commonfields:
  id: Recorded Future v2
  version: -1
name: Recorded Future v2
display: Recorded Future v2
category: Data Enrichment & Threat Intelligence
provider: Mastercard
description: Unique threat intel technology that automatically serves up relevant insights in real time.
sectionorder:
  - Connect
  - Collect
configuration:
- display: Server URL (e.g., https://api.recordedfuture.com/gw/xsoar/)
  name: server_url
  defaultvalue: https://api.recordedfuture.com/gw/xsoar/
  type: 0
  required: true
  section: Connect
- display: API Token
  name: token
  type: 4
  required: false
  section: Connect
  displaypassword: API Token
  hiddenusername: true
  hidden: true
- display: ''
  name: token_credential
  type: 9
  required: false
  displaypassword: API Token
  hiddenusername: true
  section: Connect
- display: File Suspicious Threshold
  additionalinfo: Minimum risk score from Recorded Future to consider the file suspicious.
  name: file_threshold_suspicious
  defaultvalue: "25"
  type: 0
  required: false
  section: Collect
- display: File Malicious Threshold
  additionalinfo: Minimum risk score from Recorded Future to consider the file malicious.
  name: file_threshold
  defaultvalue: "65"
  type: 0
  required: false
  section: Collect
- display: CVE Suspicious Threshold
  additionalinfo: Minimum risk score from Recorded Future to consider the CVE suspicious.
  name: cve_threshold_suspicious
  defaultvalue: "25"
  type: 0
  required: false
  section: Collect
- display: CVE Malicious Threshold
  additionalinfo: Minimum risk score from Recorded Future to consider the CVE malicious.
  name: cve_threshold
  defaultvalue: "65"
  type: 0
  required: false
  section: Collect
- display: IP Suspicious Threshold
  additionalinfo: Minimum risk score from Recorded Future to consider the IP suspicious.
  name: ip_threshold_suspicious
  defaultvalue: "25"
  type: 0
  required: false
  section: Collect
- display: IP Malicious Threshold
  additionalinfo: Minimum risk score from Recorded Future to consider the IP malicious.
  name: ip_threshold
  defaultvalue: "65"
  type: 0
  required: false
  section: Collect
- display: Domain Suspicious Threshold
  additionalinfo: Minimum risk score from Recorded Future to consider the domain suspicious.
  name: domain_threshold_suspicious
  defaultvalue: "25"
  type: 0
  required: false
  section: Collect
- display: Domain Malicious Threshold
  additionalinfo: Minimum risk score from Recorded Future to consider the domain malicious.
  name: domain_threshold
  defaultvalue: "65"
  type: 0
  required: false
  section: Collect
- display: URL Suspicious Threshold
  additionalinfo: Minimum risk score from Recorded Future to consider the URL suspicious.
  name: url_threshold_suspicious
  defaultvalue: "25"
  type: 0
  required: false
  section: Collect
- display: URL Malicious Threshold
  additionalinfo: Minimum risk score from Recorded Future to consider the URL malicious.
  name: url_threshold
  defaultvalue: "65"
  type: 0
  required: false
  section: Collect
- display: Vulnerability Threshold
  name: vulnerability_threshold
  defaultvalue: '65'
  type: 0
  required: false
  section: Collect
  additionalinfo: Minimum risk score from Recorded Future to consider the vulnerability critical.
- display: Collective Insights
  name: collective_insights
  defaultvalue: "On"
  type: 15
  required: true
  section: Collect
  additionalinfo: The Recorded Future Platform tracks trends and facilitates new insights on detections to better identify threats. See trends and track metrics over time using the Recorded Future Platform. This feature will store XSOAR enrichments based on playbooks. This feature permits additional analytics to track trends and identify new insights with the Recorded Future Intelligence Cloud. Please refer to the Help section for information about fields collected for Collective Insights.
  options:
  - On
  - Off
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  defaultvalue: "false"
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  defaultvalue: 'false'
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Rule names to fetch alerts by
  name: rule_names
  type: 12
  additionalinfo: 'Rule names to fetch alerts by, separated by semicolon. If empty, all alerts will be fetched.'
  required: false
  section: Collect
- display: Alert Statuses to include in the fetch
  name: fetch_statuses
  defaultvalue: "no-action"
  type: 0
  section: Collect
  additionalinfo: Comma-separated alert statuses (e.g. "unassigned,assigned,pending,actionable,no-action,tuning"). If empty, the default value of "no-action" will be used.
  required: false
- display: Update alert status on fetch.
  additionalinfo: 'If selected, alerts with a status of ''no-action'' will be updated to ''pending'' once fetched by the integration.'
  defaultvalue: 'true'
  name: update_status
  type: 8
  required: false
  section: Collect
- name: first_fetch
  display: 'First fetch time'
  type: 0
  defaultvalue: 24 hours
  required: false
  section: Collect
  additionalinfo: 'Format: <number> <time unit>, e.g., "12 hours", "7 days", "3 months", "1 year".'
- display: Incident type
  name: incidentType
  defaultvalue: "Recorded Future Alert"
  type: 13
  required: false
  section: Collect
- display: Maximum number of incidents per fetch
  name: max_fetch
  defaultvalue: '50'
  type: 0
  required: false
  section: Collect
- name: integrationReliability
  display: 'Source Reliability'
  defaultvalue: B - Usually reliable
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
  additionalinfo: Reliability of the source providing the intelligence data.
  section: Collect
- display: ''
  name: feedExpirationPolicy
  defaultvalue: "indicatorType"
  type: 17
  required: false
  section: Collect
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
- display: Incidents Fetch Interval
  name: feedExpirationInterval
  defaultvalue: '20160'
  type: 1
  required: false
  section: Collect
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  required: false
  type: 19
  section: Collect
script:
  script: ''
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  commands:
  - name: domain
    description: Gets a quick indicator of the risk associated with a domain.
    arguments:
    - name: domain
      required: true
      default: true
      isArray: true
      description: The domain for which to get the reputation.
    - name: collective_insights
      description: Save IOC to Collective Insights? If not specified - uses demisto param setting value.
      required: false
      default: false
      auto: PREDEFINED
      predefined:
        - on
        - off
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domains, the vendor that made the decision.
      type: string
    - contextPath: Domain.Malicious.Description
      description: For malicious Domains, the reason that the vendor made the decision.
      type: string
    - contextPath: Domain.Name
      description: Domain name.
      type: string
    - contextPath: RecordedFuture.Domain.riskScore
      description: Recorded Future domain risk score.
      type: number
    - contextPath: RecordedFuture.Domain.riskLevel
      description: Recorded Future domain risk level.
      type: string
    - contextPath: RecordedFuture.Domain.Evidence.rule
      description: Recorded Future risk rule name.
      type: string
    - contextPath: RecordedFuture.Domain.Evidence.mitigation
      description: Recorded Future risk rule mitigation.
      type: string
    - contextPath: RecordedFuture.Domain.Evidence.description
      description: Recorded Future risk rule description.
      type: string
    - contextPath: RecordedFuture.Domain.Evidence.timestamp
      description: Recorded Future risk rule timestamp.
      type: date
    - contextPath: RecordedFuture.Domain.Evidence.level
      description: Recorded Future risk rule level.
      type: number
    - contextPath: RecordedFuture.Domain.Evidence.ruleid
      description: Recorded Future risk rule ID.
      type: string
    - contextPath: RecordedFuture.Domain.name
      description: Domain name.
      type: string
    - contextPath: RecordedFuture.Domain.maxRules
      description: Maximum number of Recorded Future domain risk rules.
      type: number
    - contextPath: RecordedFuture.Domain.rules
      description: All the rules concatenated by comma.
      type: string
    - contextPath: RecordedFuture.Domain.ruleCount
      description: Number of triggered Recorded Future domain risk rules.
      type: number

  - name: ip
    description: Gets a quick indicator of the risk associated with an IP address.
    arguments:
    - name: ip
      required: true
      default: true
      isArray: true
      description: IP address for which to get the reputation.
    - name: collective_insights
      description: Save IOC to Collective Insights? If not specified - uses demisto param setting value.
      required: false
      default: false
      auto: PREDEFINED
      predefined:
        - on
        - off
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: IP.Malicious.Vendor
      description: For malicious IP addresses, the vendor that made the decision.
      type: string
    - contextPath: IP.Malicious.Description
      description: For malicious IP addresses, the reason that the vendor made the decision.
      type: string
    - contextPath: IP.Address
      description: IP address.
      type: string
    - contextPath: RecordedFuture.IP.riskScore
      description: Recorded Future IP risk score.
      type: number
    - contextPath: RecordedFuture.IP.riskLevel
      description: Recorded Future IP risk level.
      type: string
    - contextPath: RecordedFuture.IP.Evidence.rule
      description: Recorded Future risk rule name.
      type: string
    - contextPath: RecordedFuture.IP.Evidence.mitigation
      description: Recorded Future risk rule mitigation.
      type: string
    - contextPath: RecordedFuture.IP.Evidence.description
      description: Recorded Future risk rule description.
      type: string
    - contextPath: RecordedFuture.IP.Evidence.timestamp
      description: Recorded Future risk rule timestamp.
      type: date
    - contextPath: RecordedFuture.IP.Evidence.level
      description: Recorded Future risk rule level.
      type: number
    - contextPath: RecordedFuture.IP.Evidence.ruleid
      description: Recorded Future risk rule ID.
      type: string
    - contextPath: RecordedFuture.IP.name
      description: IP address.
      type: string
    - contextPath: RecordedFuture.IP.maxRules
      description: Maximum number of Recorded Future IP risk rules.
      type: number
    - contextPath: RecordedFuture.IP.rules
      description: All the rules concatenated by comma.
      type: string
    - contextPath: RecordedFuture.IP.ruleCount
      description: Number of triggered Recorded Future IP risk rules.
      type: number

