture.File.relatedEntities.RelatedIpAddress.name string Recorded Future related IP address name.
RecordedFuture.File.relatedEntities.RelatedIpAddress.type string Recorded Future related IP address type.
RecordedFuture.File.relatedEntities.RelatedInternetDomainName.count number Recorded Future related domain name count.
RecordedFuture.File.relatedEntities.RelatedInternetDomainName.id string Recorded Future related domain name ID.
RecordedFuture.File.relatedEntities.RelatedInternetDomainName.name string Recorded Future related domain name name.
RecordedFuture.File.relatedEntities.RelatedInternetDomainName.type string Recorded Future related domain name type.
RecordedFuture.File.relatedEntities.RelatedProduct.count number Recorded Future related product count.
RecordedFuture.File.relatedEntities.RelatedProduct.id string Recorded Future related product ID.
RecordedFuture.File.relatedEntities.RelatedProduct.name string Recorded Future related product name.
RecordedFuture.File.relatedEntities.RelatedProduct.type string Recorded Future related product type.
RecordedFuture.File.relatedEntities.RelatedCountries.count number Recorded Future related countries count.
RecordedFuture.File.relatedEntities.RelatedCountries.id string Recorded Future related countries ID.
RecordedFuture.File.relatedEntities.RelatedCountries.name string Recorded Future related countries name.
RecordedFuture.File.relatedEntities.RelatedCountries.type string Recorded Future related countries type.
RecordedFuture.File.relatedEntities.RelatedHash.count number Recorded Future related hash count.
RecordedFuture.File.relatedEntities.RelatedHash.id string Recorded Future related hash ID.
RecordedFuture.File.relatedEntities.RelatedHash.name string Recorded Future related hash name.
RecordedFuture.File.relatedEntities.RelatedHash.type string Recorded Future related hash type.
RecordedFuture.File.relatedEntities.RelatedTechnology.count number Recorded Future related technology count.
RecordedFuture.File.relatedEntities.RelatedTechnology.id string Recorded Future related technology ID.
RecordedFuture.File.relatedEntities.RelatedTechnology.name string Recorded Future related technology name.
RecordedFuture.File.relatedEntities.RelatedTechnology.type string Recorded Future related technology type.
RecordedFuture.File.relatedEntities.RelatedEmailAddress.count number Recorded Future related email address count.
RecordedFuture.File.relatedEntities.RelatedEmailAddress.id string Recorded Future related email address ID.
RecordedFuture.File.relatedEntities.RelatedEmailAddress.name string Recorded Future related email address name.
RecordedFuture.File.relatedEntities.RelatedEmailAddress.type string Recorded Future related email address type.
RecordedFuture.File.relatedEntities.RelatedAttackVector.count number Recorded Future related attack vector count.
RecordedFuture.File.relatedEntities.RelatedAttackVector.id string Recorded Future related attack vector ID.
RecordedFuture.File.relatedEntities.RelatedAttackVector.name string Recorded Future related attack vector name.
RecordedFuture.File.relatedEntities.RelatedAttackVector.type string Recorded Future related attack vector type.
RecordedFuture.File.relatedEntities.RelatedMalwareCategory.count number Recorded Future related malware category count.
RecordedFuture.File.relatedEntities.RelatedMalwareCategory.id string Recorded Future related malware category ID.
RecordedFuture.File.relatedEntities.RelatedMalwareCategory.name string Recorded Future related malware category name.
RecordedFuture.File.relatedEntities.RelatedMalwareCategory.type string Recorded Future related malware category type.
RecordedFuture.File.relatedEntities.RelatedOperations.count number Recorded Future related operations count.
RecordedFuture.File.relatedEntities.RelatedOperations.id string Recorded Future related operations ID.
RecordedFuture.File.relatedEntities.RelatedOperations.name string Recorded Future related operations name.
RecordedFuture.File.relatedEntities.RelatedOperations.type string Recorded Future related operations type.
RecordedFuture.File.relatedEntities.RelatedCompany.count number Recorded Future related company count.
RecordedFuture.File.relatedEntities.RelatedCompany.id string Recorded Future related company ID.
RecordedFuture.File.relatedEntities.RelatedCompany.name string Recorded Future related company name.
RecordedFuture.File.relatedEntities.RelatedCompany.type string Recorded Future related company type.
RecordedFuture.File.analystNotes.attributes.context_entities.id string Recorded Future analyst note context entity ID.
RecordedFuture.File.analystNotes.attributes.context_entities.name string Recorded Future analyst note context entity name.
RecordedFuture.File.analystNotes.attributes.context_entities.type string Recorded Future analyst note context entity type.
RecordedFuture.File.analystNotes.attributes.note_entities.id string Recorded Future analyst note entity ID.
RecordedFuture.File.analystNotes.attributes.note_entities.name string Recorded Future analyst note entity name.
RecordedFuture.File.analystNotes.attributes.note_entities.type string Recorded Future analyst note entity type.
RecordedFuture.File.analystNotes.attributes.published date Recorded Future analyst note publishing time.
RecordedFuture.File.analystNotes.attributes.validated_on date Recorded Future analyst note validation time.
