Recorded Future IOC Reputation

Entity Reputation using sub-playbooks

Recorded Future Intelligence · 7 tasks · 6 inputs · 77 outputs

Details

IDRecorded Future IOC Reputation
From Version5.0.0
Tasks7

README

Entity Reputation using sub-playbooks

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts. Depends on the recorded futures indicator field; risk rules.

Sub-playbooks

  • Recorded Future Domain Reputation
  • Recorded Future URL Reputation
  • Recorded Future CVE Reputation
  • Recorded Future IP Reputation
  • Recorded Future File Reputation

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name Description Default Value Required
IP The IP addresses to enrich IP.Address Optional
MD5 File MD5 to enrich File.MD5 Optional
SHA256 File SHA256 to enrich File.SHA256 Optional
SHA1 File SHA1 to enrich File.SHA1 Optional
URL URL to enrich URL.Data Optional
Domain The domain name to enrich Domain.Name Optional

Playbook Outputs

Path Description Type
DBotScore.Indicator The indicator that was tested string
DBotScore.Type Indicator type string
DBotScore.Vendor Vendor used to calculate the score string
DBotScore.Score The actual score number
CVE.ID Vulnerability name string
Domain.Name Domain name string
Domain.Malicious.Vendor For malicious Domains, the vendor that made the decision string
Domain.Malicious.Description For malicious Domains, the reason that the vendor made the decision string
IP.Address IP address string
IP.Malicious.Vendor For malicious IP addresses, the vendor that made the decision string
IP.Malicious.Description For malicious IP addresses, the reason that the vendor made the decision string
URL.Data URL name string
URL.Malicious.Vendor For malicious URLs, the vendor that made the decision string
URL.Malicious.Description For malicious URLs, the reason that the vendor made the decision string
File.SHA256 File SHA-256 string
File.SHA512 File SHA-512 string
File.SHA1 File SHA-1 string
File.MD5 File MD5 string
File.CRC32 File CRC32 string
File.CTPH File CTPH string
File.Malicious.Vendor For malicious files, the vendor that made the decision string
File.Malicious.Description For malicious files, the reason that the vendor made the decision string
RecordedFuture.File.riskScore Recorded Future Hash Risk Score number
RecordedFuture.File.riskLevel Recorded Future Hash Risk Level string
RecordedFuture.File.Evidence.rule Recorded Risk Rule Name string
RecordedFuture.File.Evidence.mitigation Recorded Risk Rule Mitigation string
RecordedFuture.File.Evidence.description Recorded Risk Rule description string
RecordedFuture.File.Evidence.timestamp Recorded Risk Rule timestamp date
RecordedFuture.File.Evidence.level Recorded Risk Rule Level number
RecordedFuture.File.Evidence.ruleid Recorded Risk Rule ID string
RecordedFuture.File.name Hash string
RecordedFuture.File.maxRules Maximum count of Recorded Future Hash Risk Rules number
RecordedFuture.File.ruleCount Number of triggered Recorded Future Hash Risk Rules number
RecordedFuture.IP.riskScore Recorded Future IP Risk Score number