  - name: file
    description: Gets a quick indicator of the risk associated with a file.
    arguments:
    - name: file
      required: true
      isArray: true
      default: true
      description: File hash for which to check the reputation. Can be an MD5, SHA1, SHA256, SHA512, CRC32 or CTPH.
    - name: collective_insights
      description: Save IOC to Collective Insights? If not specified - uses demisto param setting value.
      required: false
      default: false
      auto: PREDEFINED
      predefined:
        - on
        - off
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: File.SHA256
      description: SHA-256 hash of the file.
      type: string
    - contextPath: File.SHA512
      description: SHA-512 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: SHA-1 hash of the file.
      type: string
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: File.CRC32
      description: CRC32 hash of the file.
      type: string
    - contextPath: File.CTPH
      description: CTPH hash of the file.
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the reason that the vendor made the decision.
      type: string
    - contextPath: RecordedFuture.File.riskScore
      description: Recorded Future hash risk score.
      type: number
    - contextPath: RecordedFuture.File.riskLevel
      description: Recorded Future hash risk level.
      type: string
    - contextPath: RecordedFuture.File.Evidence.rule
      description: Recorded Future risk rule name.
      type: string
    - contextPath: RecordedFuture.File.Evidence.mitigation
      description: Recorded Future risk rule mitigation.
      type: string
    - contextPath: RecordedFuture.File.Evidence.description
      description: Recorded Future risk rule description.
      type: string
    - contextPath: RecordedFuture.File.Evidence.timestamp
      description: Recorded Future risk rule timestamp.
      type: date
    - contextPath: RecordedFuture.File.Evidence.level
      description: Recorded Future risk rule level.
      type: number
    - contextPath: RecordedFuture.File.Evidence.ruleid
      description: Recorded Future risk rule ID.
      type: string
    - contextPath: RecordedFuture.File.name
      description: File name.
      type: string
    - contextPath: RecordedFuture.File.maxRules
      description: Maximum number of Recorded Future hash risk rules.
      type: number
    - contextPath: RecordedFuture.File.rules
      description: All the rules concatenated by comma.
      type: string
    - contextPath: RecordedFuture.File.ruleCount
      description: Number of triggered Recorded Future hash risk rules.
      type: number

  - name: cve
    description: Gets a quick indicator of the risk associated with a CVE.
    arguments:
    - name: cve
      required: true
      default: true
      isArray: true
      description: CVE for which to get the reputation.
    - name: collective_insights
      description: Save IOC to Collective Insights? If not specified - uses demisto param setting value.
      required: false
      default: false
      auto: PREDEFINED
      predefined:
        - on
        - off
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: CVE.ID
      description: Vulnerability name.
      type: string
    - contextPath: RecordedFuture.CVE.riskScore
      description: Recorded Future vulnerability risk score.
      type: number
    - contextPath: RecordedFuture.CVE.riskLevel
      description: Recorded Future vulnerability risk level.
      type: string
    - contextPath: RecordedFuture.CVE.Evidence.rule
      description: Recorded Future risk rule name.
      type: string
    - contextPath: RecordedFuture.CVE.Evidence.mitigation
      description: Recorded Future risk rule mitigation.
      type: string
    - contextPath: RecordedFuture.CVE.Evidence.description
      description: Recorded Future risk rule description.
      type: string
    - contextPath: RecordedFuture.CVE.Evidence.timestamp
      description: Recorded Future risk rule timestamp.
      type: date
    - contextPath: RecordedFuture.CVE.Evidence.level
      description: Recorded Future risk rule level.
      type: number
    - contextPath: RecordedFuture.CVE.Evidence.ruleid
      description: Recorded Future risk rule ID.
      type: string
    - contextPath: RecordedFuture.CVE.name
      description: CVE name.
      type: string
    - contextPath: RecordedFuture.CVE.maxRules
      description: Maximum number of Recorded Future vulnerability risk rules.
      type: number
    - contextPath: RecordedFuture.CVE.rules
      description: All the rules concatenated by comma.
      type: string
    - contextPath: RecordedFuture.CVE.ruleCount
      description: Number of triggered Recorded Future vulnerability risk rules.
      type: number

  - name: url
    description: Gets a quick indicator of the risk associated with a URL.
    arguments:
    - name: url
      required: true
      default: true
      isArray: true
      description: URL for which to get the reputation.
    - name: collective_insights
      description: Save IOC to Collective Insights? If not specified - uses demisto param setting value.
      required: false
      default: false
      auto: PREDEFINED
      predefined:
        - on
        - off
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: string
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason that the vendor made the decision.
      type: string
    - contextPath: URL.Data
      description: URL name.
      type: string
    - contextPath: RecordedFuture.URL.riskScore
      description: Recorded Future URL risk score.
      type: number
    - contextPath: RecordedFuture.URL.riskLevel
      description: Recorded Future URL risk level.
      type: string
    - contextPath: RecordedFuture.URL.Evidence.rule
      description: Recorded Risk rule name.
      type: string
    - contextPath: RecordedFuture.URL.Evidence.mitigation
      description: Recorded Risk rule mitigation.
      type: string
    - contextPath: RecordedFuture.URL.Evidence.description
      description: Recorded Risk rule description.
      type: string
    - contextPath: RecordedFuture.URL.Evidence.timestamp
      description: Recorded Risk rule timestamp.
      type: date
    - contextPath: RecordedFuture.URL.Evidence.level
      description: Recorded Risk rule level.
      type: number
    - contextPath: RecordedFuture.URL.Evidence.ruleid
      description: Recorded Risk rule ID.
      type: string
    - contextPath: RecordedFuture.URL.name
      description: URL name.
      type: string
    - contextPath: RecordedFuture.URL.maxRules
      description: Maximum number of Recorded Future URL risk rules.
      type: number
    - contextPath: RecordedFuture.URL.rules
      description: All the rules concatenated by comma.
      type: string
    - contextPath: RecordedFuture.URL.ruleCount
      description: Number of triggered Recorded Future URL risk rules.
      type: number

  - name: recordedfuture-threat-assessment
    description: Get an indicator of the risk based on context.
    arguments:
    - name: context
      auto: PREDEFINED
      predefined:
      - c2
      - malware
      - phishing
      description: Context to use for the assessment. This is used by Recorded Future to calculate the relevant score and verdict. Can be "c2", "malware", or "phishing".
      required: true
    - name: ip
      isArray: true
      description: IP addresses to check if they are related to the selected context.
    - name: domain
      isArray: true
      description: Domains to check if they are related to the selected context.
    - name: file
      isArray: true
      description: File hashes to check if they are related to the selected context.
    - name: url
      isArray: true
      description: URLs to check if they are related to the selected context.
    - name: cve
      isArray: true
      description: CVEs to check if they are related to the selected context.
    - name: filter
      description: Will filter out entities that have zero as score.
      auto: PREDEFINED
      predefined:
      - yes
      - no
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: Indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: File.SHA256
      description: SHA-256 hash of the file.
      type: string
    - contextPath: File.SHA512
      description: SHA-512 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: SHA-1 hash of the file.
      type: string
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: File.CRC32
      description: CRC32 hash of the file.
      type: string
    - contextPath: File.CTPH
      description: CTPH hash of the file.
      type: string
    - contextPath: IP.Address
      description: IP address.
      type: string
    - contextPath: IP.ASN
      description: ASN.
      type: string
    - contextPath: IP.Geo.Country
      description: IP address geolocation country.
      type: string
    - contextPath: Domain.Name
      description: Domain name.
      type: string
    - contextPath: URL.Data
      description: URL name.
      type: string
    - contextPath: CVE.ID
      description: Vulnerability name.
      type: string
    - contextPath: RecordedFuture.verdict
      description: Recorded Future verdict.
      type: boolean
    - contextPath: RecordedFuture.context
      description: Threat assessment context.
      type: string
    - contextPath: RecordedFuture.riskScore
      description: Recorded Future maximum risk score.
      type: number
    - contextPath: RecordedFuture.Entities.id
      description: Recorded Future entity ID.
      type: string
    - contextPath: RecordedFuture.Entities.name
      description: Recorded Future entity name.
      type: string
    - contextPath: RecordedFuture.Entities.type
      description: Recorded Future entity type.
      type: string
    - contextPath: RecordedFuture.Entities.score
      description: Recorded Future entity score.
      type: string
    - contextPath: RecordedFuture.Entities.context
      description: Contains the current context if there is evidence.
      type: string
    - contextPath: RecordedFuture.Entities.Evidence.ruleid
      description: Recorded Future risk rule ID.
      type: string
    - contextPath: RecordedFuture.Entities.Evidence.timestamp
      description: Recorded Future evidence timestamp.
      type: date
    - contextPath: RecordedFuture.Entities.Evidence.mitigation
      description: Recorded Future evidence mitigation.
      type: string
    - contextPath: RecordedFuture.Entities.Evidence.description
      description: Recorded Future evidence description.
      type: string
    - contextPath: RecordedFuture.Entities.Evidence.rule
      description: Recorded Future risk rule.
      type: string
    - contextPath: RecordedFuture.Entities.Evidence.level
      description: Recorded Future risk rule level.
      type: number

