RecordedFutureAlerts

Fetch and triage alerts from Recorded Future.

Data Enrichment & Threat Intelligence · Recorded Future

Details

IDRecordedFutureAlerts
ProviderMastercard
CategoryData Enrichment & Threat Intelligence
From Version6.1.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Recorded Future Alerts

Fetch and triage Recorded Future Classic Alerts and Recorded Future Playbook Alerts directly from Cortex
XSOAR.

The integration allows you to:

  • Search and fetch alerts from the Recorded Future platform.
  • Look up full alert details for a single Classic Alert or Playbook Alert by ID.
  • Update alert status, assignee and comment/note from inside XSOAR.
  • Automatically fetch screenshots that accompany the alert.

Migration from Recorded Future Intelligence pack

Guide: migrating from Recorded Future Intelligence pack

Configure Recorded Future Alerts in Cortex

Parameter Description Required
Fetch incidents Turn on incident fetching. When enabled, the integration will poll Recorded Future at the defined interval and create / update incidents for new or updated alerts. False
Incident type Incident type will be set by this field if a Classifier does not exist. If a Classifier is selected, it will take precedence. Leave empty to let the built-in classifier decide based on the alert subtype. False
Your server URL Base URL for the Recorded Future XSOAR gateway API. The default value https://api.recordedfuture.com/gw/xsoar/. True
API Key Recorded Future user API token used to authenticate the requests. True
Source Reliability How trustworthy Recorded Future should be considered when the integration sets DBot scores. False
Incidents fetch interval How often to poll for new alerts. False
Maximum number of incidents per fetch Hard cap on the number of alerts to pull in a single fetch cycle (maximum 50, due to API limits). False
First fetch time How far back to look on the very first fetch run. Maximum look-back is 90 days. False
Enable Classic Alerts Toggle fetching of Classic Alerts. Disable if you only need Playbook Alerts. False
Classic Alerts: Rule names to fetch Semicolon-separated Classic Alert rule names to include (e.g., Malware;Typosquat). Leave blank to fetch alerts from all rules. False
Classic Alerts: Statuses to fetch Classic Alert statuses to be fetched. Choose one or more of New, InProgress, Resolved, Dismissed. True
Enable Playbook Alerts Toggle fetching of Playbook Alerts. Disable if you only need Classic Alerts. False
Playbook Alerts: Priority to fetch Minimum priority threshold. Alerts with lower priority than selected value will not be fetched. Possible values: Informational, Moderate, High. False
Playbook Alerts: Categories to fetch Comma-separated list of Playbook Alert categories to include (e.g., domain_abuse,cyber_vulnerability). Leave blank to fetch all categories available to your licence. False
Playbook Alerts: Statuses to fetch Playbook Alert statuses to be fetched (choose one or more of New, InProgress, Resolved, Dismissed). True
Trust any certificate (not secure) Skip TLS certificate validation. For example, enable this when using a proxy that re-signs SSL traffic or for testing with self-signed certs. False
Use system proxy settings Route all HTTP/S requests through the system-wide proxy settings configured in Cortex XSOAR. False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

rf-alerts

List Classic or Playbook alerts.

Base Command

rf-alerts

Input

Argument Name Description Required
include_classic_alerts Whether classic alerts should be included in the response. Possible values are: true, false. Default is true. Optional
include_playbook_alerts Whether playbook alerts should be included in the response. Possible values are: true, false. Default is true. Optional
classic_alert_rule_ids Comma-separated Classic Alert Rule IDs. Only applied to Classic Alert search. Optional
playbook_alert_categories Comma-separated Playbook Alert categories. Only applied to Playbook Alert search. Possible values are: domain_abuse, cyber_vulnerability, code_repo_leakage, third_party_risk, geopolitics_facility. Optional
playbook_alert_priorities Comma-separated Playbook Alert priorities. Only applied to Playbook Alert search. Possible values are: Informational, Moderate, High. Optional
statuses Comma-separated list of statuses to include. Possible values are: New, InProgress, Resolved, Dismissed. Optional
limit Maximum number of alerts to return. Maximum allowed value is 50. Default is 10. Optional
order_by Field to sort by. Possible values are: created_at, updated_at. Default value is updated_at. Optional
order_direction Direction to sort by. Possible values are: asc, desc. Default value is desc. Optional
created_from Return only alerts created on or after this datetime (ex. “2025-05-17T16:06:00Z”). Optional
created_to Return only alerts created on or before this datetime (ex. “2025-05-17T16:06:00Z”). Optional
updated_from Return only alerts updated on or after this datetime (ex. “2025-05-17T16:06:00Z”). Optional
updated_to Return only alerts updated on or before this datetime (ex. “2025-05-17T16:06:00Z”). Optional