RecordedFuture.File.analystNotes.attributes.text string Recorded Future analyst note content.
RecordedFuture.File.analystNotes.attributes.title string Recorded Future analyst note title.
RecordedFuture.File.analystNotes.attributes.topic.description string Recorded Future analyst note topic description.
RecordedFuture.File.analystNotes.attributes.topic.id string Recorded Future analyst note topic ID.
RecordedFuture.File.analystNotes.attributes.topic.name string Recorded Future analyst note topic name.
RecordedFuture.File.analystNotes.attributes.topic.type string Recorded Future analyst note topic type.
RecordedFuture.File.analystNotes.attributes.validation_urls.id string Recorded Future analyst note validation URL ID.
RecordedFuture.File.analystNotes.attributes.validation_urls.name string Recorded Future analyst note validation URL.
RecordedFuture.File.analystNotes.attributes.validation_urls.type string Recorded Future analyst note validation URL entity type.
RecordedFuture.File.analystNotes.id string Recorded Future analyst note ID.
RecordedFuture.File.analystNotes.source.id string Recorded Future analyst note source ID.
RecordedFuture.File.analystNotes.source.name string Recorded Future analyst note source name.
RecordedFuture.File.analystNotes.source.type string Recorded Future analyst note source type.
RecordedFuture.URL.criticality number Risk criticality.
RecordedFuture.URL.criticalityLabel string Risk criticality label.
RecordedFuture.URL.riskString string Risk string.
RecordedFuture.URL.riskSummary string Risk summary.
RecordedFuture.URL.rules string Risk rules.
RecordedFuture.URL.concatRules string All risk rules concatenated by comma.
RecordedFuture.URL.score number Risk score.
RecordedFuture.URL.firstSeen date Evidence first seen.
RecordedFuture.URL.lastSeen date Evidence last seen.
RecordedFuture.URL.intelCard string Recorded Future intelligence card URL.
RecordedFuture.URL.type string Recorded Future entity type.
RecordedFuture.URL.name string Recorded Future entity name.
RecordedFuture.URL.id string Recorded Future entity ID.
RecordedFuture.URL.metrics.type string Recorded Future metrics type.
RecordedFuture.URL.metrics.value number Recorded Future metrics value.
RecordedFuture.URL.threatLists.description string Recorded Future threat list description.
RecordedFuture.URL.threatLists.id string Recorded Future threat list ID.
RecordedFuture.URL.threatLists.name string Recorded Future threat list name.
RecordedFuture.URL.threatLists.type string Recorded Future threat list type.
RecordedFuture.URL.relatedEntities.RelatedAttacker.count number Recorded Future related attacker count.
RecordedFuture.URL.relatedEntities.RelatedAttacker.id string Recorded Future related attacker ID.
RecordedFuture.URL.relatedEntities.RelatedAttacker.name string Recorded Future related attacker name.
RecordedFuture.URL.relatedEntities.RelatedAttacker.type string Recorded Future related attacker type.
RecordedFuture.URL.relatedEntities.RelatedTarget.count number Recorded Future related target count.
RecordedFuture.URL.relatedEntities.RelatedTarget.id string Recorded Future related target ID.
RecordedFuture.URL.relatedEntities.RelatedTarget.name string Recorded Future related target name.
RecordedFuture.URL.relatedEntities.RelatedTarget.type string Recorded Future related target type.
RecordedFuture.URL.relatedEntities.RelatedThreatActor.count number Recorded Future related threat actor count.
RecordedFuture.URL.relatedEntities.RelatedThreatActor.id string Recorded Future related threat actor ID.
RecordedFuture.URL.relatedEntities.RelatedThreatActor.name string Recorded Future related threat actor name.
RecordedFuture.URL.relatedEntities.RelatedThreatActor.type string Recorded Future related threat actor type.
RecordedFuture.URL.relatedEntities.RelatedMalware.count number Recorded Future related malware count.
RecordedFuture.URL.relatedEntities.RelatedMalware.id string Recorded Future related malware ID.
RecordedFuture.URL.relatedEntities.RelatedMalware.name string Recorded Future related malware name.
RecordedFuture.URL.relatedEntities.RelatedMalware.type string Recorded Future related malware type.
RecordedFuture.URL.relatedEntities.RelatedCyberVulnerability.count number Recorded Future related vulnerability count.
RecordedFuture.URL.relatedEntities.RelatedCyberVulnerability.id string Recorded Future related vulnerability ID.
RecordedFuture.URL.relatedEntities.RelatedCyberVulnerability.name string Recorded Future related vulnerability name.
RecordedFuture.URL.relatedEntities.RelatedCyberVulnerability.type string Recorded Future related vulnerability type.
RecordedFuture.URL.relatedEntities.RelatedIpAddress.count number Recorded Future related IP address count.
RecordedFuture.URL.relatedEntities.RelatedIpAddress.id string Recorded Future related IP address ID.
RecordedFuture.URL.relatedEntities.RelatedIpAddress.name string Recorded Future related IP address name.
RecordedFuture.URL.relatedEntities.RelatedIpAddress.type string Recorded Future related IP address type.
RecordedFuture.URL.relatedEntities.RelatedInternetDomainName.count number Recorded Future related domain name count.
RecordedFuture.URL.relatedEntities.RelatedInternetDomainName.id string Recorded Future related domain name ID.
RecordedFuture.URL.relatedEntities.RelatedInternetDomainName.name string Recorded Future related domain name name.