  - name: recordedfuture-intelligence
    description: Get threat intelligence for an IP, Domain, CVE, URL, File or Malware.
    arguments:
    - name: profile
      description: Depending on what profile you choose you will get different related entities matching the given profile.
      auto: PREDEFINED
      defaultValue: "All"
      predefined:
      - "All"
      - "Threat Hunter"
      - "SecOp Analyst"
      - "TI Analyst"
      - "Vulnerability Analyst"
    - name: entity_type
      description: The type of entity for which to fetch context. Should be provided with its value in entityValue argument. Can be "domain", "ip", "file", "url", "cve", or "malware".
      required: true
      auto: PREDEFINED
      predefined:
      - domain
      - ip
      - file
      - url
      - cve
      - malware
    - name: entity
      required: true
      description: 'The value of the entity for which to fetch context. Should be provided with its type in entity_type argument. Supported hash types: MD5, SHA1, SHA256, SHA512, CRC32, and CTPH. Vulnerability supports CVEs.'
    - name: fetch_related_entities
      auto: PREDEFINED
      predefined:
      - yes
      - no
      description: Whether to fetch related entity data. Can be "yes" or "no".
    - name: fetch_analyst_notes
      auto: PREDEFINED
      predefined:
      - yes
      - no
      description: Whether to fetch analyst notes. Can be "yes" or "no".
      defaultValue: "no"
    - name: fetch_riskyCIDRips
      auto: PREDEFINED
      predefined:
      - no
      - yes
      defaultValue: "no"
      description: Whether risk scores for other IP addresses within the same CIDR should be fetched (only for IP intelligence). Can be "yes" or "no".
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: Indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: File.SHA256
      description: SHA-256 hash of the file.
      type: string
    - contextPath: File.SHA512
      description: SHA-512 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: SHA-1 hash of the file.
      type: string
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: File.CRC32
      description: CRC32 hash of the file.
      type: string
    - contextPath: File.CTPH
      description: CTPH hash of the file.
      type: string
    - contextPath: IP.Address
      description: IP address.
      type: string
    - contextPath: IP.ASN
      description: ASN.
      type: string
    - contextPath: IP.Geo.Country
      description: IP address geolocation country.
      type: string
    - contextPath: Domain.Name
      description: Domain name.
      type: string
    - contextPath: URL.Data
      description: URL name.
      type: string
    - contextPath: CVE.ID
      description: Vulnerability name.
      type: string
    - contextPath: RecordedFuture.IP.criticality
      description: Risk criticality.
      type: number
    - contextPath: RecordedFuture.IP.criticalityLabel
      description: Risk criticality label.
      type: string
    - contextPath: RecordedFuture.IP.riskString
      description: Risk string.
      type: string
    - contextPath: RecordedFuture.IP.riskSummary
      description: Risk summary.
      type: string
    - contextPath: RecordedFuture.IP.rules
      description: Risk rules.
      type: string
    - contextPath: RecordedFuture.Ip.concatRules
      description: All risk rules concatenated by comma.
      type: string
    - contextPath: RecordedFuture.IP.score
      description: Risk score.
      type: number
    - contextPath: RecordedFuture.IP.firstSeen
      description: Evidence first seen date.
      type: date
    - contextPath: RecordedFuture.IP.lastSeen
      description: Evidence last seen date.
      type: date
    - contextPath: RecordedFuture.IP.intelCard
      description: Recorded Future intelligence card URL.
      type: string
    - contextPath: RecordedFuture.IP.type
      description: Recorded Future entity type.
      type: string
    - contextPath: RecordedFuture.IP.name
      description: Recorded Future entity name.
      type: string
    - contextPath: RecordedFuture.IP.id
      description: Recorded Future entity ID.
      type: string
    - contextPath: RecordedFuture.IP.location.asn
      description: ASN number.
      type: string
    - contextPath: RecordedFuture.IP.location.cidr.id
      description: Recorded Future CIDR ID.
      type: string
    - contextPath: RecordedFuture.IP.location.cidr.name
      description: CIDR name.
      type: string
    - contextPath: RecordedFuture.IP.location.cidr.type
      description: CIDR type.
      type: string
    - contextPath: RecordedFuture.IP.location.location.city
      description: IP address geolocation city.
      type: string
    - contextPath: RecordedFuture.IP.location.location.continent
      description: IP address geolocation continent.
      type: string
    - contextPath: RecordedFuture.IP.location.location.country
      description: IP address geolocation country.
      type: string
    - contextPath: RecordedFuture.IP.location.organization
      description: IP address geolocation organization.
      type: string
    - contextPath: RecordedFuture.IP.metrics.type
      description: Recorded Future metrics type.
      type: string
    - contextPath: RecordedFuture.IP.metrics.value
      description: Recorded Future metrics value.
      type: number
    - contextPath: RecordedFuture.IP.threatLists.description
      description: Recorded Future threat list description.
      type: string
    - contextPath: RecordedFuture.IP.threatLists.id
      description: Recorded Future threat list ID.
      type: string
    - contextPath: RecordedFuture.IP.threatLists.name
      description: Recorded Future threat list name.
      type: string
    - contextPath: RecordedFuture.IP.threatLists.type
      description: Recorded Future threat list type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedAttacker.count
      description: Recorded Future related attacker count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedAttacker.id
      description: Recorded Future related attacker ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedAttacker.name
      description: Recorded Future related attacker name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedAttacker.type
      description: Recorded Future related attacker type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedTarget.count
      description: Recorded Future related target count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedTarget.id
      description: Recorded Future related target ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedTarget.name
      description: Recorded Future related target name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedTarget.type
      description: Recorded Future related target type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedThreatActor.count
      description: Recorded Future related threat actor count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedThreatActor.id
      description: Recorded Future related threat actor ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedThreatActor.name
      description: Recorded Future related threat actor name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedThreatActor.type
      description: Recorded Future related threat actor type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedMalware.count
      description: Recorded Future related malware count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedMalware.id
      description: Recorded Future related malware ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedMalware.name
      description: Recorded Future related malware name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedMalware.type
      description: Recorded Future related malware type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCyberVulnerability.count
      description: Recorded Future related vulnerability count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCyberVulnerability.id
      description: Recorded Future related vulnerability ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCyberVulnerability.name
      description: Recorded Future related vulnerability name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCyberVulnerability.type
      description: Recorded Future related vulnerability type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedIpAddress.count
      description: Recorded Future related IP address count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedIpAddress.id
      description: Recorded Future related IP address ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedIpAddress.name
      description: Recorded Future related IP address name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedIpAddress.type
      description: Recorded Future related IP address type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedInternetDomainName.count
      description: Recorded Future related domain name count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedInternetDomainName.id
      description: Recorded Future related domain name ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedInternetDomainName.name
      description: Recorded Future related domain name name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedInternetDomainName.type
      description: Recorded Future related domain name type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedProduct.count
      description: Recorded Future related product count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedProduct.id
      description: Recorded Future related product ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedProduct.name
      description: Recorded Future related product name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedProduct.type
      description: Recorded Future related product type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCountries.count
      description: Recorded Future related countries count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCountries.id
      description: Recorded Future related countries ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCountries.name
      description: Recorded Future related countries name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCountries.type
      description: Recorded Future related countries type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedHash.count
      description: Recorded Future related hash count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedHash.id
      description: Recorded Future related hash ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedHash.name
      description: Recorded Future related hash name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedHash.type
      description: Recorded Future related hash type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedTechnology.count
      description: Recorded Future related technology count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedTechnology.id
      description: Recorded Future related technology ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedTechnology.name
      description: Recorded Future related technology name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedTechnology.type
      description: Recorded Future related technology type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedEmailAddress.count
      description: Recorded Future related email address count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedEmailAddress.id
      description: Recorded Future related email address ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedEmailAddress.name
      description: Recorded Future related email address name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedEmailAddress.type
      description: Recorded Future related email address type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedAttackVector.count
      description: Recorded Future related attack vector count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedAttackVector.id
      description: Recorded Future related attack vector ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedAttackVector.name
      description: Recorded Future related attack vector name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedAttackVector.type
      description: Recorded Future related attack vector type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedMalwareCategory.count
      description: Recorded Future related malware category count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedMalwareCategory.id
      description: Recorded Future related malware category ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedMalwareCategory.name
      description: Recorded Future related malware category name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedMalwareCategory.type
      description: Recorded Future related malware category type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedOperations.count
      description: Recorded Future related operations count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedOperations.id
      description: Recorded Future related operations ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedOperations.name
      description: Recorded Future related operations name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedOperations.type
      description: Recorded Future related operations type.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCompany.count
      description: Recorded Future related company count.
      type: number
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCompany.id
      description: Recorded Future related company ID.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCompany.name
      description: Recorded Future related company name.
      type: string
    - contextPath: RecordedFuture.IP.relatedEntities.RelatedCompany.type
      description: Recorded Future related company type.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.context_entities.id
      description: Recorded Future analyst note context entity ID.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.context_entities.name
      description: Recorded Future analyst note context entity name.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.context_entities.type
      description: Recorded Future analyst note context entity type.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.note_entities.id
      description: Recorded Future analyst note entity ID.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.note_entities.name
      description: Recorded Future analyst note entity name.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.note_entities.type
      description: Recorded Future analyst note entity type.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.published
      description: Recorded Future analyst note publishing time.
      type: date
    - contextPath: RecordedFuture.IP.analystNotes.attributes.validated_on
      description: Recorded Future analyst note validation time.
      type: date
    - contextPath: RecordedFuture.IP.analystNotes.attributes.text
      description: Recorded Future analyst note content.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.title
      description: Recorded Future analyst note title.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.topic.description
      description: Recorded Future analyst note topic description.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.topic.id
      description: Recorded Future analyst note topic ID.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.topic.name
      description: Recorded Future analyst note topic name.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.topic.type
      description: Recorded Future analyst note topic type.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.validation_urls.id
      description: Recorded Future analyst note validation URL ID.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.validation_urls.name
      description: Recorded Future analyst note validation URL.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.attributes.validation_urls.type
      description: Recorded Future analyst note validation URL entity type.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.id
      description: Recorded Future analyst note ID.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.source.id
      description: Recorded Future analyst note source ID.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.source.name
      description: Recorded Future analyst note source name.
      type: string
    - contextPath: RecordedFuture.IP.analystNotes.source.type
      description: Recorded Future analyst note source type.
      type: string
    - contextPath: RecordedFuture.Domain.criticality
      description: Risk criticality.
      type: number
    - contextPath: RecordedFuture.Domain.criticalityLabel
      description: Risk criticality label.
      type: string
    - contextPath: RecordedFuture.Domain.riskString
      description: Risk string.
      type: string
    - contextPath: RecordedFuture.Domain.riskSummary
      description: Risk summary.
      type: string
    - contextPath: RecordedFuture.Domain.rules
      description: Risk rules.
      type: string
    - contextPath: RecordedFuture.Domain.concatRules
      description: All risk rules concatenated by comma.
      type: string
    - contextPath: RecordedFuture.Domain.score
      description: Risk score.
      type: number
    - contextPath: RecordedFuture.Domain.firstSeen
      description: Evidence first seen date.
      type: date
    - contextPath: RecordedFuture.Domain.lastSeen
      description: Evidence last seen.
      type: date
    - contextPath: RecordedFuture.Domain.intelCard
      description: Recorded Future intelligence card URL.
      type: string
    - contextPath: RecordedFuture.Domain.type
      description: Recorded Future entity type.
      type: string
    - contextPath: RecordedFuture.Domain.name
      description: Recorded Future entity name.
      type: string
    - contextPath: RecordedFuture.Domain.id
      description: Recorded Future entity ID.
      type: string
    - contextPath: RecordedFuture.Domain.metrics.type
      description: Recorded Future metrics type.
      type: string
    - contextPath: RecordedFuture.Domain.metrics.value
      description: Recorded Future metrics value.
      type: number
    - contextPath: RecordedFuture.Domain.threatLists.description
      description: Recorded Future threat list description.
      type: string
    - contextPath: RecordedFuture.Domain.threatLists.id
      description: Recorded Future threat list ID.
      type: string
    - contextPath: RecordedFuture.Domain.threatLists.name
      description: Recorded Future threat list name.
      type: string
    - contextPath: RecordedFuture.Domain.threatLists.type
      description: Recorded Future threat list type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedAttacker.count
      description: Recorded Future related attacker count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedAttacker.id
      description: Recorded Future related attacker ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedAttacker.name
      description: Recorded Future related attacker name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedAttacker.type
      description: Recorded Future related attacker type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedTarget.count
      description: Recorded Future related target count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedTarget.id
      description: Recorded Future related target ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedTarget.name
      description: Recorded Future related target name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedTarget.type
      description: Recorded Future related target type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedThreatActor.count
      description: Recorded Future related threat actor count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedThreatActor.id
      description: Recorded Future related threat actor ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedThreatActor.name
      description: Recorded Future related threat actor name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedThreatActor.type
      description: Recorded Future related threat actor type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedMalware.count
      description: Recorded Future related malware count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedMalware.id
      description: Recorded Future related malware ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedMalware.name
      description: Recorded Future related malware name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedMalware.type
      description: Recorded Future related malware type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCyberVulnerability.count
      description: Recorded Future related vulnerability count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCyberVulnerability.id
      description: Recorded Future related vulnerability ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCyberVulnerability.name
      description: Recorded Future related vulnerability name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCyberVulnerability.type
      description: Recorded Future related vulnerability type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedIpAddress.count
      description: Recorded Future related IP address count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedIpAddress.id
      description: Recorded Future related IP address ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedIpAddress.name
      description: Recorded Future related IP address name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedIpAddress.type
      description: Recorded Future related IP address type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedInternetDomainName.count
      description: Recorded Future related domain name count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedInternetDomainName.id
      description: Recorded Future related domain name ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedInternetDomainName.name
      description: Recorded Future related domain name name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedInternetDomainName.type
      description: Recorded Future related domain name type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedProduct.count
      description: Recorded Future related product count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedProduct.id
      description: Recorded Future related product ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedProduct.name
      description: Recorded Future related product name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedProduct.type
      description: Recorded Future related product type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCountries.count
      description: Recorded Future related countries count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCountries.id
      description: Recorded Future related countries ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCountries.name
      description: Recorded Future related countries name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCountries.type
      description: Recorded Future related countries type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedHash.count
      description: Recorded Future related hash count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedHash.id
      description: Recorded Future related hash ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedHash.name
      description: Recorded Future related hash name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedHash.type
      description: Recorded Future related hash type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedTechnology.count
      description: Recorded Future related technology count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedTechnology.id
      description: Recorded Future related technology ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedTechnology.name
      description: Recorded Future related technology name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedTechnology.type
      description: Recorded Future related technology type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedEmailAddress.count
      description: Recorded Future related email address count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedEmailAddress.id
      description: Recorded Future related email address ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedEmailAddress.name
      description: Recorded Future related email address name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedEmailAddress.type
      description: Recorded Future related email address type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedAttackVector.count
      description: Recorded Future related attack vector count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedAttackVector.id
      description: Recorded Future related attack vector ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedAttackVector.name
      description: Recorded Future related attack vector name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedAttackVector.type
      description: Recorded Future related attack vector type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedMalwareCategory.count
      description: Recorded Future related malware category count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedMalwareCategory.id
      description: Recorded Future related malware category ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedMalwareCategory.name
      description: Recorded Future related malware category name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedMalwareCategory.type
      description: Recorded Future related malware category type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedOperations.count
      description: Recorded Future related operations count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedOperations.id
      description: Recorded Future related operations ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedOperations.name
      description: Recorded Future related operations name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedOperations.type
      description: Recorded Future related operations type.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCompany.count
      description: Recorded Future related company count.
      type: number
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCompany.id
      description: Recorded Future related company ID.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCompany.name
      description: Recorded Future related company name.
      type: string
    - contextPath: RecordedFuture.Domain.relatedEntities.RelatedCompany.type
      description: Recorded Future related company type.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.context_entities.id
      description: Recorded Future analyst note context entity ID.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.context_entities.name