Context Output

Path Type Description
RecordedFutureAlerts.Alert.id string Unique id of the alert in Recorded Future.
RecordedFutureAlerts.Alert.title string Title of the alert.
RecordedFutureAlerts.Alert.type string Alert type (classic-alert / playbook-alert).
RecordedFutureAlerts.Alert.subtype string Alert subtype (domain_abuse / cyber_vulnerability / code_repo_leakage / third_party_risk / geopolitics_facility / classic-alert).
RecordedFutureAlerts.Alert.status string Status of the alert.
RecordedFutureAlerts.Alert.created string When the alert was created as an ISO8601 string.
RecordedFutureAlerts.Alert.updated string When the alert was updated as an ISO8601 string.
RecordedFutureAlerts.Alert.classic_alert_rule_name string If alert is a classic alert, this is the name of the rule that triggered the alert.
RecordedFutureAlerts.Alert.classic_alert_rule_id string If alert is a classic alert, this is the name of the rule that triggered the alert.
RecordedFutureAlerts.Alert.playbook_alert_category string If alert is a playbook alert, this is the category of the alert.
RecordedFutureAlerts.Alert.playbook_alert_priority string If alert is a playbook alert, this is the priority of the alert.

Command Example

!rf-alerts include_classic_alerts=false playbook_alert_categories=domain_abuse playbook_alert_priorities=High statuses=New limit=5 order_by=updated_at order_direction=desc created_from="2025-05-17T12:06:00Z"

Context Example

{
  "RecordedFutureAlerts": {
    "Alert": [
      {
        "id": "task:fc34c790-293b-42bd-8f23-c1f571323f8f",
        "title": "Potential Typosquat of example.com",
        "type": "playbook-alert",
        "subtype": "domain_abuse",
        "status": "New",
        "created": "2025-05-17T16:06:00Z",
        "updated": "2025-05-17T17:14:12Z",
        "playbook_alert_category": "domain_abuse",
        "playbook_alert_priority": "High",
        "classic_alert_rule_name": null,
        "classic_alert_rule_id": null
      },
      {
        "id": "7SKZ26",
        "title": "ClassiAlert",
        "type": "classic-alert",
        "subtype": "classic-alert",
        "status": "New",
        "created": "2025-05-17T15:58:30Z",
        "updated": "2025-05-17T16:40:00Z",
        "classic_alert_rule_name": "Alert rule name 1",
        "classic_alert_rule_id": "fDasdfwea",
        "playbook_alert_category": null,
        "playbook_alert_priority": null
      }
    ]
  }
}

rf-alert-lookup

Look up a single Recorded Future alert by ID.

Base Command

rf-alert-lookup

Input

Argument Name Description Required
alert_id ID of the alert. Required

Context Output

Path Type Description
RecordedFutureAlerts.Alert.id string Unique ID of the alert in Recorded Future.
RecordedFutureAlerts.Alert.title string Title of the alert.
RecordedFutureAlerts.Alert.type string Alert type (classic-alert / playbook-alert).
RecordedFutureAlerts.Alert.subtype string Alert subtype / category.
RecordedFutureAlerts.Alert.status string Current status of the alert.
RecordedFutureAlerts.Alert.created string Timestamp when the alert was created in ISO 8601 format, for example, 2025-05-17T16:06:00Z.
RecordedFutureAlerts.Alert.updated string Timestamp when the alert was last updated in ISO 8601 format, for example, 2025-05-17T16:06:00Z.
RecordedFutureAlerts.Alert.markdown string Markdown-formatted summary of the alert details.
RecordedFutureAlerts.Alert.images Unknown Image IDs attached to the alert.
RecordedFutureAlerts.Alert.classic_alert_rule_name string If alert is a Classic Alert, name of the rule that triggered the alert.
RecordedFutureAlerts.Alert.classic_alert_rule_id string If alert is a Classic Alert, ID of the rule that triggered the alert.
RecordedFutureAlerts.Alert.portal_url string If alert is a Classic Alert, portal URL for the alert.
RecordedFutureAlerts.Alert.ai_insights string If alert is a Classic Alert, AI-generated insight summary.
RecordedFutureAlerts.Alert.review.status string If alert is a Classic Alert, review status.
RecordedFutureAlerts.Alert.review.assignee string If alert is a Classic Alert, assignee.
RecordedFutureAlerts.Alert.review.note string If alert is a Classic Alert, review note.
RecordedFutureAlerts.Alert.entities Unknown If alert is a Classic Alert, entities referenced in the alert.
RecordedFutureAlerts.Alert.fragments Unknown If alert is a Classic Alert, text fragments from the alert hits.
RecordedFutureAlerts.Alert.documents Unknown If alert is a Classic Alert, documents associated with alert hits.
RecordedFutureAlerts.Alert.analyst_notes Unknown If alert is a Classic Alert, analyst-note URLs linked in the alert.
RecordedFutureAlerts.Alert.triggered_by Unknown If alert is a Classic Alert, entities or paths that triggered the alert.
RecordedFutureAlerts.Alert.playbook_alert_category string If alert is a Playbook Alert, category of the alert.
RecordedFutureAlerts.Alert.playbook_alert_priority string If alert is a Playbook Alert, priority of the alert.
RecordedFutureAlerts.Alert.entity_name string If alert is a Playbook Alert, primary entity name.
RecordedFutureAlerts.Alert.targets Unknown If alert is a Playbook Alert, target names associated with the alert.
RecordedFutureAlerts.Alert.log_entries Unknown If alert is a Playbook Alert, alert activity log entries.
RecordedFutureAlerts.Alert.log_entries.created string If alert is a Playbook Alert, timestamp when the log entry was created in ISO 8601 format, for example, 2025-05-17T16:06:00Z.
RecordedFutureAlerts.Alert.log_entries.author_name string If alert is a Playbook Alert, name of the log entry author.
RecordedFutureAlerts.Alert.log_entries.author_id string If alert is a Playbook Alert, ID of the log entry author.
RecordedFutureAlerts.Alert.log_entries.changes Unknown If alert is a Playbook Alert, raw change records from the alert activity log.
RecordedFutureAlerts.Alert.details Unknown If alert is a Playbook Alert, category-specific detailed panel data.