RecordedFuture.URL.relatedEntities.RelatedInternetDomainName.type string Recorded Future related domain name type.
RecordedFuture.URL.relatedEntities.RelatedProduct.count number Recorded Future related product count.
RecordedFuture.URL.relatedEntities.RelatedProduct.id string Recorded Future related product ID.
RecordedFuture.URL.relatedEntities.RelatedProduct.name string Recorded Future related product name.
RecordedFuture.URL.relatedEntities.RelatedProduct.type string Recorded Future related product type.
RecordedFuture.URL.relatedEntities.RelatedCountries.count number Recorded Future related countries count.
RecordedFuture.URL.relatedEntities.RelatedCountries.id string Recorded Future related countries ID.
RecordedFuture.URL.relatedEntities.RelatedCountries.name string Recorded Future related countries name.
RecordedFuture.URL.relatedEntities.RelatedCountries.type string Recorded Future related countries type.
RecordedFuture.URL.relatedEntities.RelatedHash.count number Recorded Future related hash count.
RecordedFuture.URL.relatedEntities.RelatedHash.id string Recorded Future related hash ID.
RecordedFuture.URL.relatedEntities.RelatedHash.name string Recorded Future related hash name.
RecordedFuture.URL.relatedEntities.RelatedHash.type string Recorded Future related hash type.
RecordedFuture.URL.relatedEntities.RelatedTechnology.count number Recorded Future related technology count.
RecordedFuture.URL.relatedEntities.RelatedTechnology.id string Recorded Future related technology ID.
RecordedFuture.URL.relatedEntities.RelatedTechnology.name string Recorded Future related technology name.
RecordedFuture.URL.relatedEntities.RelatedTechnology.type string Recorded Future related technology type.
RecordedFuture.URL.relatedEntities.RelatedEmailAddress.count number Recorded Future related email address count.
RecordedFuture.URL.relatedEntities.RelatedEmailAddress.id string Recorded Future related email address ID.
RecordedFuture.URL.relatedEntities.RelatedEmailAddress.name string Recorded Future related email address name.
RecordedFuture.URL.relatedEntities.RelatedEmailAddress.type string Recorded Future related email address type.
RecordedFuture.URL.relatedEntities.RelatedAttackVector.count number Recorded Future related attack vector count.
RecordedFuture.URL.relatedEntities.RelatedAttackVector.id string Recorded Future related attack vector ID.
RecordedFuture.URL.relatedEntities.RelatedAttackVector.name string Recorded Future related attack vector name.
RecordedFuture.URL.relatedEntities.RelatedAttackVector.type string Recorded Future related attack vector type.
RecordedFuture.URL.relatedEntities.RelatedMalwareCategory.count number Recorded Future related malware category count.
RecordedFuture.URL.relatedEntities.RelatedMalwareCategory.id string Recorded Future related malware category ID.
RecordedFuture.URL.relatedEntities.RelatedMalwareCategory.name string Recorded Future related malware category name.
RecordedFuture.URL.relatedEntities.RelatedMalwareCategory.type string Recorded Future related malware category type.
RecordedFuture.URL.relatedEntities.RelatedOperations.count number Recorded Future related operations count.
RecordedFuture.URL.relatedEntities.RelatedOperations.id string Recorded Future related operations ID.
RecordedFuture.URL.relatedEntities.RelatedOperations.name string Recorded Future related operations name.
RecordedFuture.URL.relatedEntities.RelatedOperations.type string Recorded Future related operations type.
RecordedFuture.URL.relatedEntities.RelatedCompany.count number Recorded Future related company count.
RecordedFuture.URL.relatedEntities.RelatedCompany.id string Recorded Future related company ID.
RecordedFuture.URL.relatedEntities.RelatedCompany.name string Recorded Future related company name.
RecordedFuture.URL.relatedEntities.RelatedCompany.type string Recorded Future related company type.
RecordedFuture.URL.analystNotes.attributes.context_entities.id string Recorded Future analyst note context entity ID.
RecordedFuture.URL.analystNotes.attributes.context_entities.name string Recorded Future analyst note context entity name.
RecordedFuture.URL.analystNotes.attributes.context_entities.type string Recorded Future analyst note context entity type.
RecordedFuture.URL.analystNotes.attributes.note_entities.id string Recorded Future analyst note entity ID.
RecordedFuture.URL.analystNotes.attributes.note_entities.name string Recorded Future analyst note entity name.
RecordedFuture.URL.analystNotes.attributes.note_entities.type string Recorded Future analyst note entity type.
RecordedFuture.URL.analystNotes.attributes.published date Recorded Future analyst note publishing time.
RecordedFuture.URL.analystNotes.attributes.validated_on date Recorded Future analyst note validation time.
RecordedFuture.URL.analystNotes.attributes.text string Recorded Future analyst note content.
RecordedFuture.URL.analystNotes.attributes.title string Recorded Future analyst note title.
RecordedFuture.URL.analystNotes.attributes.topic.description string Recorded Future analyst note topic description.
RecordedFuture.URL.analystNotes.attributes.topic.id string Recorded Future analyst note topic ID.
RecordedFuture.URL.analystNotes.attributes.topic.name string Recorded Future analyst note topic name.
RecordedFuture.URL.analystNotes.attributes.topic.type string Recorded Future analyst note topic type.
