category: Data Enrichment & Threat Intelligence
provider: Mastercard
commonfields:
  id: Recorded Future
  version: -1
configuration:
- defaultvalue: https://api.recordedfuture.com
  display: Server URL (e.g., https://api.recordedfuture.com)
  name: server
  required: true
  type: 0
- display: API Token
  name: token
  required: true
  type: 4
- defaultvalue: '5'
  display: Suspicious Threshold. Minimum risk score to consider an indicator suspicious.
  name: suspicious_threshold
  type: 0
  required: false
- defaultvalue: '65'
  display: File Threshold. Minimum risk score from Recorded Future to consider the file malicious.
  name: file_threshold
  type: 0
  required: false
- defaultvalue: '65'
  display: IP Threshold. Minimum risk score from RF to consider the IP malicious.
  name: ip_threshold
  type: 0
  required: false
- defaultvalue: '65'
  display: Domain Threshold. Minimum risk score from Recorded Future to consider the domain malicious.
  name: domain_threshold
  type: 0
  required: false
- defaultvalue: '65'
  display: URL Threshold. Minimum risk score from Recorded Future to consider the URL malicious.
  name: url_threshold
  type: 0
  required: false
- defaultvalue: '65'
  display: Vulnerability Threshold. Minimum risk score from Recorded Future to consider the vulnerability critical.
  name: cve_threshold
  type: 0
  required: false
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- defaultvalue: Global Trends, Trending Vulnerabilities;Global Trends, Trending Attackers
  display: Rule names to fetch alerts by, separated by semicolon. If empty, all alerts will be fetched
  name: rule_names
  type: 12
  required: false
- defaultvalue: 24 hours
  display: First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  name: triggered
  type: 0
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
description: Deprecated. Use Recorded Future v2 from RecordedFuture pack instead. Unique threat intel technology that automatically serves up relevant insights in real time.
display: Recorded Future (Deprecated)
name: Recorded Future
deprecated: true
script:
  commands:
  - arguments:
    - default: true
      description: Domain to get the reputation of
      name: domain
      required: true
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If true, fetches evidence details. Evidence is a record that is generated if any of the risk rules in Recorded Future is triggered.
      name: detailed
      predefined:
      - 'true'
      - 'false'
    description: Returns threat intelligence information for a domain or DNS in Recorded Future.
    name: domain
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: Domain.Name
      description: Domain name
      type: string
    - contextPath: Domain.RecordedFuture.Criticality
      description: Domain criticality label
      type: string
    - contextPath: Domain.RecordedFuture.FirstSeen
      description: Risk first seen timestamp
      type: date
    - contextPath: Domain.RecordedFuture.LastSeen
      description: Risk last seen timestamp
      type: date
    - contextPath: Domain.Tags
      description: Tags that are associated with the Domain.
      type: String
    - contextPath: Domain.CommunityNotes.note
      description: A summary note on the mentioning of the domain in a source monitored by Recorded Future.
      type: String
    - contextPath: Domain.CommunityNotes.timestamp
      description: The timestamp in which the community note was created.
      type: Date
    - contextPath: Domain.Publications.source
      description: The publication's source.
      type: String
    - contextPath: Domain.Publications.title
      description: The title of the published information.
      type: String
    - contextPath: Domain.Publications.link
      description: A link to the published information.
      type: String
    - contextPath: Domain.Publications.timestamp
      description: The timestamp in which the information was published.
      type: Date
  - arguments:
    - default: true
      description: IP address to get the reputation of
      name: ip
      required: true
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If true, fetches evidence details. Evidence is a record that is generated if any of the risk rules in Recorded Future is triggered.
      name: detailed
      predefined:
      - 'true'
      - 'false'
    description: Returns threat intelligence information for an IP address in Recorded Future.
    name: ip
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: IP.Malicious.Vendor
      description: For malicious IP addresses, the vendor that made the decision
      type: string
    - contextPath: IP.Malicious.Description
      description: For malicious IP addresses, the reason that the vendor made the decision
      type: string
    - contextPath: IP.Address
      description: IP address
      type: string
    - contextPath: IP.RecordedFuture.Criticality
      description: Risk criticality label
      type: string
    - contextPath: IP.RecordedFuture.FirstSeen
      description: Risk first seen timestamp
      type: date
    - contextPath: IP.RecordedFuture.LastSeen
      description: Risk last seen timestamp
      type: date
    - contextPath: IP.Tags
      description: Tags that are associated with the IP.