      description: Recorded Future analyst note context entity name.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.context_entities.type
      description: Recorded Future analyst note context entity type.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.note_entities.id
      description: Recorded Future analyst note entity ID.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.note_entities.name
      description: Recorded Future analyst note entity name.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.note_entities.type
      description: Recorded Future analyst note entity type.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.published
      description: Recorded Future analyst note publishing time.
      type: date
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.validated_on
      description: Recorded Future analyst note validation time.
      type: date
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.text
      description: Recorded Future analyst note content.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.title
      description: Recorded Future analyst note title.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.topic.description
      description: Recorded Future analyst note topic description.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.topic.id
      description: Recorded Future analyst note topic ID.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.topic.name
      description: Recorded Future analyst note topic name.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.topic.type
      description: Recorded Future analyst note topic type.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.validation_urls.id
      description: Recorded Future analyst note validation URL ID.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.validation_urls.name
      description: Recorded Future analyst note validation URL.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.attributes.validation_urls.type
      description: Recorded Future analyst note validation URL entity type.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.id
      description: Recorded Future analyst note ID.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.source.id
      description: Recorded Future analyst note source ID.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.source.name
      description: Recorded Future analyst note source name.
      type: string
    - contextPath: RecordedFuture.Domain.analystNotes.source.type
      description: Recorded Future analyst note source type.
      type: string
    - contextPath: RecordedFuture.CVE.criticality
      description: Risk criticality.
      type: number
    - contextPath: RecordedFuture.CVE.criticalityLabel
      description: Risk criticality label.
      type: string
    - contextPath: RecordedFuture.CVE.riskString
      description: Risk string.
      type: string
    - contextPath: RecordedFuture.CVE.riskSummary
      description: Risk summary.
      type: string
    - contextPath: RecordedFuture.CVE.rules
      description: Risk rules.
      type: string
    - contextPath: RecordedFuture.CVE.concatRules
      description: All risk rules concatenated by comma.
      type: string
    - contextPath: RecordedFuture.CVE.score
      description: Risk score.
      type: number
    - contextPath: RecordedFuture.CVE.firstSeen
      description: Evidence first seen.
      type: date
    - contextPath: RecordedFuture.CVE.lastSeen
      description: Evidence last seen.
      type: date
    - contextPath: RecordedFuture.CVE.intelCard
      description: Recorded Future intelligence card URL.
      type: string
    - contextPath: RecordedFuture.CVE.hashAlgorithm
      description: Hash algorithm.
      type: string
    - contextPath: RecordedFuture.CVE.type
      description: Recorded Future entity type.
      type: string
    - contextPath: RecordedFuture.CVE.name
      description: Recorded Future entity name.
      type: string
    - contextPath: RecordedFuture.CVE.id
      description: Recorded Future entity ID.
      type: string
    - contextPath: RecordedFuture.CVE.metrics.type
      description: Recorded Future metrics type.
      type: string
    - contextPath: RecordedFuture.CVE.metrics.value
      description: Recorded Future metrics value.
      type: number
    - contextPath: RecordedFuture.CVE.threatLists.description
      description: Recorded Future threat list description.
      type: string
    - contextPath: RecordedFuture.CVE.threatLists.id
      description: Recorded Future threat list ID.
      type: string
    - contextPath: RecordedFuture.CVE.threatLists.name
      description: Recorded Future threat list name.
      type: string
    - contextPath: RecordedFuture.CVE.threatLists.type
      description: Recorded Future threat list type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedAttacker.count
      description: Recorded Future related attacker count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedAttacker.id
      description: Recorded Future related attacker ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedAttacker.name
      description: Recorded Future related attacker name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedAttacker.type
      description: Recorded Future related attacker type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedTarget.count
      description: Recorded Future related target count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedTarget.id
      description: Recorded Future related target ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedTarget.name
      description: Recorded Future related target name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedTarget.type
      description: Recorded Future related target type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedThreatActor.count
      description: Recorded Future related threat actor count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedThreatActor.id
      description: Recorded Future related threat actor ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedThreatActor.name
      description: Recorded Future related threat actor name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedThreatActor.type
      description: Recorded Future related threat actor type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedMalware.count
      description: Recorded Future related malware count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedMalware.id
      description: Recorded Future related malware ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedMalware.name
      description: Recorded Future related malware name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedMalware.type
      description: Recorded Future related malware type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCyberVulnerability.count
      description: Recorded Future related vulnerability count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCyberVulnerability.id
      description: Recorded Future related vulnerability ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCyberVulnerability.name
      description: Recorded Future related vulnerability name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCyberVulnerability.type
      description: Recorded Future related vulnerability type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedIpAddress.count
      description: Recorded Future related IP address count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedIpAddress.id
      description: Recorded Future related IP address ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedIpAddress.name
      description: Recorded Future related IP address name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedIpAddress.type
      description: Recorded Future related IP address type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedInternetDomainName.count
      description: Recorded Future related domain name count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedInternetDomainName.id
      description: Recorded Future related domain name ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedInternetDomainName.name
      description: Recorded Future related domain name name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedInternetDomainName.type
      description: Recorded Future related domain name type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedProduct.count
      description: Recorded Future related product count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedProduct.id
      description: Recorded Future related product ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedProduct.name
      description: Recorded Future related product name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedProduct.type
      description: Recorded Future related product type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCountries.count
      description: Recorded Future related countries count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCountries.id
      description: Recorded Future related countries ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCountries.name
      description: Recorded Future related countries name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCountries.type
      description: Recorded Future related countries type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedHash.count
      description: Recorded Future related hash count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedHash.id
      description: Recorded Future related hash ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedHash.name
      description: Recorded Future related hash name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedHash.type
      description: Recorded Future related hash type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedTechnology.count
      description: Recorded Future related technology count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedTechnology.id
      description: Recorded Future related technology ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedTechnology.name
      description: Recorded Future related technology name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedTechnology.type
      description: Recorded Future related technology type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedEmailAddress.count
      description: Recorded Future related email address count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedEmailAddress.id
      description: Recorded Future related email address ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedEmailAddress.name
      description: Recorded Future related email address name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedEmailAddress.type
      description: Recorded Future related email address type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedAttackVector.count
      description: Recorded Future related attack vector count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedAttackVector.id
      description: Recorded Future related attack vector ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedAttackVector.name
      description: Recorded Future related attack vector name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedAttackVector.type
      description: Recorded Future related attack vector type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedMalwareCategory.count
      description: Recorded Future related malware category count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedMalwareCategory.id
      description: Recorded Future related malware category ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedMalwareCategory.name
      description: Recorded Future related malware category name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedMalwareCategory.type
      description: Recorded Future related malware category type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedOperations.count
      description: Recorded Future related operations count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedOperations.id
      description: Recorded Future related operations ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedOperations.name
      description: Recorded Future related operations name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedOperations.type
      description: Recorded Future related operations type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCompany.count
      description: Recorded Future related company count.
      type: number
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCompany.id
      description: Recorded Future related company ID.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCompany.name
      description: Recorded Future related company name.
      type: string
    - contextPath: RecordedFuture.CVE.relatedEntities.RelatedCompany.type
      description: Recorded Future related company type.
      type: string
    - contextPath: RecordedFuture.CVE.relatedLinks
      description: Recorded Future CVE related links.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.context_entities.id
      description: Recorded Future analyst note context entity ID.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.context_entities.name
      description: Recorded Future analyst note context entity name.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.context_entities.type
      description: Recorded Future analyst note context entity type.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.note_entities.id
      description: Recorded Future analyst note entity ID.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.note_entities.name
      description: Recorded Future analyst note entity name.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.note_entities.type
      description: Recorded Future analyst note entity type.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.published
      description: Recorded Future analyst note publishing time.
      type: date
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.validated_on
      description: Recorded Future analyst note validation time.
      type: date
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.text
      description: Recorded Future analyst note content.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.title
      description: Recorded Future analyst note title.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.topic.description
      description: Recorded Future analyst note topic description.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.topic.id
      description: Recorded Future analyst note topic ID.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.topic.name
      description: Recorded Future analyst note topic name.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.topic.type
      description: Recorded Future analyst note topic type.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.validation_urls.id
      description: Recorded Future analyst note validation URL ID.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.validation_urls.name
      description: Recorded Future analyst note validation URL.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.attributes.validation_urls.type
      description: Recorded Future analyst note validation URL entity type.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.id
      description: Recorded Future analyst note ID.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.source.id
      description: Recorded Future analyst note source ID.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.source.name
      description: Recorded Future analyst note source name.
      type: string
    - contextPath: RecordedFuture.CVE.analystNotes.source.type
      description: Recorded Future analyst note source type.
      type: string
    - contextPath: RecordedFuture.CVE.cpe
      description: Recorded Future CPE information.
      type: string
    - contextPath: RecordedFuture.File.criticality
      description: Risk criticality.
      type: number
    - contextPath: RecordedFuture.File.criticalityLabel
      description: Risk criticality label.
      type: string
    - contextPath: RecordedFuture.File.riskString
      description: Risk string.
      type: string
    - contextPath: RecordedFuture.File.riskSummary
      description: Risk summary.
      type: string
    - contextPath: RecordedFuture.File.rules
      description: Risk rules.
      type: string
    - contextPath: RecordedFuture.File.concatRules
      description: All risk rules concatenated by comma.
      type: string
    - contextPath: RecordedFuture.File.score
      description: Risk score.
      type: number
    - contextPath: RecordedFuture.File.firstSeen
      description: Evidence first seen.
      type: date
    - contextPath: RecordedFuture.File.lastSeen
      description: Evidence last seen.
      type: date
    - contextPath: RecordedFuture.File.intelCard
      description: Recorded Future intelligence card URL.
      type: string
    - contextPath: RecordedFuture.File.hashAlgorithm
      description: Hash algorithm.
      type: string
    - contextPath: RecordedFuture.File.type
      description: Recorded Future entity type.
      type: string
    - contextPath: RecordedFuture.File.name
      description: Recorded Future entity name.
      type: string
    - contextPath: RecordedFuture.File.id
      description: Recorded Future entity ID.
      type: string
    - contextPath: RecordedFuture.File.metrics.type
      description: Recorded Future metrics type.
      type: string
    - contextPath: RecordedFuture.File.metrics.value
      description: Recorded Future metrics value.
      type: number
    - contextPath: RecordedFuture.File.threatLists.description
      description: Recorded Future threat list description.
      type: string
    - contextPath: RecordedFuture.File.threatLists.id
      description: Recorded Future threat list ID.
      type: string
    - contextPath: RecordedFuture.File.threatLists.name
      description: Recorded Future threat list name.
      type: string
    - contextPath: RecordedFuture.File.threatLists.type
      description: Recorded Future threat list type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedAttacker.count
      description: Recorded Future related attacker count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedAttacker.id
      description: Recorded Future related attacker ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedAttacker.name
      description: Recorded Future related attacker name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedAttacker.type
      description: Recorded Future related attacker type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedTarget.count
      description: Recorded Future related target count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedTarget.id
      description: Recorded Future related target ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedTarget.name
      description: Recorded Future related target name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedTarget.type
      description: Recorded Future related target type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedThreatActor.count
      description: Recorded Future related threat actor count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedThreatActor.id
      description: Recorded Future related threat actor ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedThreatActor.name
      description: Recorded Future related threat actor name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedThreatActor.type
      description: Recorded Future related threat actor type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedMalware.count
      description: Recorded Future related malware count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedMalware.id
      description: Recorded Future related malware ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedMalware.name
      description: Recorded Future related malware name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedMalware.type
      description: Recorded Future related malware type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.count
      description: Recorded Future related vulnerability count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.id
      description: Recorded Future related vulnerability ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.name
      description: Recorded Future related vulnerability name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCyberVulnerability.type
      description: Recorded Future related vulnerability type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedIpAddress.count
      description: Recorded Future related IP address count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedIpAddress.id
      description: Recorded Future related IP address ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedIpAddress.name
      description: Recorded Future related IP address name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedIpAddress.type
      description: Recorded Future related IP address type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedInternetDomainName.count
      description: Recorded Future related domain name count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedInternetDomainName.id
      description: Recorded Future related domain name ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedInternetDomainName.name
      description: Recorded Future related domain name name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedInternetDomainName.type
      description: Recorded Future related domain name type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedProduct.count
      description: Recorded Future related product count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedProduct.id
      description: Recorded Future related product ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedProduct.name
      description: Recorded Future related product name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedProduct.type
      description: Recorded Future related product type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCountries.count
      description: Recorded Future related countries count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCountries.id
      description: Recorded Future related countries ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCountries.name
      description: Recorded Future related countries name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCountries.type
      description: Recorded Future related countries type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedHash.count
      description: Recorded Future related hash count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedHash.id
      description: Recorded Future related hash ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedHash.name
      description: Recorded Future related hash name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedHash.type
      description: Recorded Future related hash type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedTechnology.count
      description: Recorded Future related technology count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedTechnology.id
      description: Recorded Future related technology ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedTechnology.name
      description: Recorded Future related technology name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedTechnology.type
      description: Recorded Future related technology type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedEmailAddress.count
      description: Recorded Future related email address count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedEmailAddress.id
      description: Recorded Future related email address ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedEmailAddress.name
      description: Recorded Future related email address name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedEmailAddress.type
      description: Recorded Future related email address type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedAttackVector.count
      description: Recorded Future related attack vector count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedAttackVector.id
      description: Recorded Future related attack vector ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedAttackVector.name
      description: Recorded Future related attack vector name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedAttackVector.type
      description: Recorded Future related attack vector type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedMalwareCategory.count
      description: Recorded Future related malware category count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedMalwareCategory.id
      description: Recorded Future related malware category ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedMalwareCategory.name
      description: Recorded Future related malware category name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedMalwareCategory.type
      description: Recorded Future related malware category type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedOperations.count
      description: Recorded Future related operations count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedOperations.id
      description: Recorded Future related operations ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedOperations.name
      description: Recorded Future related operations name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedOperations.type
      description: Recorded Future related operations type.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCompany.count
      description: Recorded Future related company count.
      type: number
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCompany.id
      description: Recorded Future related company ID.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCompany.name
      description: Recorded Future related company name.
      type: string
    - contextPath: RecordedFuture.File.relatedEntities.RelatedCompany.type
      description: Recorded Future related company type.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.context_entities.id
      description: Recorded Future analyst note context entity ID.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.context_entities.name
      description: Recorded Future analyst note context entity name.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.context_entities.type
      description: Recorded Future analyst note context entity type.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.note_entities.id
      description: Recorded Future analyst note entity ID.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.note_entities.name
      description: Recorded Future analyst note entity name.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.note_entities.type
      description: Recorded Future analyst note entity type.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.published