RecordedFuture.URL.analystNotes.attributes.validation_urls.id string Recorded Future analyst note validation URL ID.
RecordedFuture.URL.analystNotes.attributes.validation_urls.name string Recorded Future analyst note validation URL.
RecordedFuture.URL.analystNotes.attributes.validation_urls.type string Recorded Future analyst note validation URL entity type.
RecordedFuture.URL.analystNotes.id string Recorded Future analyst note ID.
RecordedFuture.URL.analystNotes.source.id string Recorded Future analyst note source ID.
RecordedFuture.URL.analystNotes.source.name string Recorded Future analyst note source name.
RecordedFuture.URL.analystNotes.source.type string Recorded Future analyst note source type.
RecordedFuture.Malware.metrics.type string Recorded Future metrics type.
RecordedFuture.Malware.metrics.value number Recorded Future metrics value.
RecordedFuture.Malware.intelCard date Recorded Future intelligence card URL.
RecordedFuture.Malware.firstSeen date Evidence first seen.
RecordedFuture.Malware.lastSeen date Evidence last seen.
RecordedFuture.Malware.name date Recorded Future entity name.
RecordedFuture.Malware.type string Recorded Future entity type (always = “Malware”).
RecordedFuture.Malware.id string Recorded Future malware ID.
RecordedFuture.Malware.categories.id string Recorded Future malware category ID.
RecordedFuture.Malware.categories.name string Recorded Future malware category name.
RecordedFuture.Malware.categories.type string Recorded Future malware category type (always = “MalwareCategory”).
RecordedFuture.Malware.relatedEntities.RelatedAttacker.count number Recorded Future related attacker count.
RecordedFuture.Malware.relatedEntities.RelatedAttacker.id string Recorded Future related attacker ID.
RecordedFuture.Malware.relatedEntities.RelatedAttacker.name string Recorded Future related attacker name.
RecordedFuture.Malware.relatedEntities.RelatedAttacker.type string Recorded Future related attacker type.
RecordedFuture.Malware.relatedEntities.RelatedTarget.count number Recorded Future related target count.
RecordedFuture.Malware.relatedEntities.RelatedTarget.id string Recorded Future related target ID.
RecordedFuture.Malware.relatedEntities.RelatedTarget.name string Recorded Future related target name.
RecordedFuture.Malware.relatedEntities.RelatedTarget.type string Recorded Future related target type.
RecordedFuture.Malware.relatedEntities.RelatedThreatActor.count number Recorded Future related threat actor count.
RecordedFuture.Malware.relatedEntities.RelatedThreatActor.id string Recorded Future related threat actor ID.
RecordedFuture.Malware.relatedEntities.RelatedThreatActor.name string Recorded Future related threat actor name.
RecordedFuture.Malware.relatedEntities.RelatedThreatActor.type string Recorded Future related threat actor type.
RecordedFuture.Malware.relatedEntities.RelatedMalware.count number Recorded Future related malware count.
RecordedFuture.Malware.relatedEntities.RelatedMalware.id string Recorded Future related malware ID.
RecordedFuture.Malware.relatedEntities.RelatedMalware.name string Recorded Future related malware name.
RecordedFuture.Malware.relatedEntities.RelatedMalware.type string Recorded Future related malware type.
RecordedFuture.Malware.relatedEntities.RelatedCyberVulnerability.count number Recorded Future related vulnerability count.
RecordedFuture.Malware.relatedEntities.RelatedCyberVulnerability.id string Recorded Future related vulnerability ID.
RecordedFuture.Malware.relatedEntities.RelatedCyberVulnerability.name string Recorded Future related vulnerability name.
RecordedFuture.Malware.relatedEntities.RelatedCyberVulnerability.type string Recorded Future related vulnerability type.
RecordedFuture.Malware.relatedEntities.RelatedIpAddress.count number Recorded Future related IP address count.
RecordedFuture.Malware.relatedEntities.RelatedIpAddress.id string Recorded Future related IP address ID.
RecordedFuture.Malware.relatedEntities.RelatedIpAddress.name string Recorded Future related IP address name.
RecordedFuture.Malware.relatedEntities.RelatedIpAddress.type string Recorded Future related IP address type.
RecordedFuture.Malware.relatedEntities.RelatedInternetDomainName.count number Recorded Future related domain name count.
RecordedFuture.Malware.relatedEntities.RelatedInternetDomainName.id string Recorded Future related domain name ID.
RecordedFuture.Malware.relatedEntities.RelatedInternetDomainName.name string Recorded Future related domain name name.
RecordedFuture.Malware.relatedEntities.RelatedInternetDomainName.type string Recorded Future related domain name type.
RecordedFuture.Malware.relatedEntities.RelatedProduct.count number Recorded Future related product count.
RecordedFuture.Malware.relatedEntities.RelatedProduct.id string Recorded Future related product ID.
RecordedFuture.Malware.relatedEntities.RelatedProduct.name string Recorded Future related product name.
RecordedFuture.Malware.relatedEntities.RelatedProduct.type string Recorded Future related product type.
RecordedFuture.Malware.relatedEntities.RelatedCountries.count number Recorded Future related countries count.
RecordedFuture.Malware.relatedEntities.RelatedCountries.id string Recorded Future related countries ID.
RecordedFuture.Malware.relatedEntities.RelatedCountries.name string Recorded Future related countries name.
RecordedFuture.Malware.relatedEntities.RelatedCountries.type string Recorded Future related countries type.