RecordedFuture.IP.riskLevel Recorded Future IP Risk Level string
RecordedFuture.IP.Evidence.rule Recorded Risk Rule Name string
RecordedFuture.IP.Evidence.mitigation Recorded Risk Rule Mitigation string
RecordedFuture.IP.Evidence.description Recorded Risk Rule Description string
RecordedFuture.IP.Evidence.timestamp Recorded Risk Rule Timestamp date
RecordedFuture.IP.Evidence.level Recorded Risk Rule Level number
RecordedFuture.IP.Evidence.ruleid Recorded Risk Rule ID string
RecordedFuture.IP.name IP Address string
RecordedFuture.IP.maxRules Maximum count of Recorded Future IP Risk Rules number
RecordedFuture.IP.ruleCount Number of triggered Recorded Future IP Risk Rules number
RecordedFuture.CVE.riskLevel Recorded Future Vulnerability Risk Level string
RecordedFuture.CVE.riskScore Risk Score number
RecordedFuture.CVE.Evidence.rule Recorded Risk Rule Name string
RecordedFuture.CVE.Evidence.mitigation Recorded Risk Rule Mitigation string
RecordedFuture.CVE.Evidence.description Recorded Risk Rule description string
RecordedFuture.CVE.Evidence.timestamp Recorded Risk Rule timestamp date
RecordedFuture.CVE.Evidence.level Recorded Risk Rule Level number
RecordedFuture.CVE.Evidence.ruleid Recorded Risk Rule ID string
RecordedFuture.CVE.name Vulnerability name string
RecordedFuture.CVE.maxRules Maximum count of Recorded Future Vulnerability Risk Rules number
RecordedFuture.CVE.ruleCount Number of triggered Recorded Future Vulnerability Risk Rules number
RecordedFuture.Domain.riskScore Recorded Future Domain Risk Score number
RecordedFuture.Domain.riskLevel Recorded Future Domain Risk Level string
RecordedFuture.Domain.Evidence.rule Recorded Risk Rule Name string
RecordedFuture.Domain.Evidence.mitigation Recorded Risk Rule Mitigation string
RecordedFuture.Domain.Evidence.description Recorded Risk Rule description string
RecordedFuture.Domain.Evidence.timestamp Recorded Risk Rule timestamp date
RecordedFuture.Domain.Evidence.level Recorded Risk Rule Level number
RecordedFuture.Domain.Evidence.ruleid Recorded Risk Rule ID string
RecordedFuture.Domain.name Domain name string
RecordedFuture.Domain.maxRules Maximum count of Recorded Future Domain Risk Rules number
RecordedFuture.Domain.ruleCount Number of triggered Recorded Future Domain Risk Rules number
RecordedFuture.URL.riskScore Recorded Future URL Risk Score number
RecordedFuture.URL.riskLevel Recorded Future URL Risk Level string
RecordedFuture.URL.Evidence.rule Recorded Risk Rule Name string
RecordedFuture.URL.Evidence.mitigation Recorded Risk Rule Mitigation string
RecordedFuture.URL.Evidence.description Recorded Risk Rule description string
RecordedFuture.URL.Evidence.timestamp Recorded Risk Rule timestamp date
RecordedFuture.URL.Evidence.level Recorded Risk Rule Level number
RecordedFuture.URL.Evidence.ruleid Recorded Risk Rule ID string
RecordedFuture.URL.name URL string
RecordedFuture.URL.maxRules Maximum count of Recorded Future URL Risk Rules number
RecordedFuture.URL.ruleCount Number of triggered Recorded Future URL Risk Rules number