      description: Recorded Future analyst note publishing time.
      type: date
    - contextPath: RecordedFuture.File.analystNotes.attributes.validated_on
      description: Recorded Future analyst note validation time.
      type: date
    - contextPath: RecordedFuture.File.analystNotes.attributes.text
      description: Recorded Future analyst note content.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.title
      description: Recorded Future analyst note title.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.topic.description
      description: Recorded Future analyst note topic description.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.topic.id
      description: Recorded Future analyst note topic ID.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.topic.name
      description: Recorded Future analyst note topic name.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.topic.type
      description: Recorded Future analyst note topic type.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.validation_urls.id
      description: Recorded Future analyst note validation URL ID.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.validation_urls.name
      description: Recorded Future analyst note validation URL.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.attributes.validation_urls.type
      description: Recorded Future analyst note validation URL entity type.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.id
      description: Recorded Future analyst note ID.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.source.id
      description: Recorded Future analyst note source ID.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.source.name
      description: Recorded Future analyst note source name.
      type: string
    - contextPath: RecordedFuture.File.analystNotes.source.type
      description: Recorded Future analyst note source type.
      type: string
    - contextPath: RecordedFuture.URL.criticality
      description: Risk criticality.
      type: number
    - contextPath: RecordedFuture.URL.criticalityLabel
      description: Risk criticality label.
      type: string
    - contextPath: RecordedFuture.URL.riskString
      description: Risk string.
      type: string
    - contextPath: RecordedFuture.URL.riskSummary
      description: Risk summary.
      type: string
    - contextPath: RecordedFuture.URL.rules
      description: Risk rules.
      type: string
    - contextPath: RecordedFuture.URL.concatRules
      description: All risk rules concatenated by comma.
      type: string
    - contextPath: RecordedFuture.URL.score
      description: Risk score.
      type: number
    - contextPath: RecordedFuture.URL.firstSeen
      description: Evidence first seen.
      type: date
    - contextPath: RecordedFuture.URL.lastSeen
      description: Evidence last seen.
      type: date
    - contextPath: RecordedFuture.URL.intelCard
      description: Recorded Future intelligence card URL.
      type: string
    - contextPath: RecordedFuture.URL.type
      description: Recorded Future entity type.
      type: string
    - contextPath: RecordedFuture.URL.name
      description: Recorded Future entity name.
      type: string
    - contextPath: RecordedFuture.URL.id
      description: Recorded Future entity ID.
      type: string
    - contextPath: RecordedFuture.URL.metrics.type
      description: Recorded Future metrics type.
      type: string
    - contextPath: RecordedFuture.URL.metrics.value
      description: Recorded Future metrics value.
      type: number
    - contextPath: RecordedFuture.URL.threatLists.description
      description: Recorded Future threat list description.
      type: string
    - contextPath: RecordedFuture.URL.threatLists.id
      description: Recorded Future threat list ID.
      type: string
    - contextPath: RecordedFuture.URL.threatLists.name
      description: Recorded Future threat list name.
      type: string
    - contextPath: RecordedFuture.URL.threatLists.type
      description: Recorded Future threat list type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedAttacker.count
      description: Recorded Future related attacker count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedAttacker.id
      description: Recorded Future related attacker ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedAttacker.name
      description: Recorded Future related attacker name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedAttacker.type
      description: Recorded Future related attacker type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedTarget.count
      description: Recorded Future related target count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedTarget.id
      description: Recorded Future related target ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedTarget.name
      description: Recorded Future related target name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedTarget.type
      description: Recorded Future related target type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedThreatActor.count
      description: Recorded Future related threat actor count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedThreatActor.id
      description: Recorded Future related threat actor ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedThreatActor.name
      description: Recorded Future related threat actor name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedThreatActor.type
      description: Recorded Future related threat actor type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedMalware.count
      description: Recorded Future related malware count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedMalware.id
      description: Recorded Future related malware ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedMalware.name
      description: Recorded Future related malware name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedMalware.type
      description: Recorded Future related malware type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCyberVulnerability.count
      description: Recorded Future related vulnerability count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCyberVulnerability.id
      description: Recorded Future related vulnerability ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCyberVulnerability.name
      description: Recorded Future related vulnerability name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCyberVulnerability.type
      description: Recorded Future related vulnerability type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedIpAddress.count
      description: Recorded Future related IP address count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedIpAddress.id
      description: Recorded Future related IP address ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedIpAddress.name
      description: Recorded Future related IP address name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedIpAddress.type
      description: Recorded Future related IP address type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedInternetDomainName.count
      description: Recorded Future related domain name count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedInternetDomainName.id
      description: Recorded Future related domain name ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedInternetDomainName.name
      description: Recorded Future related domain name name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedInternetDomainName.type
      description: Recorded Future related domain name type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedProduct.count
      description: Recorded Future related product count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedProduct.id
      description: Recorded Future related product ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedProduct.name
      description: Recorded Future related product name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedProduct.type
      description: Recorded Future related product type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCountries.count
      description: Recorded Future related countries count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCountries.id
      description: Recorded Future related countries ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCountries.name
      description: Recorded Future related countries name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCountries.type
      description: Recorded Future related countries type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedHash.count
      description: Recorded Future related hash count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedHash.id
      description: Recorded Future related hash ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedHash.name
      description: Recorded Future related hash name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedHash.type
      description: Recorded Future related hash type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedTechnology.count
      description: Recorded Future related technology count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedTechnology.id
      description: Recorded Future related technology ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedTechnology.name
      description: Recorded Future related technology name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedTechnology.type
      description: Recorded Future related technology type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedEmailAddress.count
      description: Recorded Future related email address count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedEmailAddress.id
      description: Recorded Future related email address ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedEmailAddress.name
      description: Recorded Future related email address name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedEmailAddress.type
      description: Recorded Future related email address type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedAttackVector.count
      description: Recorded Future related attack vector count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedAttackVector.id
      description: Recorded Future related attack vector ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedAttackVector.name
      description: Recorded Future related attack vector name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedAttackVector.type
      description: Recorded Future related attack vector type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedMalwareCategory.count
      description: Recorded Future related malware category count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedMalwareCategory.id
      description: Recorded Future related malware category ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedMalwareCategory.name
      description: Recorded Future related malware category name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedMalwareCategory.type
      description: Recorded Future related malware category type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedOperations.count
      description: Recorded Future related operations count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedOperations.id
      description: Recorded Future related operations ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedOperations.name
      description: Recorded Future related operations name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedOperations.type
      description: Recorded Future related operations type.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCompany.count
      description: Recorded Future related company count.
      type: number
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCompany.id
      description: Recorded Future related company ID.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCompany.name
      description: Recorded Future related company name.
      type: string
    - contextPath: RecordedFuture.URL.relatedEntities.RelatedCompany.type
      description: Recorded Future related company type.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.context_entities.id
      description: Recorded Future analyst note context entity ID.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.context_entities.name
      description: Recorded Future analyst note context entity name.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.context_entities.type
      description: Recorded Future analyst note context entity type.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.note_entities.id
      description: Recorded Future analyst note entity ID.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.note_entities.name
      description: Recorded Future analyst note entity name.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.note_entities.type
      description: Recorded Future analyst note entity type.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.published
      description: Recorded Future analyst note publishing time.
      type: date
    - contextPath: RecordedFuture.URL.analystNotes.attributes.validated_on
      description: Recorded Future analyst note validation time.
      type: date
    - contextPath: RecordedFuture.URL.analystNotes.attributes.text
      description: Recorded Future analyst note content.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.title
      description: Recorded Future analyst note title.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.topic.description
      description: Recorded Future analyst note topic description.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.topic.id
      description: Recorded Future analyst note topic ID.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.topic.name
      description: Recorded Future analyst note topic name.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.topic.type
      description: Recorded Future analyst note topic type.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.validation_urls.id
      description: Recorded Future analyst note validation URL ID.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.validation_urls.name
      description: Recorded Future analyst note validation URL.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.attributes.validation_urls.type
      description: Recorded Future analyst note validation URL entity type.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.id
      description: Recorded Future analyst note ID.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.source.id
      description: Recorded Future analyst note source ID.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.source.name
      description: Recorded Future analyst note source name.
      type: string
    - contextPath: RecordedFuture.URL.analystNotes.source.type
      description: Recorded Future analyst note source type.
      type: string
    - contextPath: RecordedFuture.Malware.metrics.type
      description: Recorded Future metrics type.
      type: string
    - contextPath: RecordedFuture.Malware.metrics.value
      description: Recorded Future metrics value.
      type: number
    - contextPath: RecordedFuture.Malware.intelCard
      description: Recorded Future intelligence card URL.
      type: date
    - contextPath: RecordedFuture.Malware.firstSeen
      description: Evidence first seen.
      type: date
    - contextPath: RecordedFuture.Malware.lastSeen
      description: Evidence last seen.
      type: date
    - contextPath: RecordedFuture.Malware.name
      description: Recorded Future entity name.
      type: date
    - contextPath: RecordedFuture.Malware.type
      description: Recorded Future entity type (always = "Malware").
      type: string
    - contextPath: RecordedFuture.Malware.id
      description: Recorded Future malware ID.
      type: string
    - contextPath: RecordedFuture.Malware.categories.id
      description: Recorded Future malware category ID.
      type: string
    - contextPath: RecordedFuture.Malware.categories.name
      description: Recorded Future malware category name.
      type: string
    - contextPath: RecordedFuture.Malware.categories.type
      description: Recorded Future malware category type (always = "MalwareCategory").
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedAttacker.count
      description: Recorded Future related attacker count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedAttacker.id
      description: Recorded Future related attacker ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedAttacker.name
      description: Recorded Future related attacker name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedAttacker.type
      description: Recorded Future related attacker type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedTarget.count
      description: Recorded Future related target count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedTarget.id
      description: Recorded Future related target ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedTarget.name
      description: Recorded Future related target name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedTarget.type
      description: Recorded Future related target type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedThreatActor.count
      description: Recorded Future related threat actor count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedThreatActor.id
      description: Recorded Future related threat actor ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedThreatActor.name
      description: Recorded Future related threat actor name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedThreatActor.type
      description: Recorded Future related threat actor type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedMalware.count
      description: Recorded Future related malware count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedMalware.id
      description: Recorded Future related malware ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedMalware.name
      description: Recorded Future related malware name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedMalware.type
      description: Recorded Future related malware type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCyberVulnerability.count
      description: Recorded Future related vulnerability count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCyberVulnerability.id
      description: Recorded Future related vulnerability ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCyberVulnerability.name
      description: Recorded Future related vulnerability name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCyberVulnerability.type
      description: Recorded Future related vulnerability type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedIpAddress.count
      description: Recorded Future related IP address count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedIpAddress.id
      description: Recorded Future related IP address ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedIpAddress.name
      description: Recorded Future related IP address name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedIpAddress.type
      description: Recorded Future related IP address type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedInternetDomainName.count
      description: Recorded Future related domain name count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedInternetDomainName.id
      description: Recorded Future related domain name ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedInternetDomainName.name
      description: Recorded Future related domain name name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedInternetDomainName.type
      description: Recorded Future related domain name type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedProduct.count
      description: Recorded Future related product count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedProduct.id
      description: Recorded Future related product ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedProduct.name
      description: Recorded Future related product name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedProduct.type
      description: Recorded Future related product type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCountries.count
      description: Recorded Future related countries count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCountries.id
      description: Recorded Future related countries ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCountries.name
      description: Recorded Future related countries name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCountries.type
      description: Recorded Future related countries type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedHash.count
      description: Recorded Future related hash count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedHash.id
      description: Recorded Future related hash ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedHash.name
      description: Recorded Future related hash name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedHash.type
      description: Recorded Future related hash type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedTechnology.count
      description: Recorded Future related technology count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedTechnology.id
      description: Recorded Future related technology ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedTechnology.name
      description: Recorded Future related technology name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedTechnology.type
      description: Recorded Future related technology type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedEmailAddress.count
      description: Recorded Future related email address count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedEmailAddress.id
      description: Recorded Future related email address ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedEmailAddress.name
      description: Recorded Future related email address name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedEmailAddress.type
      description: Recorded Future related email address type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedAttackVector.count
      description: Recorded Future related attack vector count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedAttackVector.id
      description: Recorded Future related attack vector ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedAttackVector.name
      description: Recorded Future related attack vector name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedAttackVector.type
      description: Recorded Future related attack vector type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedMalwareCategory.count
      description: Recorded Future related malware category count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedMalwareCategory.id
      description: Recorded Future related malware category ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedMalwareCategory.name
      description: Recorded Future related malware category name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedMalwareCategory.type
      description: Recorded Future related malware category type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedOperations.count
      description: Recorded Future related operations count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedOperations.id
      description: Recorded Future related operations ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedOperations.name
      description: Recorded Future related operations name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedOperations.type
      description: Recorded Future related operations type.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCompany.count
      description: Recorded Future related company count.
      type: number
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCompany.id
      description: Recorded Future related company ID.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCompany.name
      description: Recorded Future related company name.
      type: string
    - contextPath: RecordedFuture.Malware.relatedEntities.RelatedCompany.type
      description: Recorded Future related company type.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.context_entities.id
      description: Recorded Future analyst note context entity ID.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.context_entities.name
      description: Recorded Future analyst note context entity name.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.context_entities.type
      description: Recorded Future analyst note context entity type.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.note_entities.id
      description: Recorded Future analyst note entity ID.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.note_entities.name
      description: Recorded Future analyst note entity name.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.note_entities.type
      description: Recorded Future analyst note entity type.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.published
      description: Recorded Future analyst note publishing time.
      type: date
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.validated_on
      description: Recorded Future analyst note validation time.
      type: date
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.text
      description: Recorded Future analyst note content.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.title
      description: Recorded Future analyst note title.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.topic.description
      description: Recorded Future analyst note topic description.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.topic.id
      description: Recorded Future analyst note topic ID.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.topic.name
      description: Recorded Future analyst note topic name.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.topic.type
      description: Recorded Future analyst note topic type.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.validation_urls.id
      description: Recorded Future analyst note validation URL ID.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.validation_urls.name
      description: Recorded Future analyst note validation URL.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.attributes.validation_urls.type
      description: Recorded Future analyst note validation URL entity type.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.id
      description: Recorded Future analyst note ID.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.source.id
      description: Recorded Future analyst note source ID.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.source.name
      description: Recorded Future analyst note source name.
      type: string
    - contextPath: RecordedFuture.Malware.analystNotes.source.type
      description: Recorded Future analyst note source type.
      type: string