RecordedFuture.Malware.relatedEntities.RelatedHash.count number Recorded Future related hash count.
RecordedFuture.Malware.relatedEntities.RelatedHash.id string Recorded Future related hash ID.
RecordedFuture.Malware.relatedEntities.RelatedHash.name string Recorded Future related hash name.
RecordedFuture.Malware.relatedEntities.RelatedHash.type string Recorded Future related hash type.
RecordedFuture.Malware.relatedEntities.RelatedTechnology.count number Recorded Future related technology count.
RecordedFuture.Malware.relatedEntities.RelatedTechnology.id string Recorded Future related technology ID.
RecordedFuture.Malware.relatedEntities.RelatedTechnology.name string Recorded Future related technology name.
RecordedFuture.Malware.relatedEntities.RelatedTechnology.type string Recorded Future related technology type.
RecordedFuture.Malware.relatedEntities.RelatedEmailAddress.count number Recorded Future related email address count.
RecordedFuture.Malware.relatedEntities.RelatedEmailAddress.id string Recorded Future related email address ID.
RecordedFuture.Malware.relatedEntities.RelatedEmailAddress.name string Recorded Future related email address name.
RecordedFuture.Malware.relatedEntities.RelatedEmailAddress.type string Recorded Future related email address type.
RecordedFuture.Malware.relatedEntities.RelatedAttackVector.count number Recorded Future related attack vector count.
RecordedFuture.Malware.relatedEntities.RelatedAttackVector.id string Recorded Future related attack vector ID.
RecordedFuture.Malware.relatedEntities.RelatedAttackVector.name string Recorded Future related attack vector name.
RecordedFuture.Malware.relatedEntities.RelatedAttackVector.type string Recorded Future related attack vector type.
RecordedFuture.Malware.relatedEntities.RelatedMalwareCategory.count number Recorded Future related malware category count.
RecordedFuture.Malware.relatedEntities.RelatedMalwareCategory.id string Recorded Future related malware category ID.
RecordedFuture.Malware.relatedEntities.RelatedMalwareCategory.name string Recorded Future related malware category name.
RecordedFuture.Malware.relatedEntities.RelatedMalwareCategory.type string Recorded Future related malware category type.
RecordedFuture.Malware.relatedEntities.RelatedOperations.count number Recorded Future related operations count.
RecordedFuture.Malware.relatedEntities.RelatedOperations.id string Recorded Future related operations ID.
RecordedFuture.Malware.relatedEntities.RelatedOperations.name string Recorded Future related operations name.
RecordedFuture.Malware.relatedEntities.RelatedOperations.type string Recorded Future related operations type.
RecordedFuture.Malware.relatedEntities.RelatedCompany.count number Recorded Future related company count.
RecordedFuture.Malware.relatedEntities.RelatedCompany.id string Recorded Future related company ID.
RecordedFuture.Malware.relatedEntities.RelatedCompany.name string Recorded Future related company name.
RecordedFuture.Malware.relatedEntities.RelatedCompany.type string Recorded Future related company type.
RecordedFuture.Malware.analystNotes.attributes.context_entities.id string Recorded Future analyst note context entity ID.
RecordedFuture.Malware.analystNotes.attributes.context_entities.name string Recorded Future analyst note context entity name.
RecordedFuture.Malware.analystNotes.attributes.context_entities.type string Recorded Future analyst note context entity type.
RecordedFuture.Malware.analystNotes.attributes.note_entities.id string Recorded Future analyst note entity ID.
RecordedFuture.Malware.analystNotes.attributes.note_entities.name string Recorded Future analyst note entity name.
RecordedFuture.Malware.analystNotes.attributes.note_entities.type string Recorded Future analyst note entity type.
RecordedFuture.Malware.analystNotes.attributes.published date Recorded Future analyst note publishing time.
RecordedFuture.Malware.analystNotes.attributes.validated_on date Recorded Future analyst note validation time.
RecordedFuture.Malware.analystNotes.attributes.text string Recorded Future analyst note content.
RecordedFuture.Malware.analystNotes.attributes.title string Recorded Future analyst note title.
RecordedFuture.Malware.analystNotes.attributes.topic.description string Recorded Future analyst note topic description.
RecordedFuture.Malware.analystNotes.attributes.topic.id string Recorded Future analyst note topic ID.
RecordedFuture.Malware.analystNotes.attributes.topic.name string Recorded Future analyst note topic name.
RecordedFuture.Malware.analystNotes.attributes.topic.type string Recorded Future analyst note topic type.
RecordedFuture.Malware.analystNotes.attributes.validation_urls.id string Recorded Future analyst note validation URL ID.
RecordedFuture.Malware.analystNotes.attributes.validation_urls.name string Recorded Future analyst note validation URL.
RecordedFuture.Malware.analystNotes.attributes.validation_urls.type string Recorded Future analyst note validation URL entity type.
RecordedFuture.Malware.analystNotes.id string Recorded Future analyst note ID.
RecordedFuture.Malware.analystNotes.source.id string Recorded Future analyst note source ID.
RecordedFuture.Malware.analystNotes.source.name string Recorded Future analyst note source name.
RecordedFuture.Malware.analystNotes.source.type string Recorded Future analyst note source type.