Command Example

!rf-alert-lookup alert_id=task:75ac1730-3811-44be-8ea7-de7916166c10

Context Example

{
  "RecordedFutureAlerts": {
    "Alert": {
      "id": "task:75ac1730-3811-44be-8ea7-de7916166c10",
      "title": "RF Playbook Alert - Vulnerability CVE-2021-44228",
      "type": "playbook-alert",
      "subtype": "cyber_vulnerability",
      "status": "New",
      "created": "2025-05-14T02:31:00Z",
      "updated": "2025-05-14T03:40:10Z",
      "markdown": "## Vulnerability\n\n### Summary\n\n**ID:** task:75ac1730-3811-44be-8ea7-de7916166c10",
      "playbook_alert_category": "cyber_vulnerability",
      "playbook_alert_priority": "Moderate",
      "entity_name": "CVE-2021-44228",
      "log_entries": [
        {
          "created": "2025-05-14T02:36:04Z",
          "author_name": "RF PI test Phantom modules",
          "author_id": "uhash:60ptFTXURB",
          "changes": [
            {
              "type": "status_change",
              "old": "New",
              "new": "Resolved"
            },
            {
              "type": "comment_change",
              "comment": "This has been handled."
            }
          ]
        }
      ],
      "details": {
        "type": "cyber_vulnerability",
        "lifecycle_stage": "Exploitation"
      }
    }
  }
}

rf-alert-update

Update an alert in the Recorded Future platform.

Base Command

rf-alert-update

Input

Argument Name Description Required
alert_id ID of alert to update. Required
status New status to set for the alert. Possible values are: New, InProgress, Dismissed, Resolved. Optional
comment Add comment / Replace note. Optional
reopen Only for Playbook Alerts. Set the reopen strategy for the alert. Reopen on significant updates or keep the alert Resolved. Can only be used with status=Resolved. Possible values are: never, significant_updates. Default: reopen on significant updates. Optional

Context Output

Path Type Description
RecordedFutureAlerts.Alert.id string Unique id of the alert in Recorded Future.
RecordedFutureAlerts.Alert.type string Alert type (classic-alert / playbook-alert).
RecordedFutureAlerts.Alert.status string Status of alert in Recorded Future.
RecordedFutureAlerts.Alert.comment string Note (Classic) or comment (Playbook) that was just applied.

Command Example

!rf-alert-update alert_id=task:fc34c790-293b-42bd-8f23-c1f571323f8f status=Resolved comment="Alert resolved - false-positive." reopen=never

Context Example

{
  "RecordedFutureAlerts": {
    "Alert": {
      "id": "task:fc34c790-293b-42bd-8f23-c1f571323f8f",
      "type": "playbook-alert",
      "status": "Resolved",
      "comment": "Alert resolved - false-positive."
    }
  }
}

rf-alert-rules

Search for alert rule IDs.

Base Command

rf-alert-rules

Input

Argument Name Description Required
rule_name Rule name to search. Can be a partial name. Optional
limit Maximum number of rules to return. Default is 10. Optional

Context Output

Path Type Description
RecordedFutureAlerts.AlertRule.id string Alert rule ID.
RecordedFutureAlerts.AlertRule.name string Alert rule name.

Command Example

!rf-alert-rules rule_name="malware" limit=3

Context Example

{
  "RecordedFutureAlerts": {
    "AlertRule": [
      {
        "id": "mZbDYT",
        "name": "Malware Communication - External IP"
      },
      {
        "id": "mZbDZT",
        "name": "Malware Communication - Suspicious Domain"
      },
      {
        "id": "mxbDZT",
        "name": "Malware Communication - Command & Control"
      }
    ]
  }
}

rf-alert-images

Fetch alert images and attach to incident in context Files.