Playbook Image

Recorded Future IOC Reputation

Inputs

  • IP — The IP addresses to enrich
  • MD5 — MD5 to enrich
  • SHA256 — SHA256 to enrich
  • SHA1 — SHA1 to enrich
  • URL — URL to enrich
  • Domain — The domain name to enrich

Outputs

  • DBotScore.Indicator — The indicator that was tested
  • DBotScore.Type — Indicator type
  • DBotScore.Vendor — Vendor used to calculate the score
  • DBotScore.Score — The actual score
  • CVE.ID — Vulnerability name
  • Domain.Name — Domain name
  • Domain.Malicious.Vendor — For malicious domains, the vendor that made the decision
  • Domain.Malicious.Description — For malicious domains, the reason that the vendor made the decision
  • IP.Address — IP address
  • IP.Malicious.Vendor — For malicious IP addresses, the vendor that made the decision
  • IP.Malicious.Description — For malicious IP addresses, the reason that the vendor made the decision
  • URL.Data — URL name
  • URL.Malicious.Vendor — For malicious URLs, the vendor that made the decision
  • URL.Malicious.Description — For malicious URLs, the reason that the vendor made the decision
  • File.SHA256 — File SHA-256
  • File.SHA512 — File SHA-512
  • File.SHA1 — File SHA-1
  • File.MD5 — File MD5
  • File.CRC32 — File CRC32
  • File.CTPH — File CTPH
  • File.Malicious.Vendor — For malicious files, the vendor that made the decision
  • File.Malicious.Description — For malicious files, the reason that the vendor made the decision
  • RecordedFuture.File.riskScore — Recorded Future Hash Risk Score
  • RecordedFuture.File.riskLevel — Recorded Future Hash Risk Level
  • RecordedFuture.File.Evidence.rule — Recorded Future Risk Rule Name
  • RecordedFuture.File.Evidence.mitigation — Recorded Future Risk Rule Mitigation
  • RecordedFuture.File.Evidence.description — Recorded Future Risk Rule description
  • RecordedFuture.File.Evidence.timestamp — Recorded Future Risk Rule timestamp
  • RecordedFuture.File.Evidence.level — Recorded Future Risk Rule Level
  • RecordedFuture.File.Evidence.ruleid — Recorded Future Risk Rule ID
  • RecordedFuture.File.name — Hash
  • RecordedFuture.File.maxRules — Maximum count of Recorded Future Hash Risk Rules
  • RecordedFuture.File.ruleCount — Number of triggered Recorded Future Hash Risk Rules
  • RecordedFuture.IP.riskScore — Recorded Future IP Risk Score
  • RecordedFuture.IP.riskLevel — Recorded Future IP Risk Level
  • RecordedFuture.IP.Evidence.rule — Recorded Future Risk Rule Name
  • RecordedFuture.IP.Evidence.mitigation — Recorded Future Risk Rule Mitigation
  • RecordedFuture.IP.Evidence.description — Recorded Future Risk Rule Description
  • RecordedFuture.IP.Evidence.timestamp — Recorded Future Risk Rule Timestamp
  • RecordedFuture.IP.Evidence.level — Recorded Future Risk Rule Level
  • RecordedFuture.IP.Evidence.ruleid — Recorded Future Risk Rule ID
  • RecordedFuture.IP.name — IP Address
  • RecordedFuture.IP.maxRules — Maximum count of Recorded Future IP Risk Rules
  • RecordedFuture.IP.ruleCount — Number of triggered Recorded Future IP Risk Rules
  • RecordedFuture.CVE.riskLevel — Recorded Future Vulnerability Risk Level
  • RecordedFuture.CVE.riskScore — Risk Score
  • RecordedFuture.CVE.Evidence.rule — Recorded Future Risk Rule Name
  • RecordedFuture.CVE.Evidence.mitigation — Recorded Future Risk Rule Mitigation
  • RecordedFuture.CVE.Evidence.description — Recorded Future Risk Rule description
  • RecordedFuture.CVE.Evidence.timestamp — Recorded Future Risk Rule timestamp
  • RecordedFuture.CVE.Evidence.level — Recorded Future Risk Rule Level
  • RecordedFuture.CVE.Evidence.ruleid — Recorded Future Risk Rule ID
  • RecordedFuture.CVE.name — Vulnerability name
  • RecordedFuture.CVE.maxRules — Maximum count of Recorded Future Vulnerability Risk Rules
  • RecordedFuture.CVE.ruleCount — Number of triggered Recorded Future Vulnerability Risk Rules
  • RecordedFuture.Domain.riskScore — Recorded Future Domain Risk Score
  • RecordedFuture.Domain.riskLevel — Recorded Future Domain Risk Level
  • RecordedFuture.Domain.Evidence.rule — Recorded Future Risk Rule Name
  • RecordedFuture.Domain.Evidence.mitigation — Recorded Future Risk Rule Mitigation
  • RecordedFuture.Domain.Evidence.description — Recorded Future Risk Rule description
  • RecordedFuture.Domain.Evidence.timestamp — Recorded Future Risk Rule timestamp
  • RecordedFuture.Domain.Evidence.level — Recorded Future Risk Rule Level
  • RecordedFuture.Domain.Evidence.ruleid — Recorded Future Risk Rule ID
  • RecordedFuture.Domain.name — Domain name
  • RecordedFuture.Domain.maxRules — Maximum count of Recorded Future Domain Risk Rules
  • RecordedFuture.Domain.ruleCount — Number of triggered Recorded Future Domain Risk Rules
  • RecordedFuture.URL.riskScore — Recorded Future URL Risk Score
  • RecordedFuture.URL.riskLevel — Recorded Future URL Risk Level
  • RecordedFuture.URL.Evidence.rule — Recorded Future Risk Rule Name
  • RecordedFuture.URL.Evidence.mitigation — Recorded Future Risk Rule Mitigation
  • RecordedFuture.URL.Evidence.description — Recorded Future Risk Rule description
  • RecordedFuture.URL.Evidence.timestamp — Recorded Future Risk Rule timestamp
  • RecordedFuture.URL.Evidence.level — Recorded Future Risk Rule Level
  • RecordedFuture.URL.Evidence.ruleid — Recorded Future Risk Rule ID
  • RecordedFuture.URL.name — URL
  • RecordedFuture.URL.maxRules — Maximum count of Recorded Future URL Risk Rules
  • RecordedFuture.URL.ruleCount — Number of triggered Recorded Future URL Risk Rules