      type: String
    - contextPath: IP.CommunityNotes.note
      description: A summary note on the mentioning of the IP in a source monitored by Recorded Future.
      type: String
    - contextPath: IP.CommunityNotes.timestamp
      description: The timestamp in which the community note was created.
      type: Date
    - contextPath: IP.Publications.source
      description: The publication's source.
      type: String
    - contextPath: IP.Publications.title
      description: The title of the published information.
      type: String
    - contextPath: IP.Publications.link
      description: A link to the published information.
      type: String
    - contextPath: IP.Publications.timestamp
      description: The timestamp in which the information was published.
      type: Date
  - arguments:
    - default: true
      description: File hash to check the reputation of (MD5, SHA-1, SHA-256, SHA-512, CRC-32, CTPH)
      name: file
      required: true
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If true, fetches evidence details. Evidence is a record that is generated if any of the risk rules in Recorded Future is triggered.
      name: detailed
      predefined:
      - 'true'
      - 'false'
    description: Returns threat intelligence information for a file in Recorded Future.
    name: file
    outputs:
    - contextPath: File.SHA256
      description: File SHA-256
      type: string
    - contextPath: File.SHA512
      description: File SHA-512
      type: string
    - contextPath: File.SHA1
      description: File SHA-1
      type: string
    - contextPath: File.MD5
      description: File MD-5
      type: string
    - contextPath: File.CRC32
      description: File CRC-32
      type: string
    - contextPath: File.CTPH
      description: File CTPH
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the reason that the vendor made the decision
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: File.Criticality
      description: Risk criticality label
      type: string
    - contextPath: File.RecordedFuture.FirstSeen
      description: Risk first seen timestamp
      type: date
    - contextPath: File.RecordedFuture.LastSeen
      description: Risk last seen timestamp
      type: date
    - contextPath: File.Tags
      description: Tags that are associated with the file.
      type: String
    - contextPath: File.CommunityNotes.note
      description: A summary note on the mentioning of the file in a source monitored by Recorded Future.
      type: String
    - contextPath: File.CommunityNotes.timestamp
      description: The timestamp in which the community note was created.
      type: Date
    - contextPath: File.Publications.source
      description: The publication's source.
      type: String
    - contextPath: File.Publications.title
      description: The title of the published information.
      type: String
    - contextPath: File.Publications.link
      description: A link to the published information.
      type: String
    - contextPath: File.Publications.timestamp
      description: The timestamp in which the information was published.
      type: Date
  - arguments:
    - auto: PREDEFINED
      description: The type of entity to fetch context for. (Should be provided with its value in entityValue argument)
      name: entityType
      predefined:
      - domain
      - ip
      - file
      - url
      required: true
    - description: 'The value of the entity to fetch context for. (Should be provided with its type in entityType argument, Hash types supported: MD5, SHA-1, SHA-256, SHA-512, CRC-32, CTPH)'
      name: entityValue
      required: true
    - auto: PREDEFINED
      defaultValue: All
      description: CSV list of related entity types to return in the result (e.g., Hash,IP,Domain)
      name: resultEntityType
      predefined:
      - All
      - Hash
      - IP
      - Domain
      - Attacker
      - Malware
      - URL
    description: Returns threat intelligence context for an indicator in Recorded Future.