Base Command

rf-alert-images

Command Example

!rf-alert-images

Input

There are no input arguments for this command.

Context Output

Path Type Description
Files Unknown New images are attached into incident Files.

Configuration parameters

  • isFetch — Fetch incidents
  • incidentType — Incident type
  • url — Your server URL (required)
  • credentials — (required)
  • integrationReliability — Source Reliability
  • incidentFetchInterval — Incidents fetch interval
  • max_fetch — Maximum number of incidents per fetch
  • first_fetch — First fetch time
  • classic_alerts_enabled — Enable Classic Alerts
  • classic_alert_rule_names — Classic Alerts: Rule names to fetch
  • classic_alert_statuses — Classic Alerts: Statuses to fetch (required)
  • playbook_alerts_enabled — Enable Playbook Alerts
  • playbook_alert_priority — Playbook Alerts: Priority to fetch
  • playbook_alert_categories — Playbook Alerts: Categories to fetch
  • playbook_alert_statuses — Playbook Alerts: Statuses to fetch (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (5)

  • rf-alert-images

    Fetch alert images.

  • rf-alert-lookup

    Look up a single Recorded Future alert by ID. Supports both Classic Alerts and Playbook Alerts. Returns full alert data including rule details, entities, AI insights, and Playbook Alert panel data.

  • rf-alert-rules

    Search for alert rule IDs.

  • rf-alert-update

    Update an alert in the Recorded Future platform.

  • rf-alerts

    List Classic or Playbook alerts.

