RecordedFutureLists

Details

ID	`RecordedFutureLists`
Provider	Mastercard
Category	Data Enrichment & Threat Intelligence
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Search and manage watchlists in Recorded Future
This integration was integrated and tested with version 1.1.1 of RecordedFutureLists

Configure Recorded Future - Lists in Cortex

Parameter	Description	Required
API URL	Default URL: https://api.recordedfuture.com/gw/xsoar/	True
API Token		True
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

recordedfuture-lists-search

Search for lists in Recorded Future

Base Command

recordedfuture-lists-search

Input

Argument Name	Description	Required
list_names	Freetext name to search for.	Optional
contains	Filter lists based on entity types, will only include lists with the entity types specified. Default value “” includes all types. Possible values are: entity, source, text, custom, ip, domain, tech_stack, industry, brand, partner, industry_peer, location, supplier, vulnerability, company, hash, operation, attacker, target, method.	Optional
limit	Limits the amount of returned results.	Optional
include	Include all search results. Default is to exclude all lists owned by the system user. Possible values are: all.	Optional

Context Output

Path	Type	Description
RecordedFuture.List.id	String	Unique id of the list in Recorded Future
RecordedFuture.List.name	String	Name of the list in Recorded Future
RecordedFuture.List.type	String	Recorded future entity type
RecordedFuture.List.created	String	Timestamp of creation
RecordedFuture.List.updated	String	Timestamp of last update to the list
RecordedFuture.List.owner_id	String	Unique id of the owner in Recorded Future
RecordedFuture.List.owner_name	String	Readable name of list in Recorded Future

recordedfuture-lists-add-entities

Add entities to a list, separate entities by commas. “NOTE:” if entity type is specified, only one entity type can be added with each action.
When adding IDs use the following for Recorded Future light entities:

IPaddress: “ip:x.x.x.x”
Domain: “idn:example.xyz”
Hash: “hash:examplehashvalue”
Email: “email:example@example.xyz”
Url: “url:https://example.xyz”

Base Command

recordedfuture-lists-add-entities

Input

Argument Name	Description	Required
list_id	Id of the list that should be added, can be found by running !recordedfuture-lists-search with the corresponding filters or in the Recorded Future portal.	Required
entity_ids	Specific ids from Recorded Future separated by comma, For urls containing commas: replace comma with %2C.	Optional
freetext_names	Freetext names will be matched to Recorded Future ids separated by comma, this alernative will add the best match in the Recorded Future data. For urls containing commas: escape with %2C.	Optional
entity_type	Type of the entities that should be added. Use together with freetext_names to improve entity resolution. Possible values are: ip, domain, malware, url, hash, cve, company, person, product, industry, country, attack-vector, operation, mitre-identifier, malware-category.	Optional

Context Output

Path	Type	Description
RecordedFuture.List.Entities.name	String	Name of the entity in the list
RecordedFuture.List.Entities.type	String	The Recorded Future entity type resolved during the action
RecordedFuture.List.Entities.id	String	Unique id of the entity in Recorded Future
RecordedFuture.List.Entities.input_value	String	The value inputted to the command
RecordedFuture.List.Entities.action_result	String	Entity specific result for the action

recordedfuture-lists-remove-entities

Remove entities from a list. Separate entities with commas. “NOTE:” If entity type is specified, only one entity type can be added with each action.
When adding IDs use the following for Recorded Future light entities:

IPaddress: “ip:x.x.x.x”
Domain: “idn:example.xyz”
Hash: “hash:examplehashvalue”
Email: “email:example@example.xyz”
Url: “url:https://example.xyz”

Base Command

recordedfuture-lists-remove-entities

Input

Argument Name	Description	Required
list_id	ID of the list that should be removed. Can be found by running !recordedfuture-lists-search with the corresponding filters or in the Recorded Future portal.	Required
entity_ids	A comma-separated list of specific IDs from Recorded Future. For URLs containing commas, replace comma with %2C.	Optional
freetext_names	A comma-separated list of freetext names to be matched to Recorded Future IDs. This will remove the best match in the Recorded Future data. For URLs containing commas, escape with %2C.	Optional
entity_type	Type of the entities that should be removed. Use together with freetext_names to improve entity resolution. Possible values are: ip, domain, malware, url, hash, cve, company, person, product, industry, country, attack-vector, operation, mitre-identifier, malware-category.	Optional

Context Output

Path	Type	Description
RecordedFuture.List.Entities.name	String	Name of the entity in the list
RecordedFuture.List.Entities.type	String	The Recorded Future entity type resolved during the action.
RecordedFuture.List.Entities.id	String	Unique ID of the entity in Recorded Future.
RecordedFuture.List.Entities.input_value	String	The value inputted to the command.
RecordedFuture.List.Entities.action_result	String	Entity specific result for the action.

recordedfuture-lists-entities

Get the entities that are currently in the given lists.

