category: Data Enrichment & Threat Intelligence provider: Mastercard commonfields: id: RecordedFutureAlerts version: -1 image: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAAyCAYAAACXpx/YAAAAAXNSR0IArs4c6QAAC6NJREFUeAHtmH9wVNUVx+97+3Y3i0lIgOFnQiCEgEZQxB8EZyQwSrFVK85UOk5bq7VUpyJii7VOtRlFbRSdsSgF/QNELfUHrTqOtaAmtGIFxaFgtEACwfyAqCGJZLPJ7r73+jkvu0s2pomMg7Qz983c3HvPOff8+J5zf2yU0p9GQCOgEdAIaAQ0AhoBjYBGQCOgEdAIaAQ0AhoBjYBGQCOgEdAIaAQ0AhoBjYBGQCOgEdAIaAQEgZvfn6qWvJunwfj/QMA8ITdv3j7RDAQ2+6zQOrXsndAJrdXCpwSBwRN8YUWWKinP9Lwz3FGGofJdQ01RbXGPNvSmf+SqJfuDp8R7bXRQBIwBJQp/NdTIynlJ+cxu90jtVWrRkjMMZe9QpqpzbfecQNweHQ8GXlRuvNLJnrFUlRtOf/oKCwuHDhkyJEN4XV1dTjAYbK+uro72J/tN0AoKCmZgJ+PQoUP/PAF7PtZd5PP5Gg8cOLCv97opU6ZkEVPIcZwUnhJnTU1NG3Kx3rLf9Nga0GDQPxL+bGUbMeUfOUoZpq1cu2dJlPQGY6cbVrDEicZt1fJXP4zufvRl2ra9KRKJTAQA4ZudnZ3tEyZMWFNXV7eeudvPmpNKsixrMT6NwciVJ2AoZJrmPbRXWVORXFdSUpJJMtfGYrFZ0Lz4Xdc1+KLEuJwY/5aUTfZFRUWT4F8AJn9paGiIJOknox84waYl4MeV4cY944GAIsWG48RJ5qekJstVjpfwHn7/HvoJRgLaGI/H/wxAAcQW0j82adKkQ7W1tW/1v+ykUmWnpXbb17FEHBJfIbG9StE8Q3J9og+aTSGl7fSknWg0Wgrvt5wGldBOYYKTHkkfsvwq3FKrglnPGK7/oLt6a6daduVXAgkQvGA5st5PqHxv4sSJ8wlyLvNTkWAp3BM6OfLy8qSS+11DUh0SWsNu3JGIb8AOWdETpSC8HT+g8NdkfmkHFxUtCR4bErSad68Mp+n2B0y1atYXJRvm3+iPbI7uVMpRzhVfeqSN59FVOCp+rKp87kC7WsCyAcbb/hxZQYK9yO/3j6a63+NY+3fSNsfc6IyMjNnMg/B2Ju8/1mRTIHPQkQH97wcPHmyWNXL8UVBd0IV/LtfC23v37j0IvYT5Wey0XdDS3gqcJPmBQGA2azpFFzbaE/Yt3g+z8GtMd3f3HvievwnegB0FXMAOtSjqWhEkjgz0TMXOR+FwWOxn4ufl48ePb/rkk0+2FxcXj+WYb03GIUc/V9kk5tX4novvufjQDhZlYHVg3759740bN244b5s56LGIq4rTkGM1/UtP8FkrxtUagScQyVVF9/5QOdy9ya/ViKu3FkzZ44TWuc53G1VlzXVqk3U84OE7Yr6lH1xx2B+qOBy23ywpr76turwkmlwOOPmTJ08+XaqXQK6CPp7+NQLPwbm1OFlM30R/F0HfR9BP5efnn4fcBgKzWN8B7zSCXUSAR2nP0sZAj0K30fMTCmM7tLugnUkOTfTFGH8G2OdCX0U7iv1WaMPpd4tv8C5B9iF8+RT5LHjLsPvT+vr6OngPIHIt9puQ/4I2gXY8ZlHQ88mlW8QjrJT14k81CbkVeyPKy8uvpTnonwr9eXQtFBlaLglfjO1G7DRj+xFUvU5bKSopgnORfxydF6P7W9zzd7CmhfU59GvwMUIBPYnebnoXPXdAW4zfyVNS1PAe7v256hzD8n+bh1OpCvnPVDb3b/JryIizZ2e4oUApj66rVKB7lFKB4zuBIFxTXeKEMqc6VEB19FhuYqkYdwhgMY79kX4HDl3N+AaqU460GwmkCPo8ds53EL0f/t3Tp0/PA6Tb4TXwGJkNfza8HzGvZ+3dNIvdNof1pQD5MfSVpaWl8ts8A14BtOXov5AdswfaCkDaSLWfDyA/gy9HpDFt2rRchveydhM7bT40uTI6WXMLoMuO/gHtF9iWxD1COw1+2ifgQpAEL2T8KLpWICeFZ0EL8GvBu8bg+aAFE73c0w3E9z18vJqdWktsolveJ97HXDZfgN7Avg+9k4npZRJ/PmseY+398D+mqMvYuXORe5+C+QNXybAeDT1/03dwZ/Nm5YxZbpq+HMf4/A1OEZLovRmUKowEVGbra1ZH4N64pQ6rxpo6ZYXP4nLu0VRWafmjsVUqcszkJHvHDrz+WcKQgXMGPyMepfqew5Gnobfg2EvCB4QSWjvBn4dzPoLJBODstra2CYCRj8hzR44cSep6lx0cRH4GAW5ER4PoYMdvoFtNlY+EJ4Bv4QR4U3gAko/tISIP2B2QPuRI3oofI1paWkbBG8nYxvYCbCtsdzMvoC+mgOoB9VV56Y4dO3Yzsh/jZwIQ0c49Y9uSQB6ezmqOzMfw28VOmNNKEiq+pL6+c/A4vkF6iqS3vFc4shj8fNjZj3/rmpubw/KzkziLoB0QvxnLGyCO/tNJchZLjiaNpie4ZpVYXJmyWlJ+fIefxm6ftf2LuHp8da6yIq3qFVstNbzq9JRNi/i6V82VV+PPk8p79QLA51RaPUCtALyXcPJidixFpCTufIK4HBkfjkrlV5Cs/ZmZmXI0Hz9FEKbafQAthZGisy7O3CWJHviskUR6n+wYBvLbO3W0QrJZ4/GRNVk7C9pYsU+Te+w56AW0OH6lQJe5t+jLfwSHyLZt244lWVLU6HK5S90XXnhB/PUMoiOFWe8x64Segj4hbyRkmBqd3L/elYle2TQOPDaYtwOlmCxot4RCocNJH6RPT3BvTt+xa8XUmSvyDTNc1Wa5+9UHZZdRWimH+or3neOAB35TU1Mlya3C4TuRqaTJz4S9/NNhSe818ihhjY3To3vTeYxE2Z1hqrkgSadgJiIbZ0d0CBKMUyCSuGOSuI6OjnHI8zbkPw+x2AjpqfZuxCXZT2F/k9CSH/YXwRuBrhxobYzlqMoR9UmZPn3KptDxrwO9JevXr5djt4t1crr4uW46KEQR8eGHlzB2ZTenSgR5ObG8D9/ymEv1dwlBYmLu2eBkiZJs2bWvc7pU9Kzo/+9XTzAFqVxnpGG5hUTI7+DskOIw7l9tGlWckmQljzab4B8A+Ld4QFzBMfM0403cefII2kzwk5EvJrFLif9lxsvgtTL/DP4Ckvs4/RrmvycJchTJf4tuJ/gndu/e/SlAyX/MUj8/sLsP2a3QVsIbw9opjC+DvoWk1qP7NYCq4JiXZB7B/nzkd4DhFvwKw3sCOxvpF7BuOryN9KkvAbpcG2lYYudFZBciuBa779AvRbaSR9Ah9GXBG0JhPojdrYxfZv06ZB6SWJGTR9cvoT3f2Nh4FJoUSUbClmKTdELbwLrb0CVvnI/wdQ4y7cOGDavYuXOnVzjM+zyyhNL765YHhBGkBVSMBNvKcW3H7Xl8BV1lwLfEtknC+/+4IyIA9ycC/jApQZK24fzvqFKL8dvwrsHZ8cx/jcyltB08emLIPCIN3kKCuIm+DeAPkphnkbkV3jwCWwQYD3Ef3yf6sbWZVilj+aDL7lkGbQv99TS5BnhnmPIfpjhH/h3M12L7+7Tl0IZiaxeJaGLN9ciFsXEDMrsY3wX/X7TUl52dLfG9Qgy7UkQG2N1O92NaDvquS8jIKRWHJ7ISz1B0Xwovl3ifxsZt0C6kyK5h/CQnUjlysN090J9nnPqnCA+th5n/BrmLE7gVI/c2yU1dRfAH+W9O3rKQOXzUfZzytmPk3qm6ms/mlY3jZp3rtM5U864MmP6slcqNbXMePnuNKPw6H/eVvDpTP6166fLNnDnT7F2ZCZ6cDvJOSAuq17q0YVlZmVVVVfXf7lETG75+bIgOOX2+ko00g4nJIHb7LjmhmGTxALgNkuC+ps+45wIzI+NdV7n1rhE5R+0s/7yviJ7/byGQdm8M6pqvc5/r+N8wXGOvazW1DyqvBTQCGgGNgEZAI6AR0AhoBDQCGgGNgEZAI6AR0AhoBDQCGgGNgEZAI6AR0AhoBDQCGgGNgEZAI6AROCkI/Adox/h1F7lx8wAAAABJRU5ErkJggg== sectionorder: - Connect - Collect configuration: - display: Fetch incidents name: isFetch type: 8 required: false section: Collect - display: Incident type name: incidentType type: 13 required: false section: Collect - defaultvalue: https://api.recordedfuture.com/gw/xsoar/ display: Your server URL name: url required: true type: 0 section: Connect - name: credentials type: 9 displaypassword: API KEY hiddenusername: true required: true section: Connect - name: integrationReliability display: 'Source Reliability' defaultvalue: B - Usually reliable options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged type: 15 required: false additionalinfo: Reliability of the source providing the intelligence data. section: Collect - display: Incidents fetch interval defaultvalue: '1' name: incidentFetchInterval type: 19 required: false section: Collect - display: Maximum number of incidents per fetch additionalinfo: 'The max number of incidents to fetch per run. Cannot be bigger than 50.' name: max_fetch defaultvalue: "25" type: 0 required: false section: Collect - display: 'First fetch time' additionalinfo: 'How far back we should fetch alerts on the first incident fetch. This value is not used for subsequent fetches. Cannot be bigger than 90 days.' defaultvalue: '1440' # 1 day name: first_fetch type: 19 required: false section: Collect - display: 'Enable Classic Alerts' name: classic_alerts_enabled type: 8 defaultvalue: 'true' required: false section: Collect - display: 'Classic Alerts: Rule names to fetch' name: classic_alert_rule_names type: 12 additionalinfo: 'Rule names to fetch alerts by, separated by semicolon. If empty, all alerts will be fetched.' required: false section: Collect - display: 'Classic Alerts: Statuses to fetch' name: classic_alert_statuses type: 16 defaultvalue: New options: - New - InProgress - Resolved - Dismissed required: true advanced: true section: Collect - display: 'Enable Playbook Alerts' name: playbook_alerts_enabled type: 8 defaultvalue: 'true' required: false section: Collect - display: 'Playbook Alerts: Priority to fetch' name: playbook_alert_priority type: 15 defaultvalue: Moderate additionalinfo: 'Fetch playbook alerts with this priority and higher' options: - Informational - Moderate - High required: false section: Collect - display: 'Playbook Alerts: Categories to fetch' name: playbook_alert_categories additionalinfo: 'Playbook Alert categories to filter by. If empty, all alerts will be fetched. Note that your Recorded Future licensing also affects which Playbook Alerts are available.' type: 16 defaultvalue: '' options: - domain_abuse - cyber_vulnerability - code_repo_leakage - third_party_risk - geopolitics_facility required: false section: Collect - display: 'Playbook Alerts: Statuses to fetch' name: playbook_alert_statuses type: 16 defaultvalue: New options: - New - InProgress - Resolved - Dismissed required: true advanced: true section: Collect - display: Trust any certificate (not secure) name: insecure required: false type: 8 section: Connect advanced: true - display: Use system proxy settings name: proxy required: false type: 8 section: Connect advanced: true description: 'Fetch and triage alerts from Recorded Future.' display: Recorded Future Alerts name: RecordedFutureAlerts script: commands: - name: rf-alert-images description: Fetch alert images. arguments: [] outputs: - contextPath: Files description: Image files. type: unknown - name: rf-alert-rules description: Search for alert rule IDs. arguments: - name: rule_name description: Rule name to search. Can be a partial name. - name: limit description: 'Maximum number of rules to return. Default is 10.' defaultValue: "10" outputs: - contextPath: RecordedFutureAlerts.AlertRule.id description: Alert rule ID. type: string - contextPath: RecordedFutureAlerts.AlertRule.name description: Alert rule name. type: string - name: rf-alert-update description: Update an alert in the Recorded Future platform. arguments: - name: alert_id required: true description: ID of alert to update. - name: status description: New status to set for the alert. required: false auto: PREDEFINED predefined: - New - InProgress - Dismissed - Resolved - name: comment description: Add comment / Replace note. required: false - name: reopen description: 'Only for Playbook Alerts. Set the reopen strategy for the alert. Reopen on significant updates or keep the alert Resolved. Default: reopen on significant updates. Can only be used with status=Resolved.' required: false auto: PREDEFINED predefined: - never - significant_updates outputs: - contextPath: RecordedFutureAlerts.Alert.id description: Unique id of the alert in Recorded Future. type: string - contextPath: RecordedFutureAlerts.Alert.type description: Alert type (classic-alert / playbook-alert). type: string - contextPath: RecordedFutureAlerts.Alert.status description: Status of alert in Recorded Future. type: string - contextPath: RecordedFutureAlerts.Alert.comment description: Note (Classic) or comment (Playbook) that was just applied. type: string - name: rf-alert-lookup description: Look up a single Recorded Future alert by ID. Supports both Classic Alerts and Playbook Alerts. Returns full alert data including rule details, entities, AI insights, and Playbook Alert panel data. arguments: - name: alert_id required: true description: ID of the alert to look up. outputs: - contextPath: RecordedFutureAlerts.Alert.id description: Unique ID of the alert in Recorded Future. type: string - contextPath: RecordedFutureAlerts.Alert.title description: Title of the alert. type: string - contextPath: RecordedFutureAlerts.Alert.type description: Alert type (classic-alert / playbook-alert). type: string - contextPath: RecordedFutureAlerts.Alert.subtype description: Alert subtype / category. type: string - contextPath: RecordedFutureAlerts.Alert.status description: Current status of the alert. type: string - contextPath: RecordedFutureAlerts.Alert.created description: Timestamp when the alert was created (ex. "2025-05-17T16:06:00Z"). type: date - contextPath: RecordedFutureAlerts.Alert.updated description: Timestamp when the alert was last updated (ex. "2025-05-17T16:06:00Z"). For Classic Alerts this equals the created timestamp. type: date - contextPath: RecordedFutureAlerts.Alert.markdown description: Markdown-formatted summary of the alert details. type: string - contextPath: RecordedFutureAlerts.Alert.images description: List of image IDs attached to the alert. type: unknown - contextPath: RecordedFutureAlerts.Alert.classic_alert_rule_name description: (Classic Alert) Name of the alert rule that triggered this alert. type: string - contextPath: RecordedFutureAlerts.Alert.classic_alert_rule_id description: (Classic Alert) ID of the alert rule that triggered this alert. type: string - contextPath: RecordedFutureAlerts.Alert.portal_url description: (Classic Alert) URL to the alert in the Recorded Future portal. type: string - contextPath: RecordedFutureAlerts.Alert.ai_insights description: (Classic Alert) AI-generated insights summary for the alert. type: string - contextPath: RecordedFutureAlerts.Alert.review.status description: (Classic Alert) Review status of the alert. type: string - contextPath: RecordedFutureAlerts.Alert.review.assignee description: (Classic Alert) User the alert is assigned to. type: string - contextPath: RecordedFutureAlerts.Alert.review.note description: (Classic Alert) Review note on the alert. type: string - contextPath: RecordedFutureAlerts.Alert.entities description: (Classic Alert) List of entities referenced in the alert. type: unknown - contextPath: RecordedFutureAlerts.Alert.fragments description: (Classic Alert) Text fragments from the alert hits. type: unknown - contextPath: RecordedFutureAlerts.Alert.documents description: (Classic Alert) Documents associated with alert hits. type: unknown - contextPath: RecordedFutureAlerts.Alert.analyst_notes description: (Classic Alert) URLs to analyst notes linked in the alert. type: unknown - contextPath: RecordedFutureAlerts.Alert.triggered_by description: (Classic Alert) List of entities / paths that triggered the alert. type: unknown - contextPath: RecordedFutureAlerts.Alert.playbook_alert_category description: (Playbook Alert) Category of the playbook alert. type: string - contextPath: RecordedFutureAlerts.Alert.playbook_alert_priority description: (Playbook Alert) Priority of the playbook alert. type: string - contextPath: RecordedFutureAlerts.Alert.entity_name description: (Playbook Alert) Name of the primary entity (e.g. domain, CVE). type: string - contextPath: RecordedFutureAlerts.Alert.targets description: (Playbook Alert) List of target names associated with the alert. type: unknown - contextPath: RecordedFutureAlerts.Alert.log_entries description: (Playbook Alert) Log entries associated with the alert. type: unknown - contextPath: RecordedFutureAlerts.Alert.log_entries.created description: (Playbook Alert) Timestamp when the log entry was created (ex. "2025-05-17T16:06:00Z"). type: date - contextPath: RecordedFutureAlerts.Alert.log_entries.author_name description: (Playbook Alert) Name of the log entry author. type: string - contextPath: RecordedFutureAlerts.Alert.log_entries.author_id description: (Playbook Alert) ID of the log entry author. type: string - contextPath: RecordedFutureAlerts.Alert.log_entries.changes description: (Playbook Alert) Raw log entry changes from the alert activity history. type: unknown - contextPath: RecordedFutureAlerts.Alert.details description: (Playbook Alert) Detailed panel data for the alert. Structure depends on the alert category. type: unknown - name: rf-alerts description: List Classic or Playbook alerts. arguments: - name: include_classic_alerts description: Whether we should include classic alerts in the response. Defaults to true. defaultValue: true auto: PREDEFINED predefined: - 'true' - 'false' - name: include_playbook_alerts description: Whether we should include playbook alerts in the response. Defaults to true. defaultValue: true auto: PREDEFINED predefined: - 'true' - 'false' - name: classic_alert_rule_ids description: Comma-separated Classic Alert Rule IDs. Only applied to Classic Alert search. isArray: true - name: playbook_alert_categories description: Comma-separated Playbook Alert categories (ex. 