    name: recorded-future-get-related-entities
    outputs:
    - contextPath: File.SHA256
      description: File SHA-256
      type: string
    - contextPath: File.SHA512
      description: File SHA-512
      type: string
    - contextPath: File.SHA1
      description: File SHA-1
      type: string
    - contextPath: File.MD5
      description: File MD-5
      type: string
    - contextPath: File.CRC32
      description: File CRC-32
      type: string
    - contextPath: File.CTPH
      description: File CTPH
      type: string
    - contextPath: File.RecordedFuture.RelatedEntities.IPAddress.Count
      description: File related entity count (IP)
      type: number
    - contextPath: File.RecordedFuture.RelatedEntities.IPAddress.ID
      description: File related entity ID (IP)
      type: string
    - contextPath: File.RecordedFuture.RelatedEntities.IPAddress.Name
      description: File related entity name (IP)
      type: string
    - contextPath: File.RecordedFuture.RelatedEntities.Hash.Count
      description: File related entity count (Hash)
      type: number
    - contextPath: File.RecordedFuture.RelatedEntities.Hash.ID
      description: File related entity ID (Hash)
      type: string
    - contextPath: File.RecordedFuture.RelatedEntities.Hash.Name
      description: File related entity name (Hash)
      type: string
    - contextPath: File.RecordedFuture.RelatedEntities.Domain.Count
      description: File related entity count (Domain)
      type: number
    - contextPath: File.RecordedFuture.RelatedEntities.Domain.ID
      description: File related entity ID (Domain)
      type: string
    - contextPath: File.RecordedFuture.RelatedEntities.Domain.Name
      description: File related entity name (Domain)
      type: string
    - contextPath: File.RecordedFuture.RelatedEntities.Attacker.Count
      description: File related entity count (Attacker)
      type: number
    - contextPath: File.RecordedFuture.RelatedEntities.Attacker.ID
      description: File related entity ID (Attacker)
      type: string
    - contextPath: File.RecordedFuture.RelatedEntities.Attacker.Name
      description: File related entity name (Attacker)
      type: string
    - contextPath: File.RecordedFuture.RelatedEntities.Malware.Count
      description: File related entity count (Malware)
      type: number
    - contextPath: File.RecordedFuture.RelatedEntities.Malware.ID
      description: File related entity ID (Malware)
      type: string
    - contextPath: File.RecordedFuture.RelatedEntities.Malware.Name
      description: File related entity name (Malware)
      type: string
    - contextPath: File.RecordedFuture.RelatedEntities.URL.Count
      description: File related entity count (URL)
      type: number
    - contextPath: File.RecordedFuture.RelatedEntities.URL.ID
      description: File related entity ID (URL)
      type: string
    - contextPath: File.RecordedFuture.RelatedEntities.URL.Data
      description: File related entity name (URL)
      type: string
    - contextPath: IP.Address
      description: IP address
      type: string
    - contextPath: IP.RecordedFuture.RelatedEntities.IPAddress.Count
      description: IP related entity count (IP)
      type: number
    - contextPath: IP.RecordedFuture.RelatedEntities.IPAddress.ID
      description: IP related entity ID (IP)
      type: string
    - contextPath: IP.RecordedFuture.RelatedEntities.IPAddress.Name
      description: IP related entity name (IP)
      type: string
    - contextPath: IP.RecordedFuture.RelatedEntities.Hash.Count
      description: IP related entity count (Hash)
      type: number
    - contextPath: IP.RecordedFuture.RelatedEntities.Hash.ID
      description: IP related entity ID (Hash)
      type: string
    - contextPath: IP.RecordedFuture.RelatedEntities.Hash.Name
      description: IP related entity name (Hash)
      type: string
    - contextPath: IP.RecordedFuture.RelatedEntities.Domain.Count
      description: IP related entity count (Domain)
      type: number
    - contextPath: IP.RecordedFuture.RelatedEntities.Domain.ID
      description: IP related entity ID (Domain)
      type: string
    - contextPath: IP.RecordedFuture.RelatedEntities.Domain.Name
      description: IP related entity name (Domain)
      type: string
    - contextPath: IP.RecordedFuture.RelatedEntities.Attacker.Count
      description: IP related entity count (Attacker)
      type: number
    - contextPath: IP.RecordedFuture.RelatedEntities.Attacker.ID
      description: IP related entity ID (Attacker)
      type: string
    - contextPath: IP.RecordedFuture.RelatedEntities.Attacker.Name
      description: IP related entity name (Attacker)
      type: string
    - contextPath: IP.RecordedFuture.RelatedEntities.Malware.Count
      description: IP related entity count (Malware)
      type: number
    - contextPath: IP.RecordedFuture.RelatedEntities.Malware.ID
      description: IP related entity ID (Malware)
      type: string
    - contextPath: IP.RecordedFuture.RelatedEntities.Malware.Name
      description: IP related entity name (Malware)
      type: string
    - contextPath: IP.RecordedFuture.RelatedEntities.URL.Count
      description: IP related entity count (URL)
      type: number
    - contextPath: IP.RecordedFuture.RelatedEntities.URL.ID
      description: IP related entity ID (URL)
      type: string
    - contextPath: IP.RecordedFuture.RelatedEntities.URL.Data
      description: IP related entity name (URL)