Base Command

recordedfuture-lists-entities

Input

Argument Name	Description	Required
list_ids	A comma-separated list of Recorded Future list IDs.	Required

Context Output

Path	Type	Description
RecordedFuture.List.id	String	Unique ID of the list in Recorded Future.
RecordedFuture.List.name	String	Name of the list in Recorded Future.
RecordedFuture.List.type	String	Recorded Future entity type.
RecordedFuture.List.Entities.name	String	Name of the entity in the list.
RecordedFuture.List.Entities.type	String	The Recorded Future entity type resolved during the action.
RecordedFuture.List.Entities.id	String	Unique ID of the entity in Recorded Future.

Configuration parameters

server_url — API URL (required)
token — (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (4)

recordedfuture-lists-add-entities
Add entities to a list, separate entities by commas. "NOTE:" if entity type is specified, only one entity type can be added with each action.
recordedfuture-lists-entities
Get the entities that are currently in the given lists.
recordedfuture-lists-remove-entities
Remove entities from a list. Separate entities with a comma. "NOTE:" If entity type is specified, only one entity type can be added with each action.
recordedfuture-lists-search
Search for lists in Recorded Future.

Source

RecordedFutureLists.py RecordedFutureLists_test.py RecordedFutureLists.yml RecordedFutureLists_description.md command_examples.txt