Source

RecordedFutureAlerts.py RecordedFutureAlerts_test.py RecordedFutureAlerts.yml RecordedFutureAlerts_description.md command_examples.txt
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: Mastercard
commonfields:
  id: RecordedFutureAlerts
  version: -1
image: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAAyCAYAAACXpx/YAAAAAXNSR0IArs4c6QAAC6NJREFUeAHtmH9wVNUVx+97+3Y3i0lIgOFnQiCEgEZQxB8EZyQwSrFVK85UOk5bq7VUpyJii7VOtRlFbRSdsSgF/QNELfUHrTqOtaAmtGIFxaFgtEACwfyAqCGJZLPJ7r73+jkvu0s2pomMg7Qz983c3HvPOff8+J5zf2yU0p9GQCOgEdAIaAQ0AhoBjYBGQCOgEdAIaAQ0AhoBjYBGQCOgEdAIaAQ0AhoBjYBGQCOgEdAIaAQEgZvfn6qWvJunwfj/QMA8ITdv3j7RDAQ2+6zQOrXsndAJrdXCpwSBwRN8YUWWKinP9Lwz3FGGofJdQ01RbXGPNvSmf+SqJfuDp8R7bXRQBIwBJQp/NdTIynlJ+cxu90jtVWrRkjMMZe9QpqpzbfecQNweHQ8GXlRuvNLJnrFUlRtOf/oKCwuHDhkyJEN4XV1dTjAYbK+uro72J/tN0AoKCmZgJ+PQoUP/PAF7PtZd5PP5Gg8cOLCv97opU6ZkEVPIcZwUnhJnTU1NG3Kx3rLf9Nga0GDQPxL+bGUbMeUfOUoZpq1cu2dJlPQGY6cbVrDEicZt1fJXP4zufvRl2ra9KRKJTAQA4ZudnZ3tEyZMWFNXV7eeudvPmpNKsixrMT6NwciVJ2AoZJrmPbRXWVORXFdSUpJJMtfGYrFZ0Lz4Xdc1+KLEuJwY/5aUTfZFRUWT4F8AJn9paGiIJOknox84waYl4MeV4cY944GAIsWG48RJ5qekJstVjpfwHn7/HvoJRgLaGI/H/wxAAcQW0j82adKkQ7W1tW/1v+ykUmWnpXbb17FEHBJfIbG9StE8Q3J9og+aTSGl7fSknWg0Wgrvt5wGldBOYYKTHkkfsvwq3FKrglnPGK7/oLt6a6daduVXAgkQvGA5st5PqHxv4sSJ8wlyLvNTkWAp3BM6OfLy8qSS+11DUh0SWsNu3JGIb8AOWdETpSC8HT+g8NdkfmkHFxUtCR4bErSad68Mp+n2B0y1atYXJRvm3+iPbI7uVMpRzhVfeqSN59FVOCp+rKp87kC7WsCyAcbb/hxZQYK9yO/3j6a63+NY+3fSNsfc6IyMjNnMg/B2Ju8/1mRTIHPQkQH97wcPHmyWNXL8UVBd0IV/LtfC23v37j0IvYT5Wey0XdDS3gqcJPmBQGA2azpFFzbaE/Yt3g+z8GtMd3f3HvievwnegB0FXMAOtSjqWhEkjgz0TMXOR+FwWOxn4ufl48ePb/rkk0+2FxcXj+WYb03GIUc/V9kk5tX4novvufjQDhZlYHVg3759740bN244b5s56LGIq4rTkGM1/UtP8FkrxtUagScQyVVF9/5QOdy9ya/ViKu3FkzZ44TWuc53G1VlzXVqk3U84OE7Yr6lH1xx2B+qOBy23ywpr76turwkmlwOOPmTJ08+XaqXQK6CPp7+NQLPwbm1OFlM30R/F0HfR9BP5efnn4fcBgKzWN8B7zSCXUSAR2nP0sZAj0K30fMTCmM7tLugnUkOTfTFGH8G2OdCX0U7iv1WaMPpd4tv8C5B9iF8+RT5LHjLsPvT+vr6OngPIHIt9puQ/4I2gXY8ZlHQ88mlW8QjrJT14k81CbkVeyPKy8uvpTnonwr9eXQtFBlaLglfjO1G7DRj+xFUvU5bKSopgnORfxydF6P7W9zzd7CmhfU59GvwMUIBPYnebnoXPXdAW4zfyVNS1PAe7v256hzD8n+bh1OpCvnPVDb3b/JryIizZ2e4oUApj66rVKB7lFKB4zuBIFxTXeKEMqc6VEB19FhuYqkYdwhgMY79kX4HDl3N+AaqU460GwmkCPo8ds53EL0f/t3Tp0/PA6Tb4TXwGJkNfza8HzGvZ+3dNIvdNof1pQD5MfSVpaWl8ts8A14BtOXov5AdswfaCkDaSLWfDyA/gy9HpDFt2rRchveydhM7bT40uTI6WXMLoMuO/gHtF9iWxD1COw1+2ifgQpAEL2T8KLpWICeFZ0EL8GvBu8bg+aAFE73c0w3E9z18vJqdWktsolveJ97HXDZfgN7Avg+9k4npZRJ/PmseY+398D+mqMvYuXORe5+C+QNXybAeDT1/03dwZ/Nm5YxZbpq+HMf4/A1OEZLovRmUKowEVGbra1ZH4N64pQ6rxpo6ZYXP4nLu0VRWafmjsVUqcszkJHvHDrz+WcKQgXMGPyMepfqew5Gnobfg2EvCB4QSWjvBn4dzPoLJBODstra2CYCRj8hzR44cSep6lx0cRH4GAW5ER4PoYMdvoFtNlY+EJ4Bv4QR4U3gAko/tISIP2B2QPuRI3oofI1paWkbBG8nYxvYCbCtsdzMvoC+mgOoB9VV56Y4dO3Yzsh/jZwIQ0c49Y9uSQB6ezmqOzMfw28VOmNNKEiq+pL6+c/A4vkF6iqS3vFc4shj8fNjZj3/rmpubw/KzkziLoB0QvxnLGyCO/tNJchZLjiaNpie4ZpVYXJmyWlJ+fIefxm6ftf2LuHp8da6yIq3qFVstNbzq9JRNi/i6V82VV+PPk8p79QLA51RaPUCtALyXcPJidixFpCTufIK4HBkfjkrlV5Cs/ZmZmXI0Hz9FEKbafQAthZGisy7O3CWJHviskUR6n+wYBvLbO3W0QrJZ4/GRNVk7C9pYsU+Te+w56AW0OH6lQJe5t+jLfwSHyLZt244lWVLU6HK5S90XXnhB/PUMoiOFWe8x64Segj4hbyRkmBqd3L/elYle2TQOPDaYtwOlmCxot4RCocNJH6RPT3BvTt+xa8XUmSvyDTNc1Wa5+9UHZZdRWimH+or3neOAB35TU1Mlya3C4TuRqaTJz4S9/NNhSe818ihhjY3To3vTeYxE2Z1hqrkgSadgJiIbZ0d0CBKMUyCSuGOSuI6OjnHI8zbkPw+x2AjpqfZuxCXZT2F/k9CSH/YXwRuBrhxobYzlqMoR9UmZPn3KptDxrwO9JevXr5djt4t1crr4uW46KEQR8eGHlzB2ZTenSgR5ObG8D9/ymEv1dwlBYmLu2eBkiZJs2bWvc7pU9Kzo/+9XTzAFqVxnpGG5hUTI7+DskOIw7l9tGlWckmQljzab4B8A+Ld4QFzBMfM0403cefII2kzwk5EvJrFLif9lxsvgtTL/DP4Ckvs4/RrmvycJchTJf4tuJ/gndu/e/SlAyX/MUj8/sLsP2a3QVsIbw9opjC+DvoWk1qP7NYCq4JiXZB7B/nzkd4DhFvwKw3sCOxvpF7BuOryN9KkvAbpcG2lYYudFZBciuBa779AvRbaSR9Ah9GXBG0JhPojdrYxfZv06ZB6SWJGTR9cvoT3f2Nh4FJoUSUbClmKTdELbwLrb0CVvnI/wdQ4y7cOGDavYuXOnVzjM+zyyhNL765YHhBGkBVSMBNvKcW3H7Xl8BV1lwLfEtknC+/+4IyIA9ycC/jApQZK24fzvqFKL8dvwrsHZ8cx/jcyltB08emLIPCIN3kKCuIm+DeAPkphnkbkV3jwCWwQYD3Ef3yf6sbWZVilj+aDL7lkGbQv99TS5BnhnmPIfpjhH/h3M12L7+7Tl0IZiaxeJaGLN9ciFsXEDMrsY3wX/X7TUl52dLfG9Qgy7UkQG2N1O92NaDvquS8jIKRWHJ7ISz1B0Xwovl3ifxsZt0C6kyK5h/CQnUjlysN090J9nnPqnCA+th5n/BrmLE7gVI/c2yU1dRfAH+W9O3rKQOXzUfZzytmPk3qm6ms/mlY3jZp3rtM5U864MmP6slcqNbXMePnuNKPw6H/eVvDpTP6166fLNnDnT7F2ZCZ6cDvJOSAuq17q0YVlZmVVVVfXf7lETG75+bIgOOX2+ko00g4nJIHb7LjmhmGTxALgNkuC+ps+45wIzI+NdV7n1rhE5R+0s/7yviJ7/byGQdm8M6pqvc5/r+N8wXGOvazW1DyqvBTQCGgGNgEZAI6AR0AhoBDQCGgGNgEZAI6AR0AhoBDQCGgGNgEZAI6AR0AhoBDQCGgGNgEZAI6AROCkI/Adox/h1F7lx8wAAAABJRU5ErkJggg==
sectionorder:
- Connect
- Collect
configuration:
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- defaultvalue: https://api.recordedfuture.com/gw/xsoar/
  display: Your server URL
  name: url
  required: true
  type: 0
  section: Connect
- name: credentials
  type: 9
  displaypassword: API KEY
  hiddenusername: true
  required: true
  section: Connect
- name: integrationReliability
  display: 'Source Reliability'
  defaultvalue: B - Usually reliable
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
  additionalinfo: Reliability of the source providing the intelligence data.
  section: Collect
- display: Incidents fetch interval
  defaultvalue: '1'