recordedfuture-links

Get Insikt Group Research Links for an IP, Domain, CVE, URL, File, or Malware.

Base Command

recordedfuture-links

Input

Argument Name Description Required
entity_type The type of entity for which to fetch context. Should be provided with its value in entityValue argument. Can be “domain”, “ip”, “file”, “url”, “cve”, or “malware”. Possible values are: domain, ip, file, url, cve, malware. Required
entity The value of the entity for which to fetch context. Should be provided with its type in entity_type argument. Supported hash types: MD5, SHA1, SHA256, SHA512, CRC32, and CTPH. Vulnerability supports CVEs. Required

Context Output

Path Type Description
RecordedFuture.Links.category String Recorded Future links category.
RecordedFuture.Links.type String Recorded Future links type.
RecordedFuture.Links.lists.entity_type String Recorded Future links entity list type.
RecordedFuture.Links.lists.entities.type String Recorded Future link entity type.
RecordedFuture.Links.lists.entities.name String Recorded Future link entity name.
RecordedFuture.Links.lists.entities.score Number Recorded Future link entity risk score.

recordedfuture-single-alert

Get detailed information from vulnerability, typosquat and credential alerts.

Base Command

recordedfuture-single-alert

Input

Argument Name Description Required
id Alert ID. Required

Context Output

Path Type Description
RecordedFuture.SingleAlert.id string Recorded Future alert ID.
RecordedFuture.SingleAlert.flat_entities.fragment string Recorded Future fragment of the entity.
RecordedFuture.SingleAlert.flat_entities.name string Recorded Future name of the entity.
RecordedFuture.SingleAlert.flat_entities.type string Recorded Future type of the entity.
RecordedFuture.SingleAlert.flat_entities.id string Recorded Future ID of the entity.

recordedfuture-alerts

Gets details on alerts configured and generated by Recorded Future by alert rule ID and/or time range.

Base Command

recordedfuture-alerts

Input

Argument Name Description Required
rule_id Alert rule ID. Optional
limit Maximum number of alerts to return. Default is 10. Default is 10. Optional
triggered_time Alert triggered time, e.g., “1 hour” or “2 days”. Optional
assignee Alert assignee’s email address. Optional
status Alert review status. Can be “unassigned”, “assigned”, “pending”, “actionable”, “no-action”, or “tuning”. Possible values are: unassigned, assigned, pending, actionable, no-action, tuning. Optional
freetext Free text search. Optional
offset Alerts from offset. Optional
orderby Alerts sort order. Possible values are: triggered. Optional
direction The direction by which to sort alerts. Can be “asc” or “desc”. Possible values are: asc, desc. Optional

Context Output

Path Type Description
RecordedFuture.Alert.id string Alert ID.
RecordedFuture.Alert.name string Alert name.
RecordedFuture.Alert.type string Alert type.
RecordedFuture.Alert.triggered date Alert triggered time.
RecordedFuture.Alert.status string Alert status.
RecordedFuture.Alert.assignee string Alert assignee.
RecordedFuture.Alert.rule string Alert rule name.

recordedfuture-alert-rules

Search for alert rule IDs.

Base Command

recordedfuture-alert-rules

Input

Argument Name Description Required
rule_name Rule name to search. Can be a partial name. Optional
limit Maximum number of rules to return. Default is 10. Default is 10. Optional

Context Output

Path Type Description
RecordedFuture.AlertRule.id string Alert rule ID.
RecordedFuture.AlertRule.name string Alert rule name.

recordedfuture-alert-set-status

Set alert into predefined status.