      type: string
    - contextPath: Domain.Name
      description: Domain name
      type: string
    - contextPath: Domain.RecordedFuture.RelatedEntities.IPAddress.Count
      description: Domain related entity count (IP)
      type: number
    - contextPath: Domain.RecordedFuture.RelatedEntities.IPAddress.ID
      description: Domain related entity ID (IP)
      type: string
    - contextPath: Domain.RecordedFuture.RelatedEntities.IPAddress.Name
      description: Domain related entity name (IP)
      type: string
    - contextPath: Domain.RecordedFuture.RelatedEntities.Hash.Count
      description: Domain related entity count (Hash)
      type: number
    - contextPath: Domain.RecordedFuture.RelatedEntities.Hash.ID
      description: Domain related entity ID (Hash)
      type: string
    - contextPath: Domain.RecordedFuture.RelatedEntities.Hash.Name
      description: Domain related entity name (Hash)
      type: string
    - contextPath: Domain.RecordedFuture.RelatedEntities.Domain.Count
      description: Domain related entity count (Domain)
      type: number
    - contextPath: Domain.RecordedFuture.RelatedEntities.Domain.ID
      description: Domain related entity ID (Domain)
      type: string
    - contextPath: Domain.RecordedFuture.RelatedEntities.Domain.Name
      description: Domain related entity name (Domain)
      type: string
    - contextPath: Domain.RecordedFuture.RelatedEntities.Attacker.Count
      description: Domain related entity count (Attacker)
      type: number
    - contextPath: Domain.RecordedFuture.RelatedEntities.Attacker.ID
      description: Domain related entity ID (Attacker)
      type: string
    - contextPath: Domain.RecordedFuture.RelatedEntities.Attacker.Name
      description: Domain related entity name (Attacker)
      type: string
    - contextPath: Domain.RecordedFuture.RelatedEntities.Malware.Count
      description: Domain related entity count (Malware)
      type: number
    - contextPath: Domain.RecordedFuture.RelatedEntities.Malware.ID
      description: Domain related entity ID (Malware)
      type: string
    - contextPath: Domain.RecordedFuture.RelatedEntities.Malware.Name
      description: Domain related entity name (Malware)
      type: string
    - contextPath: Domain.RecordedFuture.RelatedEntities.URL.Count
      description: Domain related entity count (URL)
      type: number
    - contextPath: Domain.RecordedFuture.RelatedEntities.URL.ID
      description: Domain related entity ID (URL)
      type: string
    - contextPath: Domain.RecordedFuture.RelatedEntities.URL.Data
      description: Domain related entity name (URL)
      type: string
    - contextPath: URL.Data
      description: URL name
      type: string
    - contextPath: URL.RecordedFuture.RelatedEntities.IPAddress.Count
      description: URL related entity count (IP)
      type: number
    - contextPath: URL.RecordedFuture.RelatedEntities.IPAddress.ID
      description: URL related entity ID (IP)
      type: string
    - contextPath: URL.RecordedFuture.RelatedEntities.IPAddress.Name
      description: URL related entity name (IP)
      type: string
    - contextPath: URL.RecordedFuture.RelatedEntities.Hash.Count
      description: URL related entity count (Hash)
      type: number
    - contextPath: URL.RecordedFuture.RelatedEntities.Hash.ID
      description: URL related entity ID (Hash)
      type: string
    - contextPath: URL.RecordedFuture.RelatedEntities.Hash.Name
      description: URL related entity name (Hash)
      type: string
    - contextPath: URL.RecordedFuture.RelatedEntities.Domain.Count
      description: URL related entity count (Domain)
      type: number
    - contextPath: URL.RecordedFuture.RelatedEntities.Domain.ID
      description: URL related entity ID (Domain)
      type: string
    - contextPath: URL.RecordedFuture.RelatedEntities.Domain.Name
      description: URL related entity name (Domain)
      type: string
    - contextPath: URL.RecordedFuture.RelatedEntities.Attacker.Count
      description: URL related entity count (Attacker)
      type: number
    - contextPath: URL.RecordedFuture.RelatedEntities.Attacker.ID
      description: URL related entity ID (Attacker)
      type: string
    - contextPath: URL.RecordedFuture.RelatedEntities.Attacker.Name
      description: URL related entity name (Attacker)
      type: string
    - contextPath: URL.RecordedFuture.RelatedEntities.Malware.Count
      description: URL related entity count (Malware)
      type: number
    - contextPath: URL.RecordedFuture.RelatedEntities.Malware.ID
      description: URL related entity ID (Malware)
      type: string
    - contextPath: URL.RecordedFuture.RelatedEntities.Malware.Name
      description: URL related entity name (Malware)
      type: string
    - contextPath: URL.RecordedFuture.RelatedEntities.URL.Count
      description: URL related entity count (URL)
      type: number
    - contextPath: URL.RecordedFuture.RelatedEntities.URL.ID
      description: URL related entity ID (URL)
      type: string
    - contextPath: URL.RecordedFuture.RelatedEntities.URL.Data
      description: URL related entity name (URL)
      type: string
  - arguments:
    - default: true
      description: URL to get the reputation of
      name: url
      required: true
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If true, fetches evidence details. Evidence is a record that is generated if any of the risk rules in Recorded Future is triggered.