Flowchart

Start Start Done Done Recorded Future Domain Reputation - Recorded Future Domain Reputation Recorded Future Domain Re... Recorded Future Domain Reputa... Recorded Future IP Reputation - Recorded Future IP Reputation Recorded Future IP Reputa... Recorded Future IP Reputation Recorded Future URL Reputation - Recorded Future URL Reputation Recorded Future URL Reput... Recorded Future URL Reputation Recorded Future File Reputation - Recorded Future File Reputation Recorded Future File Repu... Recorded Future File Reputation Recorded Future CVE Reputation - Recorded Future CVE Reputation Recorded Future CVE Reput... Recorded Future CVE Reputation

Source

playbook-Recorded_Future_IOC_Reputation.yml
Download History Raw 
id: Recorded Future IOC Reputation
version: -1
name: Recorded Future IOC Reputation
description: Entity Reputation using sub-playbooks
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 31873721-cbc2-4aff-89c6-8158aceb2f04
    type: start
    task:
      id: 31873721-cbc2-4aff-89c6-8158aceb2f04
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "17"
      - "16"
      - "18"
      - "19"
      - "20"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 280,
          "y": 70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: a6d14c3d-59ff-4c4e-828b-a21492d4d1da
    type: title
    task:
      id: a6d14c3d-59ff-4c4e-828b-a21492d4d1da
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 280,
          "y": 520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: c0323bab-06fc-49a3-8c75-c0a42de70554
    type: playbook
    task:
      id: c0323bab-06fc-49a3-8c75-c0a42de70554
      version: -1
      name: Recorded Future Domain Reputation
      playbookName: Recorded Future Domain Reputation
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": -130,
          "y": 260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "17":
    id: "17"
    taskid: 7fea0d9b-6f98-4ec4-81b0-cdadd6c749ad
    type: playbook
    task:
      id: 7fea0d9b-6f98-4ec4-81b0-cdadd6c749ad
      version: -1
      name: Recorded Future IP Reputation
      playbookName: Recorded Future IP Reputation
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": -540,
          "y": 260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: ca55d1ff-d524-4456-8365-5b655de0b4a0
    type: playbook
    task:
      id: ca55d1ff-d524-4456-8365-5b655de0b4a0
      version: -1
      name: Recorded Future URL Reputation
      playbookName: Recorded Future URL Reputation
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 690,
          "y": 260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: 8c9869fa-477d-4b6b-8e86-b37121adea91
    type: playbook
    task:
      id: 8c9869fa-477d-4b6b-8e86-b37121adea91
      version: -1
      name: Recorded Future File Reputation
      playbookName: Recorded Future File Reputation
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 1100,
          "y": 260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: da774399-ce73-4369-89ae-1ad2be7c3130
    type: playbook
    task:
      id: da774399-ce73-4369-89ae-1ad2be7c3130
      version: -1
      name: Recorded Future CVE Reputation
      playbookName: Recorded Future CVE Reputation
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      CVE:
        complex:
          root: CVE
          accessor: ID
          transformers:
          - operator: uniq
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 280,
          "y": 260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 515,
        "width": 2020,
        "x": -540,
        "y": 70
      }
    }
  }
inputs:
- key: IP
  value:
    complex:
      root: IP
      accessor: Address
      transformers:
      - operator: uniq
  required: false
  description: The IP addresses to enrich
  playbookInputQuery:
- key: MD5
  value:
    complex:
      root: File
      accessor: MD5
      transformers:
      - operator: uniq
  required: false
  description: MD5 to enrich
  playbookInputQuery:
- key: SHA256
  value:
    complex:
      root: File
      accessor: SHA256
      transformers:
      - operator: uniq
  required: false
  description: SHA256 to enrich
  playbookInputQuery:
- key: SHA1
  value:
    complex:
      root: File
      accessor: SHA1
      transformers:
      - operator: uniq
  required: false