  name: incidentFetchInterval
  type: 19
  required: false
  section: Collect
- display: Maximum number of incidents per fetch
  additionalinfo: 'The max number of incidents to fetch per run. Cannot be bigger than 50.'
  name: max_fetch
  defaultvalue: "25"
  type: 0
  required: false
  section: Collect
- display: 'First fetch time'
  additionalinfo: 'How far back we should fetch alerts on the first incident fetch. This value is not used for subsequent fetches. Cannot be bigger than 90 days.'
  defaultvalue: '1440' # 1 day
  name: first_fetch
  type: 19
  required: false
  section: Collect
- display: 'Enable Classic Alerts'
  name: classic_alerts_enabled
  type: 8
  defaultvalue: 'true'
  required: false
  section: Collect
- display: 'Classic Alerts: Rule names to fetch'
  name: classic_alert_rule_names
  type: 12
  additionalinfo: 'Rule names to fetch alerts by, separated by semicolon. If empty, all alerts will be fetched.'
  required: false
  section: Collect
- display: 'Classic Alerts: Statuses to fetch'
  name: classic_alert_statuses
  type: 16
  defaultvalue: New
  options:
  - New
  - InProgress
  - Resolved
  - Dismissed
  required: true
  advanced: true
  section: Collect
- display: 'Enable Playbook Alerts'
  name: playbook_alerts_enabled
  type: 8
  defaultvalue: 'true'
  required: false
  section: Collect
- display: 'Playbook Alerts: Priority to fetch'
  name: playbook_alert_priority
  type: 15
  defaultvalue: Moderate
  additionalinfo: 'Fetch playbook alerts with this priority and higher'
  options:
  - Informational
  - Moderate
  - High
  required: false
  section: Collect
- display: 'Playbook Alerts: Categories to fetch'
  name: playbook_alert_categories
  additionalinfo: 'Playbook Alert categories to filter by. If empty, all alerts will be fetched. Note that your Recorded Future licensing also affects which Playbook Alerts are available.'
  type: 16
  defaultvalue: ''
  options:
  - domain_abuse
  - cyber_vulnerability
  - code_repo_leakage
  - third_party_risk
  - geopolitics_facility
  required: false
  section: Collect
- display: 'Playbook Alerts: Statuses to fetch'
  name: playbook_alert_statuses
  type: 16
  defaultvalue: New
  options:
  - New
  - InProgress
  - Resolved
  - Dismissed
  required: true
  advanced: true
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
  advanced: true
description: 'Fetch and triage alerts from Recorded Future.'
display: Recorded Future Alerts
name: RecordedFutureAlerts
script:
  commands:
    - name: rf-alert-images
      description: Fetch alert images.
      arguments: []
      outputs:
        - contextPath: Files
          description: Image files.
          type: unknown
    - name: rf-alert-rules
      description: Search for alert rule IDs.
      arguments:
        - name: rule_name
          description: Rule name to search. Can be a partial name.
        - name: limit
          description: 'Maximum number of rules to return. Default is 10.'
          defaultValue: "10"
      outputs:
        - contextPath: RecordedFutureAlerts.AlertRule.id
          description: Alert rule ID.
          type: string
        - contextPath: RecordedFutureAlerts.AlertRule.name
          description: Alert rule name.
          type: string
    - name: rf-alert-update
      description: Update an alert in the Recorded Future platform.
      arguments:
        - name: alert_id
          required: true
          description: ID of alert to update.
        - name: status
          description: New status to set for the alert.
          required: false
          auto: PREDEFINED
          predefined:
            - New
            - InProgress
            - Dismissed
            - Resolved
        - name: comment
          description: Add comment / Replace note.
          required: false
        - name: reopen
          description: 'Only for Playbook Alerts. Set the reopen strategy for the alert. Reopen on significant updates or keep the alert Resolved. Default: reopen on significant updates. Can only be used with status=Resolved.'
          required: false
          auto: PREDEFINED
          predefined:
            - never
            - significant_updates
      outputs:
        - contextPath: RecordedFutureAlerts.Alert.id
          description: Unique id of the alert in Recorded Future.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.type
          description: Alert type (classic-alert / playbook-alert).
          type: string
        - contextPath: RecordedFutureAlerts.Alert.status
          description: Status of alert in Recorded Future.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.comment
          description: Note (Classic) or comment (Playbook) that was just applied.
          type: string
    - name: rf-alert-lookup
      description: Look up a single Recorded Future alert by ID. Supports both Classic Alerts and Playbook Alerts. Returns full alert data including rule details, entities, AI insights, and Playbook Alert panel data.
      arguments:
        - name: alert_id