  - name: recordedfuture-links
    description: Get Insikt Group Research Links for an IP, Domain, CVE, URL, File, or Malware.
    arguments:
    - name: entity_type
      required: true
      description: The type of entity for which to fetch context. Should be provided with its value in entityValue argument. Can be "domain", "ip", "file", "url", "cve", or "malware".
      auto: PREDEFINED
      predefined:
      - domain
      - ip
      - file
      - url
      - cve
      - malware
    - name: entity
      required: true
      description: 'The value of the entity for which to fetch context. Should be provided with its type in entity_type argument. Supported hash types: MD5, SHA1, SHA256, SHA512, CRC32, and CTPH. Vulnerability supports CVEs.'
    outputs:
    - contextPath: RecordedFuture.Links.category
      description: Recorded Future links category.
      type: String
    - contextPath: RecordedFuture.Links.type
      description: Recorded Future links type.
      type: String
    - contextPath: RecordedFuture.Links.lists.entity_type
      description: Recorded Future links entity list type.
      type: String
    - contextPath: RecordedFuture.Links.lists.entities.type
      description: Recorded Future link entity type.
      type: String
    - contextPath: RecordedFuture.Links.lists.entities.name
      description: Recorded Future link entity name.
      type: String
    - contextPath: RecordedFuture.Links.lists.entities.score
      description: Recorded Future link entity risk score.
      type: Number