      name: detailed
      predefined:
      - 'true'
      - 'false'
    description: Returns threat intelligence information for a URL in Recorded Future.
    name: url
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: URL.Data
      description: URL name
      type: string
    - contextPath: URL.RecordedFuture.Criticality
      description: URL criticality label
      type: string
    - contextPath: URL.RecordedFuture.FirstSeen
      description: Risk first seen timestamp
      type: date
    - contextPath: URL.RecordedFuture.LastSeen
      description: Risk last seen timestamp
      type: date
    - contextPath: URL.Tags
      description: Tags that are associated with the URL.
      type: String
    - contextPath: URL.CommunityNotes.note
      description: A summary note on the mentioning of the URL in a source monitored by Recorded Future.
      type: String
    - contextPath: URL.CommunityNotes.timestamp
      description: The timestamp in which the community note was created.
      type: Date
    - contextPath: URL.Publications.source
      description: The publication's source.
      type: String
    - contextPath: URL.Publications.title
      description: The title of the published information.
      type: String
    - contextPath: URL.Publications.link
      description: A link to the published information.
      type: String
    - contextPath: URL.Publications.timestamp
      description: The timestamp in which the information was published.
      type: Date
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If true, fetches evidence details. Evidence is a record that is generated if any of the risk rules in Recorded Future is triggered.
      name: detailed
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '1'
      description: Number of results to return
      name: limit
    - defaultValue: '65'
      description: Minimum threshold score to return results for
      name: risk_lower
    - defaultValue: '99'
      description: Maximum threshold score to return results for
      name: risk_higher
    - auto: PREDEFINED
      defaultValue: sevendayshits
      description: Category to sort results by
      name: orderby
      predefined:
      - created
      - criticality
      - firstseen
      - lastseen
      - modified
      - riskscore
      - rules
      - sevendayshits
      - sixtydayshits
      - totalhits
    - description: Sort direction
      name: direction
    description: Returns hash threats from Recorded Future
    name: recorded-future-get-threats-hash
    outputs:
    - contextPath: File.SHA256
      description: File SHA-256
      type: string
    - contextPath: File.SHA512
      description: File SHA-512
      type: string
    - contextPath: File.SHA1
      description: File SHA-1
      type: string
    - contextPath: File.MD5
      description: File MD-5
      type: string
    - contextPath: File.CRC32
      description: File CRC-32
      type: string
    - contextPath: File.CTPH
      description: File CTPH
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the reason that the vendor made the decision
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: File.RecordedFuture.Criticality
      description: Risk criticality label
      type: string
    - contextPath: File.RecordedFuture.FirstSeen
      description: Risk first seen timestamp
      type: date
    - contextPath: File.RecordedFuture.LastSeen
      description: Risk last seen timestamp
      type: date
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If true, fetches evidence details. Evidence is a record that is generated if any of the risk rules in Recorded Future is triggered.