Download History Raw

commonfields:
  id: RecordedFutureLists
  version: -1
name: RecordedFutureLists
display: 'Recorded Future - Lists'
category: Data Enrichment & Threat Intelligence
provider: Mastercard
image:
description: 'Search and manage watchlists in Recorded Future.'
configuration:
- display: API URL
  name: server_url
  additionalinfo: "Default URL: https://api.recordedfuture.com/gw/xsoar/"
  defaultvalue: https://api.recordedfuture.com/gw/xsoar/
  type: 0
  required: true
- displaypassword: API Token
  name: token
  defaultvalue: ""
  type: 9
  hiddenusername: true
  required: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
script:
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  commands:
  - name: recordedfuture-lists-search
    description: Search for lists in Recorded Future.
    arguments:
    - name: list_names
      description: Freetext name to search for.
    - name: contains
      description: Filter lists based on entity types, will only include lists with the entity types specified. Default value "" includes all types.
      auto: PREDEFINED
      predefined:
      - entity
      - source
      - text
      - custom
      - ip
      - domain
      - tech_stack
      - industry
      - brand
      - partner
      - industry_peer
      - location
      - supplier
      - vulnerability
      - company
      - hash
      - operation
      - attacker
      - target
      - method
    - name: limit
      description: Limits the amount of returned results.
    - name: include
      required: false
      description: Include all search results. Default is to exclude all lists owned by the system user.
      auto: PREDEFINED
      predefined:
      - all
    outputs:
    - contextPath: RecordedFuture.List.id
      description: Unique id of the list in Recorded Future.
      type: String
    - contextPath: RecordedFuture.List.name
      description: Name of the list in Recorded Future.
      type: String
    - contextPath: RecordedFuture.List.type
      description: Recorded future entity type.
      type: String
    - contextPath: RecordedFuture.List.created
      description: Timestamp of creation.
      type: String
    - contextPath: RecordedFuture.List.updated
      description: Timestamp of last update to the list.
      type: String
    - contextPath: RecordedFuture.List.owner_id
      description: Unique id of the owner in Recorded Future.
      type: String
    - contextPath: RecordedFuture.List.owner_name
      description: Readable name of list in Recorded Future.
      type: String
  - name: recordedfuture-lists-add-entities
    description: Add entities to a list, separate entities by commas. "NOTE:" if entity type is specified, only one entity type can be added with each action.
    arguments:
    - name: list_id
      required: true
      description: Id of the list that should be added, can be found by running !recordedfuture-lists-search with the corresponding filters or in the Recorded Future portal.
    - name: entity_ids
      description: 'A comma-separated list of specific IDs from Recorded Future. For URLs containing commas, replace the comma with %2C. For more information, go to https://xsoar.pan.dev/docs/reference/integrations/recorded-future-lists#recordedfuture-lists-add-entities.'
      required: false
    - name: freetext_names
      description: 'Freetext names will be matched to Recorded Future ids separated by comma, this alernative will add the best match in the Recorded Future data. For urls containing commas: escape with %2C.'
    - name: entity_type
      required: false
      description: Type of the entities that should be added. Use together with freetext_names to improve entity resolution.
      auto: PREDEFINED
      predefined:
      - ip
      - domain
      - malware
      - url
      - hash
      - cve
      - company
      - person
      - product
      - industry
      - country
      - attack-vector
      - operation
      - mitre-identifier
      - malware-category
    outputs:
    - contextPath: RecordedFuture.List.Entities.name
      description: Name of the entity in the list.
      type: String
    - contextPath: RecordedFuture.List.Entities.type
      description: The Recorded Future entity type resolved during the action.
      type: String
    - contextPath: RecordedFuture.List.Entities.id
      description: Unique ID of the entity in Recorded Future.
      type: String
    - contextPath: RecordedFuture.List.Entities.input_value
      description: The value inputted to the command.
      type: String
    - contextPath: RecordedFuture.List.Entities.action_result
      description: Entity specific result for the action.
      type: String
  - name: recordedfuture-lists-remove-entities
    description: Remove entities from a list. Separate entities with a comma. "NOTE:" If entity type is specified, only one entity type can be added with each action.
    arguments:
    - name: list_id
      required: true
      description: ID of the list that should be removed. Can be found by running !recordedfuture-lists-search with the corresponding filters or in the Recorded Future portal.
    - name: entity_ids
      description: 'A comma-separated list of specific IDs from Recorded Future. For URLs containing commas, replace the comma with %2C. For more information, go to https://xsoar.pan.dev/docs/reference/integrations/recorded-future-lists#recordedfuture-lists-add-entities.'
      required: false
    - name: freetext_names
      description: 'A comma-separated list of freetext names to be matched to Recorded Future IDs. Will remove the best match in the Recorded Future data. For URLs containing commas, escape with %2C.'
      required: false
    - name: entity_type
      required: false
      description: Type of the entities that should be removed. Use together with freetext_names to improve entity resolution.
      auto: PREDEFINED
      predefined:
      - ip
      - domain
      - malware
      - url
      - hash
      - cve
      - company
      - person
      - product
      - industry
      - country
      - attack-vector
      - operation
      - mitre-identifier
      - malware-category
    outputs:
    - contextPath: RecordedFuture.List.Entities.name
      description: Name of the entity in the list.
      type: String
    - contextPath: RecordedFuture.List.Entities.type
      description: The Recorded Future entity type resolved during the action.
      type: String
    - contextPath: RecordedFuture.List.Entities.id
      description: Unique id of the entity in Recorded Future.
      type: String
    - contextPath: RecordedFuture.List.Entities.input_value
      description: The value inputted to the command.
      type: String
    - contextPath: RecordedFuture.List.Entities.action_result
      description: Entity specific result for the action.
      type: String
  - name: recordedfuture-lists-entities
    description: Get the entities that are currently in the given lists.
    arguments:
    - name: list_ids
      required: true
      description: A comma-separated list of Recorded Future list IDs.
    outputs:
    - contextPath: RecordedFuture.List.id
      description: Unique ID of the list in Recorded Future.
      type: String
    - contextPath: RecordedFuture.List.name
      description: Name of the list in Recorded Future.
      type: String
    - contextPath: RecordedFuture.List.type
      description: Recorded Future entity type.
      type: String
    - contextPath: RecordedFuture.List.Entities.name
      description: Name of the entity in the list.
      type: String
    - contextPath: RecordedFuture.List.Entities.type
      description: The Recorded Future entity type resolved during the action.
      type: String
    - contextPath: RecordedFuture.List.Entities.id
      description: Unique ID of the entity in Recorded Future.
      type: String
fromversion: 6.5.0
tests:
- No tests (auto formatted)