Add entity to list
Action ID:tools.recorded_future.add_entity_to_list
Add an entity to the list listId. Calls POST /list/{listId}/entity/add directly.
Reference: https://docs.recordedfuture.com/reference/lists-add-entity
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
object
required
Entity to add, given either as {“id”: “<entity id>”} or as {“type”: “<entity type>”, “name”: “<entity name>”}. Different lists have different limitations in terms of entity types, some lists have no limitations in terms of entity types, consult the specific list you are trying to update.
string
required
Id of list or named watch list.
string | null
Base URL of the Recorded Future API.Default:
null.object | null
Context to store with the list entry.Default:
null.Enrich indicators
Action ID:tools.recorded_future.enrich_indicators
Returns risk score and risk rules for the submitted indicators. Handles both individual and batch lookups up to 1000 IOCs per request. Calls POST /soar/v3/enrichment directly.
Reference: https://docs.recordedfuture.com/reference/soar-enrich
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string | null
Base URL of the Recorded Future API.Default:
null.array[string] | null
Company domains to enrich.Default:
null.array[string] | null
Domains to enrich.Default:
null.array[string] | null
Hashes to enrich.Default:
null.array[string] | null
IP addresses to enrich.Default:
null.boolean | null
Annotates the response with additional metadata explaining the response data elements.Default:
null.array[string] | null
URLs to enrich.Default:
null.array[string] | null
Vulnerabilities to enrich.Default:
null.Get alert
Action ID:tools.recorded_future.get_alert
Fetch an alert by id. Calls GET /alert/v3/{alert_id} directly.
Reference: https://docs.recordedfuture.com/reference/alerts-get-by-id
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string
required
Id of alert to fetch.
string | null
Base URL of the Recorded Future API.Default:
null.string | null
Fields to include in the response. If no specific fields are requested, all available fields are included in the response. Values should be separated by comma. Available fields are ai_insights, enriched_entities, hits, id, log, owner_organisation_details, review, rule, title, triggered_by, type and url.Default:
null.boolean | null
Include text tags.Default:
null.Get list entities
Action ID:tools.recorded_future.get_list_entities
Get entities on the list listId. Calls GET /list/{listId}/entities directly.
Reference: https://docs.recordedfuture.com/reference/lists-entities
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string
required
Id of list or named watch list.
string | null
Base URL of the Recorded Future API.Default:
null.Get playbook alert
Action ID:tools.recorded_future.get_playbook_alert
Returns a Playbook Alert representation containing only properties shared between all alert types. Calls GET /playbook-alert/common/{playbook_alert_id} directly.
Reference: https://docs.recordedfuture.com/reference/playbook-alerts-preview
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string
required
The unique id of a specific Playbook Alert.
string | null
Base URL of the Recorded Future API.Default:
null.List alert hits
Action ID:tools.recorded_future.list_alert_hits
Returns only a flat array of all hits (the Intelligence Cloud data that caused the alert to trigger) for one or several alerts. Calls GET /alert/v3/hits directly.
Reference: https://docs.recordedfuture.com/reference/alerts-get-hits
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string
required
Alert ids separated by comma.
string | null
Base URL of the Recorded Future API.Default:
null.boolean | null
Include text tags.Default:
null.List triage contexts
Action ID:tools.recorded_future.list_triage_contexts
Lookup all available risk contexts. Calls GET /soar/v3/triage/contexts directly.
Reference: https://docs.recordedfuture.com/reference/soar-get-contexts
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string | null
Base URL of the Recorded Future API.Default:
null.Lookup analyst note
Action ID:tools.recorded_future.lookup_analyst_note
Lookup a specific Analyst Note. Calls POST /analyst-note/lookup/{note_id} directly.
Reference: https://docs.recordedfuture.com/reference/analyst-note-lookup
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string
required
Note id.
string | null
Base URL of the Recorded Future API.Default:
null.boolean | null
Determines if HTML tags are escaped, applied only when tagged_text is true and tagged_text_format is html.Default:
null.string | null
Entity serialization level. When set to id, only the entity id will be included. Setting it to min leads to the id and name being included and setting it to full means that each entity will have the id, name, type, isThreatActor flag and possibly a description included in the response. Allowed values are id, min and full.Default:
null.boolean | null
Determines if the <entity></entity> tags should be inline with entities in the note title and text.Default:
null.string | null
Output format for inline tags when tagged_text is true. Allowed values are html and markdown. Recorded Future defaults to html.Default:
null.Lookup company
Action ID:tools.recorded_future.lookup_company
Lookup a Company entity by id. Calls GET /v2/company/{id} directly.