      name: detailed
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '1'
      description: Number of results to return
      name: limit
    - defaultValue: '65'
      description: Minimum threshold score to return results for
      name: risk_lower
    - defaultValue: '99'
      description: Maximum threshold score to return results for
      name: risk_higher
    - auto: PREDEFINED
      defaultValue: sevendayshits
      description: Category to sort by
      name: orderby
      predefined:
      - created
      - criticality
      - firstseen
      - lastseen
      - modified
      - riskscore
      - rules
      - sevendayshits
      - sixtydayshits
      - totalhits
    - auto: PREDEFINED
      description: Sort direction
      name: direction
      predefined:
      - asc
      - desc
    description: Returns IP threats from Recorded Future
    name: recorded-future-get-threats-ip
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: IP.Malicious.Vendor
      description: For malicious IP addresses, the vendor that made the decision
      type: string
    - contextPath: IP.Malicious.Description
      description: For malicious IP addresses, the reason that the vendor made the decision
      type: string
    - contextPath: IP.Address
      description: IP address
      type: string
    - contextPath: IP.RecordedFuture.Criticality
      description: Risk criticality label
      type: string
    - contextPath: IP.RecordedFuture.FirstSeen
      description: Risk first seen timestamp
      type: string
    - contextPath: IP.RecordedFuture.LastSeen
      description: Risk last seen timestamp
      type: date
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If true, fetches evidence details. Evidence is a record that is generated if any of the risk rules in Recorded Future is triggered.
      name: detailed
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '1'
      description: Number of results to return
      name: limit
    - defaultValue: '65'
      description: Minimum threshold score to return results for
      name: risk_lower
    - defaultValue: '99'
      description: Maximum threshold score to return results for
      name: risk_higher
    - auto: PREDEFINED
      defaultValue: sevendayshits
      description: Category to sort by
      name: orderby
      predefined:
      - created
      - criticality
      - firstseen
      - lastseen
      - modified
      - riskscore
      - rules
      - sevendayshits
      - sixtydayshits
      - totalhits
    - auto: PREDEFINED
      description: Sort direction
      name: direction
      predefined:
      - asc
      - desc
    description: Returns URL threats from Recorded Future
    name: recorded-future-get-threats-url
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: URL.Data
      description: URL name
      type: string
    - contextPath: URL.RecordedFuture.Criticality
      description: URL criticality label
      type: string
    - contextPath: URL.RecordedFuture.FirstSeen
      description: Risk first seen timestamp
      type: date
    - contextPath: URL.RecordedFuture.LastSeen
      description: Risk last seen timestamp
      type: date
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If true, fetches evidence details. Evidence is a record that is generated if any of the risk rules in Recorded Future is triggered.
      name: detailed
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '1'
      description: Limit number of results returned
      name: limit
    - defaultValue: '65'
      description: Minimum threshold score to return results for
      name: risk_lower
    - defaultValue: '99'
      description: Maximum threshold score to return results for
      name: risk_higher
    - auto: PREDEFINED
      defaultValue: sevendayshits
      description: Category to sort by
      name: orderby
      predefined:
      - created
      - criticality
      - firstseen
      - lastseen
      - modified
      - riskscore
      - rules
      - sevendayshits
      - sixtydayshits
      - totalhits
    - auto: PREDEFINED
      description: Sort direction
      name: direction
      predefined:
      - asc
      - desc
    description: Returns domain threats from Recorded Future
    name: recorded-future-get-threats-domain
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: Domain.Name
      description: Domain name
      type: string
    - contextPath: Domain.RecordedFuture.Criticality
      description: Domain criticality label
      type: string
    - contextPath: Domain.RecordedFuture.FirstSeen
      description: Risk first seen timestamp
      type: date
    - contextPath: Domain.RecordedFuture.LastSeen
      description: Risk last seen timestamp
      type: date
  - arguments:
    - defaultValue: '1'
      description: Number of results to return
      name: limit
    - defaultValue: '65'
      description: Minimum threshold score to return results for
      name: risk_lower
    - defaultValue: '99'
      description: Maximum threshold score to return results for
      name: risk_higher
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If true, fetches evidence details. Evidence is a record that is generated if any of the risk rules in Recorded Future is triggered.
      name: detailed
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      defaultValue: sevendayshits
      description: Category to sort by
      name: orderby
      predefined:
      - created
      - criticality
      - firstseen
      - lastseen
      - modified
      - riskscore
      - rules
      - sevendayshits
      - sixtydayshits
      - totalhits
    - auto: PREDEFINED
      description: Sort direction
      name: direction
      predefined:
      - asc
      - desc
    description: Returns vulnerability threats from Recorded Future.
    name: recorded-future-get-threats-vulnerabilities
    outputs:
    - contextPath: CVE.ID
      description: Vulnerability CVE ID
      type: string
    - contextPath: CVE.RecordedFuture.Criticality
      description: CVE criticality label
      type: string
    - contextPath: CVE.RecordedFuture.FirstSeen
      description: Risk first seen timestamp
      type: date
    - contextPath: CVE.RecordedFuture.LastSeen
      description: Risk last seen timestamp
      type: date
  - arguments:
    - description: Specify a domain list by a risk rule name, which can be retrieved by the get-domain-riskrules command.