          required: true
          description: ID of the alert to look up.
      outputs:
        - contextPath: RecordedFutureAlerts.Alert.id
          description: Unique ID of the alert in Recorded Future.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.title
          description: Title of the alert.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.type
          description: Alert type (classic-alert / playbook-alert).
          type: string
        - contextPath: RecordedFutureAlerts.Alert.subtype
          description: Alert subtype / category.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.status
          description: Current status of the alert.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.created
          description: Timestamp when the alert was created (ex. "2025-05-17T16:06:00Z").
          type: date
        - contextPath: RecordedFutureAlerts.Alert.updated
          description: Timestamp when the alert was last updated (ex. "2025-05-17T16:06:00Z"). For Classic Alerts this equals the created timestamp.
          type: date
        - contextPath: RecordedFutureAlerts.Alert.markdown
          description: Markdown-formatted summary of the alert details.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.images
          description: List of image IDs attached to the alert.
          type: unknown
        - contextPath: RecordedFutureAlerts.Alert.classic_alert_rule_name
          description: (Classic Alert) Name of the alert rule that triggered this alert.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.classic_alert_rule_id
          description: (Classic Alert) ID of the alert rule that triggered this alert.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.portal_url
          description: (Classic Alert) URL to the alert in the Recorded Future portal.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.ai_insights
          description: (Classic Alert) AI-generated insights summary for the alert.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.review.status
          description: (Classic Alert) Review status of the alert.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.review.assignee
          description: (Classic Alert) User the alert is assigned to.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.review.note
          description: (Classic Alert) Review note on the alert.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.entities
          description: (Classic Alert) List of entities referenced in the alert.
          type: unknown
        - contextPath: RecordedFutureAlerts.Alert.fragments
          description: (Classic Alert) Text fragments from the alert hits.
          type: unknown
        - contextPath: RecordedFutureAlerts.Alert.documents
          description: (Classic Alert) Documents associated with alert hits.
          type: unknown
        - contextPath: RecordedFutureAlerts.Alert.analyst_notes
          description: (Classic Alert) URLs to analyst notes linked in the alert.
          type: unknown
        - contextPath: RecordedFutureAlerts.Alert.triggered_by
          description: (Classic Alert) List of entities / paths that triggered the alert.
          type: unknown
        - contextPath: RecordedFutureAlerts.Alert.playbook_alert_category
          description: (Playbook Alert) Category of the playbook alert.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.playbook_alert_priority
          description: (Playbook Alert) Priority of the playbook alert.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.entity_name
          description: (Playbook Alert) Name of the primary entity (e.g. domain, CVE).
          type: string
        - contextPath: RecordedFutureAlerts.Alert.targets
          description: (Playbook Alert) List of target names associated with the alert.
          type: unknown
        - contextPath: RecordedFutureAlerts.Alert.log_entries
          description: (Playbook Alert) Log entries associated with the alert.
          type: unknown
        - contextPath: RecordedFutureAlerts.Alert.log_entries.created
          description: (Playbook Alert) Timestamp when the log entry was created (ex. "2025-05-17T16:06:00Z").
          type: date
        - contextPath: RecordedFutureAlerts.Alert.log_entries.author_name
          description: (Playbook Alert) Name of the log entry author.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.log_entries.author_id
          description: (Playbook Alert) ID of the log entry author.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.log_entries.changes
          description: (Playbook Alert) Raw log entry changes from the alert activity history.
          type: unknown
        - contextPath: RecordedFutureAlerts.Alert.details
          description: (Playbook Alert) Detailed panel data for the alert. Structure depends on the alert category.
          type: unknown
    - name: rf-alerts
      description: List Classic or Playbook alerts.
      arguments:
        - name: include_classic_alerts