  - name: recordedfuture-single-alert
    description: 'Get detailed information from vulnerability, typosquat and credential alerts. Deprecated in favor of "Recorded Future Alerts" integration in "Recorded Future" pack.'
    deprecated: true
    arguments:
    - name: id
      description: Alert ID.
      required: true
    outputs:
    - contextPath: RecordedFuture.SingleAlert.id
      description: Recorded Future alert ID.
      type: string
    - contextPath: RecordedFuture.SingleAlert.flat_entities.fragment
      description: Recorded Future fragment of the entity.
      type: string
    - contextPath: RecordedFuture.SingleAlert.flat_entities.name
      description: Recorded Future name of the entity.
      type: string
    - contextPath: RecordedFuture.SingleAlert.flat_entities.type
      description: Recorded Future type of the entity.
      type: string
    - contextPath: RecordedFuture.SingleAlert.flat_entities.id
      description: Recorded Future ID of the entity.
      type: string

  - name: recordedfuture-alerts
    description: |-
      Gets details on alerts configured and generated by Recorded Future by alert rule ID and/or time range.
      
      Deprecated: use rf-alerts from "Recorded Future Alerts" integration in "Recorded Future" pack instead.
    deprecated: true
    arguments:
    - name: rule_id
      description: Alert rule ID.
    - name: limit
      description: Maximum number of alerts to return. Default is 10.
      defaultValue: "10"
    - name: triggered_time
      description: 'Alert triggered time, e.g., "1 hour" or "2 days".'
    - name: assignee
      description: 'Alert assignee''s email address.'
    - name: status
      auto: PREDEFINED
      predefined:
      - unassigned
      - assigned
      - pending
      - actionable
      - no-action
      - tuning
      description: 'Alert review status. Can be "unassigned", "assigned", "pending", "actionable", "no-action", or "tuning".'
    - name: freetext
      description: Free text search.
    - name: offset
      description: Alerts from offset.
    - name: orderby
      auto: PREDEFINED
      predefined:
      - triggered
      description: Alerts sort order.
    - name: direction
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: The direction by which to sort alerts. Can be "asc" or "desc".
    outputs:
    - contextPath: RecordedFuture.Alert.id
      description: Alert ID.
      type: string
    - contextPath: RecordedFuture.Alert.name
      description: Alert name.
      type: string
    - contextPath: RecordedFuture.Alert.type
      description: Alert type.
      type: string
    - contextPath: RecordedFuture.Alert.triggered
      description: Alert triggered time.
      type: date
    - contextPath: RecordedFuture.Alert.status
      description: Alert status.
      type: string
    - contextPath: RecordedFuture.Alert.assignee
      description: Alert assignee.
      type: string
    - contextPath: RecordedFuture.Alert.rule
      description: Alert rule name.
      type: string

  - name: recordedfuture-alert-rules
    description: |-
      Search for alert rule IDs.
      
      Deprecated: use rf-alerts from "Recorded Future Alerts" integration in "Recorded Future" pack instead.
    deprecated: true
    arguments:
    - name: rule_name
      description: Rule name to search. Can be a partial name.
    - name: limit
      description: 'Maximum number of rules to return. Default is 10.'
      defaultValue: "10"
    outputs:
    - contextPath: RecordedFuture.AlertRule.id
      description: Alert rule ID.
      type: string
    - contextPath: RecordedFuture.AlertRule.name
      description: Alert rule name.
      type: string

  - name: recordedfuture-alert-set-status
    description: |-
      Set alert into predefined status.
      