Reference: https://docs.recordedfuture.com/reference/company-lookup
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string
required
Company entity id.
string | null
Base URL of the Recorded Future API.Default:
null.string | null
The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See https://docs.recordedfuture.com/reference/enrichment-field-attributes for a list of values.Default:
null.boolean | null
Annotates the response with additional metadata explaining the response data elements.Default:
null.boolean | null
Enable or disable entity tags in text fragments.Default:
null.Lookup company by domain
Action ID:tools.recorded_future.lookup_company_by_domain
Retrieve a company by a domain it owns. Calls GET /v2/company/by_domain/{domain} directly.
Reference: https://docs.recordedfuture.com/reference/company-lookup-by-domain
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string
required
Domain owned by Company.
string | null
Base URL of the Recorded Future API.Default:
null.string | null
The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See https://docs.recordedfuture.com/reference/enrichment-field-attributes for a list of values.Default:
null.boolean | null
Annotates the response with additional metadata explaining the response data elements.Default:
null.Lookup domain
Action ID:tools.recorded_future.lookup_domain
Lookup a Domain entity by id. Calls GET /v2/domain/{id} directly.
Reference: https://docs.recordedfuture.com/reference/domain-lookup
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string
required
Domain entity id.
string | null
Base URL of the Recorded Future API.Default:
null.string | null
The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See https://docs.recordedfuture.com/reference/enrichment-field-attributes for a list of values.Default:
null.boolean | null
Annotates the response with additional metadata explaining the response data elements.Default:
null.boolean | null
Enable or disable entity tags in text fragments.Default:
null.Lookup entity
Action ID:tools.recorded_future.lookup_entity
Lookup entity by its ID. Calls GET /entity-match/entity/{id} directly.
Reference: https://docs.recordedfuture.com/reference/entity-lookup
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string
required
Entity ID.
string | null
Base URL of the Recorded Future API.Default:
null.Lookup hash
Action ID:tools.recorded_future.lookup_hash
Lookup a Hash entity by id. Calls GET /v2/hash/{id} directly.
Reference: https://docs.recordedfuture.com/reference/hash-lookup
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string
required
Hash entity id.
string | null
Base URL of the Recorded Future API.Default:
null.string | null
The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See https://docs.recordedfuture.com/reference/enrichment-field-attributes for a list of values.Default:
null.boolean | null
Annotates the response with additional metadata explaining the response data elements.Default:
null.boolean | null
Enable or disable entity tags in text fragments.Default:
null.Lookup IP
Action ID:tools.recorded_future.lookup_ip
Lookup a IP address entity by id. Calls GET /v2/ip/{id} directly.
Reference: https://docs.recordedfuture.com/reference/ip-lookup
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string
required
IP address entity id.
string | null
Base URL of the Recorded Future API.Default:
null.string | null
The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See https://docs.recordedfuture.com/reference/enrichment-field-attributes for a list of values.Default:
null.boolean | null
Annotates the response with additional metadata explaining the response data elements.Default:
null.boolean | null
Enable or disable entity tags in text fragments.Default:
null.Lookup malware
Action ID:tools.recorded_future.lookup_malware
Lookup a Malware entity by id. Calls GET /v2/malware/{id} directly.
Reference: https://docs.recordedfuture.com/reference/malware-lookup
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string
required
Malware entity id.
string | null
Base URL of the Recorded Future API.Default:
null.string | null
The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See https://docs.recordedfuture.com/reference/enrichment-field-attributes for a list of values.Default:
null.boolean | null
Annotates the response with additional metadata explaining the response data elements.Default:
null.boolean | null
Enable or disable entity tags in text fragments.Default:
null.Lookup URL
Action ID:tools.recorded_future.lookup_url
Lookup a URL entity by id. Calls GET /v2/url/{id} directly.
