category: Data Enrichment & Threat Intelligence
provider: Mastercard
sectionorder:
- Connect
- Collect
commonfields:
  id: Recorded Future Feed
  version: -1
configuration:
- display: Fetch indicators
  name: feed
  defaultvalue: 'true'
  type: 8
  required: false
  section: Collect
- display: Indicator Reputation
  name: feedReputation
  defaultvalue: feedInstanceReputationNotSet
  type: 18
  options:
  - None
  - Good
  - Suspicious
  - Bad
  additionalinfo: Indicators from this integration instance will be marked with this reputation
  required: false
  section: Collect
- defaultvalue: A - Completely reliable
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
  additionalinfo: Reliability of the source providing the intelligence data
  section: Collect
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
  section: Collect
- display: ""
  name: feedExpirationPolicy
  defaultvalue: indicatorType
  type: 17
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  required: false
  section: Collect
- name: feedExpirationInterval
  defaultvalue: "20160"
  type: 1
  display: ""
  required: false
  section: Collect
- defaultvalue: '60'
  display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  required: false
  section: Collect
- display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  additionalinfo: |-
    When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  required: false
  section: Collect
  advanced: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- additionalinfo: Type of the indicator in the feed.
  display: Indicator Type
  name: indicator_type
  options:
  - domain
  - ip
  - hash
  - url
  - CVE(vulnerability)
  required: true
  type: 15
  section: Collect
- display: API token
  name: api_token
  type: 4
  hidden: true
  required: false
  section: Connect
- displaypassword: API Token
  name: credentials_api_token
  hiddenusername: true
  type: 9
  required: false
  display: ''
  section: Connect
- defaultvalue: connectApi
  display: Services
  name: services
  options:
  - connectApi
  - fusion
  required: true
  type: 16
  section: Connect
- additionalinfo: |-
    A comma-separated list of risk rules which limits the indicators list to a specific risk rule.
    For example: 'dhsAis,phishingUrl'.
    If more than one risk rule is set, the indicators fetching and the 'rf-feed-get-indicators' command will be executed for each risk rule.
    To see available risk rules run the rf-feed-get-risk-rules command.
    This parameter will only be used for the 'connectApi' service.
    Using the 'large' risk rule is not recommended.
  display: Risk Rule
  name: risk_rule
  type: 0
  required: false
  section: Collect
- additionalinfo: |-
    Load a custom risklist from a specified Recorded Future file path.
    If no file path is specified, the default risklist file is used. This parameter
    will only be used for the 'fusion' service.
  display: Fusion File Path
  name: fusion_file_path
  type: 0
  required: false
  section: Collect
  advanced: true
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  type: 0
  required: false
  section: Collect
  advanced: true
- additionalinfo: Time in seconds before HTTP requests timeout.
  defaultvalue: '20'
  display: Request Timeout
  name: polling_timeout
  required: true
  type: 0
  section: Collect
- additionalinfo: |-
    The minimum score from the feed in order to determine whether the indicator is malicious. Default is "65". For more information about Recorded Future scoring go to integration details.
  defaultvalue: '65'
  display: Malicious Threshold
  name: threshold
  type: 0
  required: false
  section: Collect
  advanced: true
- additionalinfo: The minimum score from the feed in order to determine whether the indicator is Suspicious. Ranges up to the Malicious Threshold. Default is "25". For more information about Recorded Future scoring go to integration details.
  defaultvalue: '25'
  display: Suspicious Threshold
  name: suspicious_threshold
  type: 0
  required: false
  section: Collect
  advanced: true
- additionalinfo: If selected, will be used to filter out the ingested indicators, and only indicators with equivalent and higher risk score will be ingested into XSOAR. Scores greater than the IOC Risk Score Threshold and less than the Suspicious Threshold will have an unknown verdict.
  defaultvalue: '0'
  display: IOC Risk Score Threshold
  name: risk_score_threshold
  required: false
  type: 0
  section: Collect
  advanced: true
- additionalinfo: 'Improve the feed performance by removing the rawJSON from the indicators. Note: A loss of data may occur if selecting this checkbox.'
  display: Remove rawJSON from indicators
  name: performance
  defaultvalue: "true"
  type: 8
  required: false
  section: Collect
  advanced: true
description: Ingests indicators from Recorded Future feeds into Demisto.
display: Recorded Future RiskList Feed
name: Recorded Future Feed
script:
  commands:
  - arguments:
    - default: true
      defaultValue: '10'
      description: The maximum number of results to return. The default value is 10.
      name: limit
      required: true
    - auto: PREDEFINED
      description: The indicator type. Can be "ip", "domain", "hash", "vulnerability" or "url".
      name: indicator_type
      predefined:
      - ip
      - domain
      - hash
      - url
      - vulnerability
    description: Gets indicators from the feed.
    name: rf-feed-get-indicators
  - arguments:
    - auto: PREDEFINED
      description: The indicator type.
      name: indicator_type
      predefined:
      - ip
      - domain
      - hash
      - url
      - vulnerability
      required: true
    description: |-
      Get a list of the risk rules available for an indicator,
      To limit the 'connectApi' service indicators list.
    name: rf-feed-get-risk-rules
    outputs:
    - contextPath: RecordedFutureFeed.RiskRule.Name
      description: The risk rule name.
      type: String
    - contextPath: RecordedFutureFeed.RiskRule.Description
      description: The risk rule description.
      type: String
    - contextPath: RecordedFutureFeed.RiskRule.Criticality
      description: The risk rule criticality.
      type: String
  dockerimage: demisto/python3:3.12.13.10404775
  feed: true
  runonce: false
  script: ''
  subtype: python3
  type: python
tests:
- RecordedFutureFeed - Test
fromversion: 5.5.0