      name: list
    description: Gets the domain risk list as a CSV file from Recorded Future.
    name: recorded-future-get-domain-risklist
    outputs:
    - contextPath: InfoFile.Name
      description: File name
      type: string
    - contextPath: InfoFile.EntryID
      description: The EntryID of the file
      type: string
    - contextPath: InfoFile.Size
      description: File size
      type: number
    - contextPath: InfoFile.Type
      description: File type, e.g., "PE"
      type: string
    - contextPath: InfoFile.Info
      description: Basic information of the file
      type: string
    - contextPath: InfoFile.Extension
      description: File extension
      type: string
  - arguments:
    - description: Specify a URL list by a risk rule name, which can be retrieved from the get-url-riskrules command.
      name: list
    description: Gets the URL risk list as a CSV file from Recorded Future.
    name: recorded-future-get-url-risklist
    outputs:
    - contextPath: InfoFile.Name
      description: File name
      type: string
    - contextPath: InfoFile.EntryID
      description: The EntryID of the file
      type: string
    - contextPath: InfoFile.Size
      description: File size
      type: number
    - contextPath: InfoFile.Type
      description: File type, e.g., "PE"
      type: string
    - contextPath: InfoFile.Info
      description: Basic information of the file
      type: string
    - contextPath: InfoFile.Extension
      description: File extension
      type: string
  - arguments:
    - description: Specify an IP list by a risk rule name, which can be retrieved from the get-ip-riskrules command.
      name: list
    description: Gets the IP risk list as a CSV file from Recorded Future.
    name: recorded-future-get-ip-risklist
    outputs:
    - contextPath: InfoFile.Name
      description: File name
      type: string
    - contextPath: InfoFile.EntryID
      description: The EntryID of the file
      type: string
    - contextPath: InfoFile.Size
      description: File size
      type: number
    - contextPath: InfoFile.Type
      description: File type, e.g., "PE"
      type: string
    - contextPath: InfoFile.Info
      description: Basic information of the file
      type: string
    - contextPath: InfoFile.Extension
      description: File extension
      type: string
  - arguments:
    - description: Specify a vulnerability list by a risk rule name, which can be retrieved from the get-vulnerability-riskrules command.
      name: list
    description: Gets the vulnerability (CVE) risk list from Recorded Future.
    name: recorded-future-get-vulnerability-risklist
    outputs:
    - contextPath: InfoFile.Name
      description: File name
      type: string
    - contextPath: InfoFile.EntryID
      description: File entry ID
      type: string
    - contextPath: InfoFile.Size
      description: File size
      type: number
    - contextPath: InfoFile.Type
      description: File type, e.g., "PE"
      type: string
    - contextPath: InfoFile.Info
      description: Basic information of the file
      type: string
    - contextPath: InfoFile.Extension
      description: File extension
      type: string
  - arguments:
    - description: Specify a hash list by a riskrule name, which can be retrieved from the get-hash-riskrules command.
      name: list
    description: Gets the hash risk list from Recorded Future.
    name: recorded-future-get-hash-risklist
    outputs:
    - contextPath: InfoFile.Name
      description: File name
      type: string
    - contextPath: InfoFile.EntryID
      description: File entry ID
      type: string
    - contextPath: InfoFile.Size
      description: File size
      type: number
    - contextPath: InfoFile.Type
      description: File type, e.g., "PE"
      type: string
    - contextPath: InfoFile.Info
      description: Basic information of the file
      type: string
    - contextPath: InfoFile.Extension
      description: File extension
      type: string
  - description: Gets the risk rules for domain data.
    name: recorded-future-get-domain-riskrules
    outputs:
    - contextPath: RecordedFuture.RiskRule.Domain.Name
      description: Risk rule name
      type: string
    - contextPath: RecordedFuture.RiskRule.Domain.Description
      description: Risk rule description
      type: string
    - contextPath: RecordedFuture.RiskRule.Domain.Count
      description: Risk rule indicator count
      type: number
    - contextPath: RecordedFuture.RiskRule.Domain.Criticality
      description: Risk rule criticality
      type: string
  - description: Gets the risk rules for hash data.