Reference: https://docs.recordedfuture.com/reference/url-lookup
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string
required
URL entity id.
string | null
Base URL of the Recorded Future API.Default:
null.string | null
The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See https://docs.recordedfuture.com/reference/enrichment-field-attributes for a list of values.Default:
null.boolean | null
Annotates the response with additional metadata explaining the response data elements.Default:
null.boolean | null
Enable or disable entity tags in text fragments.Default:
null.Lookup vulnerability
Action ID:tools.recorded_future.lookup_vulnerability
Lookup a Vulnerability entity by id. Calls GET /v2/vulnerability/{id} directly.
Reference: https://docs.recordedfuture.com/reference/vulnerability-lookup
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string
required
Vulnerability entity id.
string | null
Base URL of the Recorded Future API.Default:
null.string | null
The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See https://docs.recordedfuture.com/reference/enrichment-field-attributes for a list of values.Default:
null.boolean | null
Annotates the response with additional metadata explaining the response data elements.Default:
null.boolean | null
Enable or disable entity tags in text fragments.Default:
null.Match entities
Action ID:tools.recorded_future.match_entities
Match entities by name and (optionally) type. Calls POST /entity-match/match directly.
Reference: https://docs.recordedfuture.com/reference/entity-match
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string
required
Entity name to match for.
string | null
Base URL of the Recorded Future API.Default:
null.integer | null
Number of entities to include in the response. The maximum is 100 and Recorded Future defaults to 10.Default:
null.array[string] | null
Entity types to match for.Default:
null.Publish analyst note
Action ID:tools.recorded_future.publish_analyst_note
Publish an Analyst Note from a JSON object. Calls POST /analyst-note/publish directly.
Reference: https://docs.recordedfuture.com/reference/analyst-note-publish
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string
required
Note text. Sent as attributes.text.
string
required
Note title. Sent as attributes.title.
string | null
Base URL of the Recorded Future API.Default:
null.array[string] | null
Entity ids. Context entities or note entities must be specified. Each entity must exist as a note entity. Sent as attributes.context_entities.Default:
null.array[string] | null
Entity ids for detection rules. Sent as attributes.detection_rules.Default:
null.boolean | null
Determines if HTML tags are escaped, applied only when tagged_text is true.Default:
null.array[string] | null
Entity ids for the note labels. Sent as attributes.labels.Default:
null.array[string] | null
Entity ids. Either note entities or context entities must be specified. Each entity must exist as a note entity. Sent as attributes.note_entities.Default:
null.string | null
The id of an existing note to edit.Default:
null.boolean | null
Determines if the entity resolver should be used on the note title and text for automated tagging of entities. Recorded Future defaults to true.Default:
null.string | null
Entity serialization level. When set to id, only the entity id will be included. Setting it to min leads to the id and name being included and setting it to full means that each entity will have the id, name, type, isThreatActor flag and possibly a description included in the response. Allowed values are id, min and full.Default:
null.string | null
Entity id for note source.Default:
null.boolean | null
Determines if the <entity></entity> tags should be inline with entities in the note title and text.Default:
null.array[string] | null
Array of entity ids for the topics, see https://docs.recordedfuture.com/reference/analyst-note-available-topics for available ones. Sent as attributes.topic.Default:
null.string | null
Date when analyst note was validated. Sent as attributes.validated_on.Default:
null.Remove entity from list
Action ID:tools.recorded_future.remove_entity_from_list
Remove an entity from the list listId. Calls POST /list/{listId}/entity/remove directly.
Reference: https://docs.recordedfuture.com/reference/lists-remove-entity
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
object
required
Entity to remove, given either as {“id”: “<entity id>”} or as {“type”: “<entity type>”, “name”: “<entity name>”}.
string
required
Id of list or named watch list.
string | null
Base URL of the Recorded Future API.Default:
null.Search alert rules
Action ID:tools.recorded_future.search_alert_rules
Search for alert rules based on a set of filters. Calls GET /alert/v2/rule directly.
Reference: https://docs.recordedfuture.com/reference/alerts-search-rules
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string | null
Base URL of the Recorded Future API.Default:
null.string | null
Filter by any text.Default:
null.integer | null
Maximum number of items to include. The maximum is 1000 and Recorded Future defaults to 10.Default:
null.boolean | null
Include text tags.Default:
null.Search alerts
Action ID:tools.recorded_future.search_alerts
Search for alerts based on a set of filters. Calls GET /alert/v3 directly.