Base Command

recordedfuture-alert-set-status

Input

Argument Name Description Required
alert_id Alert id. Required
status The status we want to set for the alert in Recorded Future. Possible values are: unassigned, assigned, pending, dismiss, no-action, actionable, tuning. Required

Context Output

Path Type Description
RecordedFuture.Alerts.id String Recorded Future alert ID.
RecordedFuture.Alerts.status String Recorded Future alert status.
RecordedFuture.Alerts.note.text String Recorded Future alert note text.
RecordedFuture.Alerts.note.author String Recorded Future alert note author.
RecordedFuture.Alerts.note.date date Recorded Future alert note date.
RecordedFuture.Alerts.reviewDate date Recorded Future alert get date.

recordedfuture-alert-set-note

Set a note for the alert in Recorded Future.

Base Command

recordedfuture-alert-set-note

Input

Argument Name Description Required
alert_id Alert ID. Required
note The note of the ID we want to set. Required

Context Output

Path Type Description
RecordedFuture.Alerts.id String Recorded Future alert ID.
RecordedFuture.Alerts.status String Recorded Future alert status.
RecordedFuture.Alerts.note.text String Recorded Future alert note text.
RecordedFuture.Alerts.note.author String Recorded Future alert note author.
RecordedFuture.Alerts.note.date date Recorded Future alert note date.
RecordedFuture.Alerts.reviewDate date Recorded Future alert get date.

recordedfuture-malware-search

Search for a malware by specified filters.

Base Command

recordedfuture-malware-search

Input

Argument Name Description Required
freetext Part of malware name or ID to search for. Optional
limit How many records to retrieve (default = 10). Optional

Context Output

Path Type Description
RecordedFuture.Malware.id string Recorded Future malware ID.
RecordedFuture.Malware.name string Recorded Future entity name.
RecordedFuture.Malware.type string Recorded Future entity type (always = “Malware”).
RecordedFuture.Malware.intelCard date Recorded Future intelligence card URL.

Base Command

recordedfuture-threat-map

Input

Argument Name Description Required
actors_ids Actors IDs for which to get the threat map Optional
actor_name Actors name for which to get the threat map Optional
include_links Fetch links to threat actor or not Optional

Context Output

Path Type Description
RecordedFuture.ThreatMap.id string Recorded Future threat actor ID.
RecordedFuture.ThreatMap.name string Recorded Future entity name.
RecordedFuture.ThreatMap.alias array Recorded Future threat actor alias.
RecordedFuture.ThreatMap.intent number Recorded Future threat actor intent.
RecordedFuture.ThreatMap.id string Recorded Future threat actor ID.
RecordedFuture.ThreatMap.opportunity number Recorded Future threat actor opportunity.
RecordedFuture.ThreatMap.log_entries array Recorded Future threat actor log entries.
RecordedFuture.ThreatMap.links array Recorded Future threat actor links.

Base Command

recordedfuture-threat-links

Input

Argument Name Description Required
entity_type Type of the entity to fetch links for. E.g. “domain”, “ip”, “file”, “url”, “cve”, “malware”, “organization, “person”. Should be provided along with the entity in entity_name argument. Optional
entity_name Name of the entity to fetch links for Optional
entity_id ID of entity to fetch links for Optional
source_type Source of the links to be fetched. Can be “insikt” or “technical” Optional
timeframe Time range of the links to be fetched. Eg. “-1d” for last 1 day Optional
technical_type Type of technical source to fetch links from. Can be “type:MalwareAnalysis”, “type:InfrastructureAnalysis”, “type:NetworkTrafficAnalysis” or “type:TTPAnalysis” Optional

Context Output

Path Type Description
RecordedFuture.Links.entity.id string Recorded Future Entity id.
RecordedFuture.Links.entity.type string Recorded Future Entity type
RecordedFuture.Links.links.type string Recorded Future link type.
RecordedFuture.Links.links.id string Recorded Future link id.
RecordedFuture.Links.links.name string Recorded Future link name.
RecordedFuture.Links.links.source string Recorded Future link source.
RecordedFuture.Links.links.section string Recorded Future link section.
RecordedFuture.Links.links.attributes string Recorded Future link attributes.

Base Command

recordedfuture-detection-rules

Input

Argument Name Description Required
entity_type Type of the entity to fetch links for Optional
entity_name Name of the entity to fetch links for Optional
entity_id ID of entity to fetch links for Optional
rule_types Rule type. Can be “yara”, “sigma”, “snort” Optional
title Rule title Optional

Context Output

Path Type Description
RecordedFuture.DetectionRules.id string Recorded Future Detection rule id.
RecordedFuture.DetectionRules.type string Recorded Future Detection rule type.
RecordedFuture.DetectionRules.title string Recorded Future Detection rule title.
RecordedFuture.DetectionRules.description string Recorded Future Detection rule description.
RecordedFuture.DetectionRules.created string Recorded Future link name.
RecordedFuture.DetectionRules.updated string Recorded Future link source.
RecordedFuture.DetectionRules.rules array Recorded Future link section.
RecordedFuture.DetectionRules.rules.entities array Recorded Future link attributes.
RecordedFuture.DetectionRules.rules.entities.id string Recorded Future link attributes.
RecordedFuture.DetectionRules.rules.entities.type string Recorded Future link attributes.
RecordedFuture.DetectionRules.rules.entities.name string Recorded Future link attributes.
RecordedFuture.DetectionRules.rules.content string Recorded Future link attributes.
RecordedFuture.DetectionRules.rules.file_name string Recorded Future link attributes.