'domain_abuse,cyber_vulnerability,code_repo_leakage,third_party_risk,geopolitics_facility'). Only applied to Playbook Alert search. isArray: true auto: PREDEFINED predefined: - domain_abuse - cyber_vulnerability - code_repo_leakage - third_party_risk - geopolitics_facility - name: playbook_alert_priorities description: Comma-separated Playbook Alert priorities (ex. 'Informational,Moderate,High'). Only applied to Playbook Alert search. isArray: true auto: PREDEFINED predefined: - Informational - Moderate - High - name: statuses description: Comma-separated list of statuses to include (ex. 'New,InProgress,Resolved,Dismissed'). isArray: true auto: PREDEFINED predefined: - New - InProgress - Resolved - Dismissed - name: limit description: Maximum number of alerts to return. Default 10, maximum 50. defaultValue: "10" - name: order_by description: 'Field to sort by. Possible values are: created_at, updated_at. Default value is updated_at.' auto: PREDEFINED predefined: - created_at - updated_at - name: order_direction description: 'Direction to sort by. Possible values are: asc, desc. Default value is desc.' auto: PREDEFINED predefined: - asc - desc - name: created_from description: Return only alerts created on or after this datetime (ex. "2025-05-17T16:06:00Z"). required: false type: string - name: created_to description: Return only alerts created on or before this datetime (ex. "2025-05-17T16:06:00Z"). required: false type: string - name: updated_from description: Return only alerts updated on or after this datetime (ex. "2025-05-17T16:06:00Z"). required: false type: string - name: updated_to description: Return only alerts updated on or before this datetime (ex. "2025-05-17T16:06:00Z"). required: false type: string outputs: - contextPath: RecordedFutureAlerts.Alert.id description: Unique id of the alert in Recorded Future. type: string - contextPath: RecordedFutureAlerts.Alert.title description: Title of the alert. type: string - contextPath: RecordedFutureAlerts.Alert.type description: Alert type (classic-alert / playbook-alert). type: string - contextPath: RecordedFutureAlerts.Alert.subtype description: Alert subtype (domain_abuse / cyber_vulnerability / code_repo_leakage / third_party_risk / geopolitics_facility). type: string - contextPath: RecordedFutureAlerts.Alert.status description: Status of the alert. type: string - contextPath: RecordedFutureAlerts.Alert.created description: When the date was created as an ISO8601 string. type: string - contextPath: RecordedFutureAlerts.Alert.updated description: When the date was updated as an ISO8601 string. type: string - contextPath: RecordedFutureAlerts.Alert.classic_alert_rule_name description: If alert is a classic alert, this is the name of the rule that triggered the alert. type: string - contextPath: RecordedFutureAlerts.Alert.classic_alert_rule_id description: If alert is a classic alert, this is the name of the rule that triggered the alert. type: string - contextPath: RecordedFutureAlerts.Alert.playbook_alert_category description: If alert is a playbook alert, this is the category of the alert. type: string - contextPath: RecordedFutureAlerts.Alert.playbook_alert_priority description: If alert is a playbook alert, this is the priority of the alert. type: string isfetch: true runonce: false script: '-' type: python subtype: python3 dockerimage: demisto/python3:3.12.13.10116658 fromversion: 6.1.0 marketplaces: - xsoar - marketplacev2 - platform tests: - No tests (auto formatted) defaultclassifier: RF - Classifier defaultmapperin: RF - Incoming Mapper