  description: SHA1 to enrich
  playbookInputQuery:
- key: URL
  value:
    complex:
      root: URL
      accessor: Data
      transformers:
      - operator: uniq
  required: false
  description: URL to enrich
  playbookInputQuery:
- key: Domain
  value:
    complex:
      root: Domain
      accessor: Name
      transformers:
      - operator: uniq
  required: false
  description: The domain name to enrich
  playbookInputQuery:
outputs:
- contextPath: DBotScore.Indicator
  description: The indicator that was tested
  type: string
- contextPath: DBotScore.Type
  description: Indicator type
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score
  type: string
- contextPath: DBotScore.Score
  description: The actual score
  type: number
- contextPath: CVE.ID
  description: Vulnerability name
  type: string
- contextPath: Domain.Name
  description: Domain name
  type: string
- contextPath: Domain.Malicious.Vendor
  description: For malicious domains, the vendor that made the decision
  type: string
- contextPath: Domain.Malicious.Description
  description: For malicious domains, the reason that the vendor made the decision
  type: string
- contextPath: IP.Address
  description: IP address
  type: string
- contextPath: IP.Malicious.Vendor
  description: For malicious IP addresses, the vendor that made the decision
  type: string
- contextPath: IP.Malicious.Description
  description: For malicious IP addresses, the reason that the vendor made the decision
  type: string
- contextPath: URL.Data
  description: URL name
  type: string
- contextPath: URL.Malicious.Vendor
  description: For malicious URLs, the vendor that made the decision
  type: string
- contextPath: URL.Malicious.Description
  description: For malicious URLs, the reason that the vendor made the decision
  type: string
- contextPath: File.SHA256
  description: File SHA-256
  type: string
- contextPath: File.SHA512
  description: File SHA-512
  type: string
- contextPath: File.SHA1
  description: File SHA-1
  type: string
- contextPath: File.MD5
  description: File MD5
  type: string
- contextPath: File.CRC32
  description: File CRC32
  type: string
- contextPath: File.CTPH
  description: File CTPH
  type: string
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision
  type: string
- contextPath: File.Malicious.Description
  description: For malicious files, the reason that the vendor made the decision
  type: string
- contextPath: RecordedFuture.File.riskScore
  description: Recorded Future Hash Risk Score
  type: number
- contextPath: RecordedFuture.File.riskLevel
  description: Recorded Future Hash Risk Level
  type: string
- contextPath: RecordedFuture.File.Evidence.rule
  description: Recorded Future Risk Rule Name
  type: string
- contextPath: RecordedFuture.File.Evidence.mitigation
  description: Recorded Future Risk Rule Mitigation
  type: string
- contextPath: RecordedFuture.File.Evidence.description
  description: Recorded Future Risk Rule description
  type: string
- contextPath: RecordedFuture.File.Evidence.timestamp
  description: Recorded Future Risk Rule timestamp
  type: date
- contextPath: RecordedFuture.File.Evidence.level
  description: Recorded Future Risk Rule Level
  type: number
- contextPath: RecordedFuture.File.Evidence.ruleid
  description: Recorded Future Risk Rule ID
  type: string
- contextPath: RecordedFuture.File.name
  description: Hash
  type: string
- contextPath: RecordedFuture.File.maxRules
  description: Maximum count of Recorded Future Hash Risk Rules
  type: number
- contextPath: RecordedFuture.File.ruleCount
  description: Number of triggered Recorded Future Hash Risk Rules
  type: number
- contextPath: RecordedFuture.IP.riskScore
  description: Recorded Future IP Risk Score
  type: number
- contextPath: RecordedFuture.IP.riskLevel
  description: Recorded Future IP Risk Level
  type: string
- contextPath: RecordedFuture.IP.Evidence.rule
  description: Recorded Future Risk Rule Name
  type: string
- contextPath: RecordedFuture.IP.Evidence.mitigation
  description: Recorded Future Risk Rule Mitigation
  type: string
- contextPath: RecordedFuture.IP.Evidence.description
  description: Recorded Future Risk Rule Description
  type: string
- contextPath: RecordedFuture.IP.Evidence.timestamp
  description: Recorded Future Risk Rule Timestamp
  type: date