    name: recorded-future-get-hash-riskrules
    outputs:
    - contextPath: RecordedFuture.RiskRule.Hash.Name
      description: Risk rule name
      type: string
    - contextPath: RecordedFuture.RiskRule.Hash.Description
      description: Risk rule description
      type: string
    - contextPath: RecordedFuture.RiskRule.Hash.Count
      description: Risk rule indicator count
      type: number
    - contextPath: RecordedFuture.RiskRule.Hash.Criticality
      description: Risk rule criticality
      type: string
  - description: Gets the risk rules for IP data.
    name: recorded-future-get-ip-riskrules
    outputs:
    - contextPath: RecordedFuture.RiskRule.IP.Name
      description: Risk rule name
      type: string
    - contextPath: RecordedFuture.RiskRule.IP.Description
      description: Risk rule description
      type: string
    - contextPath: RecordedFuture.RiskRule.IP.Count
      description: Risk rule indicator count
      type: number
    - contextPath: RecordedFuture.RiskRule.IP.Criticality
      description: Risk rule criticality
      type: string
  - description: Gets the risk rules for URL data.
    name: recorded-future-get-url-riskrules
    outputs:
    - contextPath: RecordedFuture.RiskRule.URL.Name
      description: Risk rule name
      type: string
    - contextPath: RecordedFuture.RiskRule.URL.Description
      description: Risk rule description
      type: string
    - contextPath: RecordedFuture.RiskRule.URL.Count
      description: Risk rule indicator count
      type: number
    - contextPath: RecordedFuture.RiskRule.URL.Criticality
      description: Risk rule criticality
      type: string
  - description: Gets the risk rules for vulnerability data.
    name: recorded-future-get-vulnerability-riskrules
    outputs:
    - contextPath: RecordedFuture.RiskRule.Vulnerability.Name
      description: Risk rule name
      type: string
    - contextPath: RecordedFuture.RiskRule.Vulnerability.Description
      description: Risk rule description
      type: string
    - contextPath: RecordedFuture.RiskRule.Vulnerability.Count
      description: Risk rule indicator count
      type: number
    - contextPath: RecordedFuture.RiskRule.Vulnerability.Criticality
      description: Risk rule criticality
      type: string
  - arguments:
    - description: Rule name to search, can be a partial name
      name: rule_name
    - defaultValue: '10'
      description: Number of rules to return
      name: limit
    description: Gets Recorded Future alert rules.
    name: recorded-future-get-alert-rules
    outputs:
    - contextPath: RecordedFuture.AlertRule.ID
      description: Alert rule ID
      type: string
    - contextPath: RecordedFuture.AlertRule.Name
      description: Alert rule name
      type: string
  - arguments:
    - description: Alert rule ID
      name: rule_id
    - defaultValue: '10'
      description: Number of alerts to return
      name: limit
    - description: Alert triggered time, e.g., "1 hour" or "2 days"
      name: triggered_time
    - description: Alert assignee's email address
      name: assignee
    - auto: PREDEFINED
      description: Alert review status
      name: status
      predefined:
      - unassigned
      - assigned
      - actionable
      - no-action
      - tuning
    - description: Free text search
      name: freetext
    - description: Alerts from offset
      name: offset
    - auto: PREDEFINED
      description: Alerts sort order
      name: orderby
      predefined:
      - triggered
    - auto: PREDEFINED
      description: Alerts sort direction
      name: direction
      predefined:
      - asc
      - desc
    description: Gets alerts from Recorded Future.
    name: recorded-future-get-alerts
    outputs:
    - contextPath: RecordedFuture.Alert.ID
      description: Alert ID
      type: string
    - contextPath: RecordedFuture.Alert.Name
      description: Alert name
      type: string
    - contextPath: RecordedFuture.Alert.Type
      description: Alert type
      type: string
    - contextPath: RecordedFuture.Alert.Triggered
      description: Alert triggered time
      type: date
    - contextPath: RecordedFuture.Alert.Status
      description: Alert status
      type: string
    - contextPath: RecordedFuture.Alert.Assignee
      description: Alert assignee
      type: string
    - contextPath: RecordedFuture.Alert.Rule
      description: Alert rule name
      type: string
  isfetch: true
  runonce: false
  script: '-'
  subtype: python2
  type: python
  dockerimage: demisto/python:2.7.18.20958
tests:
- Recorded Future Test
fromversion: 5.0.0