      Deprecated: use rf-alert-update from "Recorded Future Alerts" integration in "Recorded Future" pack instead.
    deprecated: true
    arguments:
    - name: alert_id
      required: true
      description: Alert id.
    - name: status
      required: true
      auto: PREDEFINED
      predefined:
      - unassigned
      - assigned
      - pending
      - dismiss
      - no-action
      - actionable
      - tuning
      description: The status we want to set for the alert in Recorded Future.
    outputs:
    - contextPath: RecordedFuture.Alerts.id
      description: Recorded Future alert ID.
      type: String
    - contextPath: RecordedFuture.Alerts.status
      description: Recorded Future alert status.
      type: String
    - contextPath: RecordedFuture.Alerts.note.text
      description: Recorded Future alert note text.
      type: String
    - contextPath: RecordedFuture.Alerts.note.author
      description: Recorded Future alert note author.
      type: String
    - contextPath: RecordedFuture.Alerts.note.date
      description: Recorded Future alert note date.
      type: date
    - contextPath: RecordedFuture.Alerts.reviewDate
      description: Recorded Future alert get date.
      type: date

  - name: recordedfuture-alert-set-note
    description: |-
      Set a note for the alert in Recorded Future.
      
      Deprecated: use rf-alert-update from "Recorded Future Alerts" integration in "Recorded Future" pack instead.
    deprecated: true
    arguments:
    - name: alert_id
      required: true
      description: Alert ID.
    - name: note
      required: true
      description: The note of the ID we want to set.
    outputs:
    - contextPath: RecordedFuture.Alerts.id
      description: Recorded Future alert ID.
      type: String
    - contextPath: RecordedFuture.Alerts.status
      description: Recorded Future alert status.
      type: String
    - contextPath: RecordedFuture.Alerts.note.text
      description: Recorded Future alert note text.
      type: String
    - contextPath: RecordedFuture.Alerts.note.author
      description: Recorded Future alert note author.
      type: String
    - contextPath: RecordedFuture.Alerts.note.date
      description: Recorded Future alert note date.
      type: date
    - contextPath: RecordedFuture.Alerts.reviewDate
      description: Recorded Future alert get date.
      type: date

  - name: recordedfuture-malware-search
    description: Search for a malware by specified filters.
    arguments:
    - name: freetext
      description: Part of malware name or ID to search for.
    - name: limit
      description: How many records to retrieve (default = 10).
    outputs:
    - contextPath: RecordedFuture.Malware.id
      description: Recorded Future malware ID.
      type: string
    - contextPath: RecordedFuture.Malware.name
      description: Recorded Future entity name.
      type: string
    - contextPath: RecordedFuture.Malware.type
      description: Recorded Future entity type (always = "Malware").
      type: string
    - contextPath: RecordedFuture.Malware.intelCard
      description: Recorded Future intelligence card URL.
      type: date

  - name: recordedfuture-threat-map
    description: Get threat actors map.
    arguments:
    - name: actors_ids
      isArray: true
      description: Actors IDs for which to get the threat map.
    - name: actor_name
      description: Actors name for which to get the threat map.
    - name: include_links
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Fetch links to threat actor or not.

    outputs:
    - contextPath: RecordedFuture.ThreatMap.id
      description: Recorded Future threat actor ID.
      type: string
    - contextPath: RecordedFuture.ThreatMap.name
      description: Recorded Future entity name.
      type: string
    - contextPath: RecordedFuture.ThreatMap.alias
      description: Recorded Future threat actor alias.
      type: array
    - contextPath: RecordedFuture.ThreatMap.intent
      description: Recorded Future threat actor intent.
      type: number
    - contextPath: RecordedFuture.ThreatMap.opportunity
      description: Recorded Future threat actor opportunity.
      type: number
    - contextPath: RecordedFuture.ThreatMap.log_entries
      description: Recorded Future threat actor log entries.
      type: array
    - contextPath: RecordedFuture.ThreatMap.links
      description: Recorded Future threat actor links by type.
      type: string

  - name: recordedfuture-threat-links
    description: Search links.
    arguments:
    - name: entity_type
      description: Type of the entity to fetch links for. E.g. "domain", "ip", "file", "url", "cve", "malware", "organization, "person". Should be provided along with the entity in entity_name argument.
      auto: PREDEFINED
      predefined:
      - IpAddress
      - URL
      - InternetDomainName
      - Hash
      - CyberVulnerability
      - CyberThreatActorCategory
      - AttackVector
      - Company
      - FileContent
      - Malware
      - MalwareCategory
      - MalwareSignature
      - MitreAttackIdentifier
      - Organization
      - Person
      - Username
    - name: entity_name
      description: Name of the entity to fetch links for.
    - name: entity_id
      description: ID of entity to fetch links for.
    - name: source_type
      description: Source of the links to be fetched. Can be "insikt" or "technical".
      auto: PREDEFINED
      predefined:
      - technical
      - insikt
    - name: timeframe
      description: Time range of the links to be fetched. Eg. "-1d" for last 1 day.
    - name: technical_type
      description: Type of technical source to fetch links from. Can be "type:MalwareAnalysis", "type:InfrastructureAnalysis", "type:NetworkTrafficAnalysis" or "type:TTPAnalysis".
    outputs:
    - contextPath: RecordedFuture.Links.entity.id
      description: Recorded Future Entity id.
      type: String
    - contextPath: RecordedFuture.Links.entity.type
      description: Recorded Future Entity type.
      type: String
    - contextPath: RecordedFuture.Links.links.type
      description: Recorded Future link type.
      type: String
    - contextPath: RecordedFuture.Links.links.id
      description: Recorded Future link id.
    - contextPath: RecordedFuture.Links.links.name
      description: Recorded Future link name.
    - contextPath: RecordedFuture.Links.links.source
      description: Recorded Future link source.
    - contextPath: RecordedFuture.Links.links.section
      description: Recorded Future link section.
    - contextPath: RecordedFuture.Links.links.attributes
      description: Recorded Future link attributes.

  - name: recordedfuture-detection-rules
    description: Search detection rules.
    arguments:
    - name: entity_type
      description: The type of entity for which to fetch context. Should be provided with its value in entity name argument. Can be "domain", "ip", "file", "url", "cve", or "malware".
      auto: PREDEFINED
      predefined:
      - IpAddress
      - URL
      - InternetDomainName
      - Hash
      - CyberVulnerability
      - CyberThreatActorCategory
      - AttackVector
      - Company
      - FileContent
      - Malware
      - MalwareCategory
      - MalwareSignature
      - MitreAttackIdentifier
      - Organization
      - Person
      - Username
    - name: entity_name
      description: Entity name.
    - name: entity_id
      description: Entity id.
    - name: rule_types
      isArray: true
      description: Rule type.
      auto: PREDEFINED
      predefined:
      - yara
      - sigma
      - snort
    - name: title
      description: Rule title.
    outputs:
    - contextPath: RecordedFuture.DetectionRules.id
      description: Recorded Future Detection rule id.
      type: String
    - contextPath: RecordedFuture.DetectionRules.type
      description: Recorded Future Detection rule type.
      type: String
    - contextPath: RecordedFuture.DetectionRules.title
      description: Recorded Future Detection rule title.
      type: String
    - contextPath: RecordedFuture.DetectionRules.description
      description: Recorded Future Detection rule description.
      type: String
    - contextPath: RecordedFuture.DetectionRules.created
      description: Recorded Future Detection rule created at.
      type: String
    - contextPath: RecordedFuture.DetectionRules.updated
      description: Recorded Future Detection rule updated at.
      type: String
    - contextPath: RecordedFuture.DetectionRules.rules
      description: Recorded Future Detection rules.
      type: array
    - contextPath: RecordedFuture.DetectionRules.rules.entities
      description: Recorded Future Detection rule entities.
      type: array
    - contextPath: RecordedFuture.DetectionRules.rules.entities.id
      description: Recorded Future Detection rule entity id.
      type: String
    - contextPath: RecordedFuture.DetectionRules.rules.entities.type
      description: Recorded Future Detection rule entity type.
      type: String
    - contextPath: RecordedFuture.DetectionRules.rules.entities.name
      description: Recorded Future Detection rule entity name.
      type: String
    - contextPath: RecordedFuture.DetectionRules.rules.content
      description: Recorded Future Detection rules content.
      type: String
    - contextPath: RecordedFuture.DetectionRules.rules.file_name
      description: Recorded Future Detection rules file_name.
      type: String

  - name: recordedfuture-collective-insight
    description: Post detection to collective insight.
    arguments:
    - name: entity_type
      required: true
      description: Value that can contain one of the enumerated list of values (ip, hash, domain, vulnerability, url).
      auto: PREDEFINED
      predefined:
      - ip
      - hash
      - domain
      - vulnerability
      - url
    - name: entity_name
      required: true
      description: Value of the IOC itself.
    - name: entity_field
      description: Used to describe characteristics about the IOC.
    - name: entity_source_type
      description: Used to describe what log source the IOC came from.
    - name: incident_name
      description: Title of the incident related to the IOC.
    - name: incident_id
      description: ID of the incident related to the IOC.
    - name: incident_type
      description: Attack vector associated with the incident (C2, Phishing.. etc).
    - name: mitre_codes
      description: List contains one or more MITRE codes associated with the IOC.
      isArray: true
    - name: malware
      description: List contains all known malware associated with the IOCs.
      isArray: true
    outputs:
    - contextPath: RecordedFuture.CollectiveInsight.status
      description: Request status.
      type: String

  isfetch: true
  runonce: false
tests:
- No tests
fromversion: 5.0.0
defaultclassifier: Recorded Future - Classifier
defaultmapperin: Recorded Future - Incoming Mapper