          description: Whether we should include classic alerts in the response. Defaults to true.
          defaultValue: true
          auto: PREDEFINED
          predefined:
            - 'true'
            - 'false'
        - name: include_playbook_alerts
          description: Whether we should include playbook alerts in the response. Defaults to true.
          defaultValue: true
          auto: PREDEFINED
          predefined:
            - 'true'
            - 'false'
        - name: classic_alert_rule_ids
          description: Comma-separated Classic Alert Rule IDs. Only applied to Classic Alert search.
          isArray: true
        - name: playbook_alert_categories
          description: Comma-separated Playbook Alert categories (ex. 'domain_abuse,cyber_vulnerability,code_repo_leakage,third_party_risk,geopolitics_facility'). Only applied to Playbook Alert search.
          isArray: true
          auto: PREDEFINED
          predefined:
            - domain_abuse
            - cyber_vulnerability
            - code_repo_leakage
            - third_party_risk
            - geopolitics_facility
        - name: playbook_alert_priorities
          description: Comma-separated Playbook Alert priorities (ex. 'Informational,Moderate,High'). Only applied to Playbook Alert search.
          isArray: true
          auto: PREDEFINED
          predefined:
            - Informational
            - Moderate
            - High
        - name: statuses
          description: Comma-separated list of statuses to include (ex. 'New,InProgress,Resolved,Dismissed').
          isArray: true
          auto: PREDEFINED
          predefined:
            - New
            - InProgress
            - Resolved
            - Dismissed
        - name: limit
          description: Maximum number of alerts to return. Default 10, maximum 50.
          defaultValue: "10"
        - name: order_by
          description: 'Field to sort by. Possible values are: created_at, updated_at. Default value is updated_at.'
          auto: PREDEFINED
          predefined:
            - created_at
            - updated_at
        - name: order_direction
          description: 'Direction to sort by. Possible values are: asc, desc. Default value is desc.'
          auto: PREDEFINED
          predefined:
            - asc
            - desc
        - name: created_from
          description: Return only alerts created on or after this datetime (ex. "2025-05-17T16:06:00Z").
          required: false
          type: string
        - name: created_to
          description: Return only alerts created on or before this datetime (ex. "2025-05-17T16:06:00Z").
          required: false
          type: string
        - name: updated_from
          description: Return only alerts updated on or after this datetime (ex. "2025-05-17T16:06:00Z").
          required: false
          type: string
        - name: updated_to
          description: Return only alerts updated on or before this datetime (ex. "2025-05-17T16:06:00Z").
          required: false
          type: string
      outputs:
        - contextPath: RecordedFutureAlerts.Alert.id
          description: Unique id of the alert in Recorded Future.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.title
          description: Title of the alert.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.type
          description: Alert type (classic-alert / playbook-alert).
          type: string
        - contextPath: RecordedFutureAlerts.Alert.subtype
          description: Alert subtype (domain_abuse / cyber_vulnerability / code_repo_leakage / third_party_risk / geopolitics_facility).
          type: string
        - contextPath: RecordedFutureAlerts.Alert.status
          description: Status of the alert.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.created
          description: When the date was created as an ISO8601 string.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.updated
          description: When the date was updated as an ISO8601 string.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.classic_alert_rule_name
          description: If alert is a classic alert, this is the name of the rule that triggered the alert.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.classic_alert_rule_id
          description: If alert is a classic alert, this is the name of the rule that triggered the alert.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.playbook_alert_category
          description: If alert is a playbook alert, this is the category of the alert.
          type: string
        - contextPath: RecordedFutureAlerts.Alert.playbook_alert_priority
          description: If alert is a playbook alert, this is the priority of the alert.
          type: string
  isfetch: true
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.1.0
marketplaces:
- xsoar
- marketplacev2
- platform
tests:
- No tests (auto formatted)
defaultclassifier: RF - Classifier
defaultmapperin: RF - Incoming Mapper