Base Command

recordedfuture-collective-insight

Input

Input

Argument Name Description Required
entity_type Value that can contain one of the enumerated list of values (ip, hash, domain, vulnerability, url). Required
entity_name Value of the IOC itself Required
entity_source_type Used to describe what log source the IOC came from Optional
incident_name Title of the incident related to the IOC Optional
incident_id ID of the incident related to the IOC Optional
incident_type Attack vector associated with the incident (C2, Phishing.. etc) Optional
mitre_codes List contains one or more MITRE codes associated with the IOC Optional
malware List contains all known malware associated with the IOCs Optional

Context Output

Path Type Description
RecordedFuture.CollectiveInsight.status string Request status

Breaking changes from the previous version of this integration - Recorded Future v2

Renamed the integration setting “Incident Sharing” to “Collective Insights”, resetting any previous configuration to this setting.

Configuration parameters

  • server_url — Server URL (e.g., https://api.recordedfuture.com/gw/xsoar/) (required)
  • token — API Token
  • token_credential —
  • file_threshold_suspicious — File Suspicious Threshold
  • file_threshold — File Malicious Threshold
  • cve_threshold_suspicious — CVE Suspicious Threshold
  • cve_threshold — CVE Malicious Threshold
  • ip_threshold_suspicious — IP Suspicious Threshold
  • ip_threshold — IP Malicious Threshold
  • domain_threshold_suspicious — Domain Suspicious Threshold
  • domain_threshold — Domain Malicious Threshold
  • url_threshold_suspicious — URL Suspicious Threshold
  • url_threshold — URL Malicious Threshold
  • vulnerability_threshold — Vulnerability Threshold
  • collective_insights — Collective Insights (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • rule_names — Rule names to fetch alerts by
  • fetch_statuses — Alert Statuses to include in the fetch
  • update_status — Update alert status on fetch.
  • first_fetch — First fetch time
  • incidentType — Incident type
  • max_fetch — Maximum number of incidents per fetch
  • integrationReliability — Source Reliability
  • feedExpirationPolicy —
  • feedExpirationInterval — Incidents Fetch Interval
  • incidentFetchInterval — Incidents Fetch Interval

Commands (18)

  • cve

    Gets a quick indicator of the risk associated with a CVE.

  • domain

    Gets a quick indicator of the risk associated with a domain.

  • file

    Gets a quick indicator of the risk associated with a file.

  • ip

    Gets a quick indicator of the risk associated with an IP address.

  • recordedfuture-alert-rules Deprecated

    Search for alert rule IDs. Deprecated: use rf-alerts from "Recorded Future Alerts" integration in "Recorded Future" pack instead.

  • recordedfuture-alert-set-note Deprecated

    Set a note for the alert in Recorded Future. Deprecated: use rf-alert-update from "Recorded Future Alerts" integration in "Recorded Future" pack instead.

  • recordedfuture-alert-set-status Deprecated

    Set alert into predefined status. Deprecated: use rf-alert-update from "Recorded Future Alerts" integration in "Recorded Future" pack instead.

  • recordedfuture-alerts Deprecated

    Gets details on alerts configured and generated by Recorded Future by alert rule ID and/or time range. Deprecated: use rf-alerts from "Recorded Future Alerts" integration in "Recorded Future" pack instead.

  • recordedfuture-collective-insight

    Post detection to collective insight.

  • recordedfuture-detection-rules

    Search detection rules.

  • recordedfuture-intelligence

    Get threat intelligence for an IP, Domain, CVE, URL, File or Malware.

  • recordedfuture-links

    Get Insikt Group Research Links for an IP, Domain, CVE, URL, File, or Malware.

  • recordedfuture-malware-search

    Search for a malware by specified filters.

  • recordedfuture-single-alert Deprecated

    Get detailed information from vulnerability, typosquat and credential alerts. Deprecated in favor of "Recorded Future Alerts" integration in "Recorded Future" pack.

  • recordedfuture-threat-assessment

    Get an indicator of the risk based on context.

  • recordedfuture-threat-links

    Search links.

  • recordedfuture-threat-map

    Get threat actors map.

  • url

    Gets a quick indicator of the risk associated with a URL.

Source

RecordedFuture.py RecordedFuture_test.py RecordedFuture.yml RecordedFuture_description.md command_examples.txt
Download History Raw 
!ip ip="8.8.8.8"
!domain domain="google.com"
!file file="027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745"
!url url="https://google.com"
!cve cve="CVE-2011-3874"
!recordedfuture-threat-assessment context="c2" ip="8.8.8.8"
!recordedfuture-malware-search freetext=File
!recordedfuture-intelligence entity_type="ip" entity="8.8.8.8"
!recordedfuture-links entity=CVE-2017-0143 entity_type=cve
!recordedfuture-alert-rules limit=1
!recordedfuture-alerts limit=1
!recordedfuture-alert-set-status alert_id=jfy31 status="pending"
!recordedfuture-alert-set-note alert_id=jfy31 note="this is the note for alert"