- contextPath: RecordedFuture.IP.Evidence.level
  description: Recorded Future Risk Rule Level
  type: number
- contextPath: RecordedFuture.IP.Evidence.ruleid
  description: Recorded Future Risk Rule ID
  type: string
- contextPath: RecordedFuture.IP.name
  description: IP Address
  type: string
- contextPath: RecordedFuture.IP.maxRules
  description: Maximum count of Recorded Future IP Risk Rules
  type: number
- contextPath: RecordedFuture.IP.ruleCount
  description: Number of triggered Recorded Future IP Risk Rules
  type: number
- contextPath: RecordedFuture.CVE.riskLevel
  description: Recorded Future Vulnerability Risk Level
  type: string
- contextPath: RecordedFuture.CVE.riskScore
  description: Risk Score
  type: number
- contextPath: RecordedFuture.CVE.Evidence.rule
  description: Recorded Future Risk Rule Name
  type: string
- contextPath: RecordedFuture.CVE.Evidence.mitigation
  description: Recorded Future Risk Rule Mitigation
  type: string
- contextPath: RecordedFuture.CVE.Evidence.description
  description: Recorded Future Risk Rule description
  type: string
- contextPath: RecordedFuture.CVE.Evidence.timestamp
  description: Recorded Future Risk Rule timestamp
  type: date
- contextPath: RecordedFuture.CVE.Evidence.level
  description: Recorded Future Risk Rule Level
  type: number
- contextPath: RecordedFuture.CVE.Evidence.ruleid
  description: Recorded Future Risk Rule ID
  type: string
- contextPath: RecordedFuture.CVE.name
  description: Vulnerability name
  type: string
- contextPath: RecordedFuture.CVE.maxRules
  description: Maximum count of Recorded Future Vulnerability Risk Rules
  type: number
- contextPath: RecordedFuture.CVE.ruleCount
  description: Number of triggered Recorded Future Vulnerability Risk Rules
  type: number
- contextPath: RecordedFuture.Domain.riskScore
  description: Recorded Future Domain Risk Score
  type: number
- contextPath: RecordedFuture.Domain.riskLevel
  description: Recorded Future Domain Risk Level
  type: string
- contextPath: RecordedFuture.Domain.Evidence.rule
  description: Recorded Future Risk Rule Name
  type: string
- contextPath: RecordedFuture.Domain.Evidence.mitigation
  description: Recorded Future Risk Rule Mitigation
  type: string
- contextPath: RecordedFuture.Domain.Evidence.description
  description: Recorded Future Risk Rule description
  type: string
- contextPath: RecordedFuture.Domain.Evidence.timestamp
  description: Recorded Future Risk Rule timestamp
  type: date
- contextPath: RecordedFuture.Domain.Evidence.level
  description: Recorded Future Risk Rule Level
  type: number
- contextPath: RecordedFuture.Domain.Evidence.ruleid
  description: Recorded Future Risk Rule ID
  type: string
- contextPath: RecordedFuture.Domain.name
  description: Domain name
  type: string
- contextPath: RecordedFuture.Domain.maxRules
  description: Maximum count of Recorded Future Domain Risk Rules
  type: number
- contextPath: RecordedFuture.Domain.ruleCount
  description: Number of triggered Recorded Future Domain Risk Rules
  type: number
- contextPath: RecordedFuture.URL.riskScore
  description: Recorded Future URL Risk Score
  type: number
- contextPath: RecordedFuture.URL.riskLevel
  description: Recorded Future URL Risk Level
  type: string
- contextPath: RecordedFuture.URL.Evidence.rule
  description: Recorded Future Risk Rule Name
  type: string
- contextPath: RecordedFuture.URL.Evidence.mitigation
  description: Recorded Future Risk Rule Mitigation
  type: string
- contextPath: RecordedFuture.URL.Evidence.description
  description: Recorded Future Risk Rule description
  type: string
- contextPath: RecordedFuture.URL.Evidence.timestamp
  description: Recorded Future Risk Rule timestamp
  type: date
- contextPath: RecordedFuture.URL.Evidence.level
  description: Recorded Future Risk Rule Level
  type: number
- contextPath: RecordedFuture.URL.Evidence.ruleid
  description: Recorded Future Risk Rule ID
  type: string
- contextPath: RecordedFuture.URL.name
  description: URL
  type: string
- contextPath: RecordedFuture.URL.maxRules
  description: Maximum count of Recorded Future URL Risk Rules
  type: number
- contextPath: RecordedFuture.URL.ruleCount
  description: Number of triggered Recorded Future URL Risk Rules
  type: number
fromversion: 5.0.0
tests:
- No tests (auto formatted)