Reference: https://docs.recordedfuture.com/reference/alerts-search
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string | null
Filter by alert rule id.Default:
null.string | null
Filter by a specific assigned user, using the email address associated with that user account, or use NONE to explicitly match against unassigned alerts.Default:
null.string | null
Base URL of the Recorded Future API.Default:
null.string | null
Sort direction based on the triggered timestamp. Allowed values are asc and desc.Default:
null.string | null
Fields to include in the response. If no specific fields are requested, all available fields are included in the response. Values should be separated by comma. Available fields are ai_insights, enriched_entities, hits, id, log, owner_organisation_details, review, rule, title, triggered_by, type and url.Default:
null.string | null
Filter by any text.Default:
null.integer | null
Offset search from previous result. The API may only return the first 1000 results, meaning that limit + from cannot exceed 1000.Default:
null.integer | null
Maximum number of items to include. The maximum is 1000 and Recorded Future defaults to 10.Default:
null.string | null
Sort order. The only allowed value is triggered.Default:
null.string | null
Filter by review status. Allowed values are New, Resolved, Pending, Dismissed and Flag for Tuning.Default:
null.boolean | null
Include text tags.Default:
null.string | null
The triggered time itself has millisecond precision, but can be searched for using parameters of higher granularity on the form [x, y], which is interpreted as beginning of x until end of y.Default:
null.Search analyst notes
Action ID:tools.recorded_future.search_analyst_notes
Search for published analyst notes, either from within the enterprise or from Insikt Group. Calls POST /analyst-note/search directly.
Reference: https://docs.recordedfuture.com/reference/analyst-note-search
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string | null
Base URL of the Recorded Future API.Default:
null.string | null
Entity id.Default:
null.boolean | null
Determines if HTML tags are escaped, applied only when tagged_text is true and tagged_text_format is html.Default:
null.string | null
Offset the result based on next_offset from a previous search response.Default:
null.string | null
Search string to match against note labels.Default:
null.integer | null
Maximum number of references from which notes are fetched, at most 1000. Recorded Future defaults to 10.Default:
null.string | null
Notes published after this date, absolute like 2024-01-01 or relative like -3d.Default:
null.string | null
Entity serialization level. When set to id, only the entity id will be included. Setting it to min leads to the id and name being included and setting it to full means that each entity will have the id, name, type, isThreatActor flag and possibly a description included in the response. Allowed values are id, min and full.Default:
null.string | null
Entity id for note source.Default:
null.boolean | null
Determines if the <entity></entity> tags should be inline with entities in the note title and text.Default:
null.string | null
Output format for inline tags when tagged_text is true. Allowed values are html and markdown. Recorded Future defaults to html.Default:
null.string | null
Search string to match against note titles.Default:
null.string | null
Topic entity id, see https://docs.recordedfuture.com/reference/analyst-note-available-topics for available ones.Default:
null.Search companies
Action ID:tools.recorded_future.search_companies
Search for Company entities based on a filter. Calls GET /v2/company/search directly.
Reference: https://docs.recordedfuture.com/reference/company-search
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string | null
Base URL of the Recorded Future API.Default:
null.string | null
The direction of the sorting by the orderBy parameter, ascending or descending. Allowed values are asc and desc.Default:
null.string | null
Filters for companies based on domicile. The expected value is a valid Entity ID for a country. The Entity Match API is available to lookup country Entity IDs.Default:
null.string | null
The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See https://docs.recordedfuture.com/reference/enrichment-field-attributes for a list of values.Default:
null.string | null
Filters entities based on the download of the first reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.Default:
null.string | null
Freetext.Default:
null.integer | null
Offsets the pagination of the request. Note that there is a limit of returning only the top 1000 results from a search, meaning if limit plus from exceeds 1000, this will result in a Bad Request message.Default:
null.string | null
Filters for companies based on industry. The expected value is a Industry ID.Default:
null.string | null
Filters entities based on the download of the latest reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.Default:
null.integer | null
Maximum number of records returned. The maximum is 1000.Default:
null.string | null
Filters entities based on presence in a single list. Requires the list ID, which can be found using the List API.Default:
null.boolean | null
Annotates the response with additional metadata explaining the response data elements.Default:
null.string | null
Sorts the search according to the chosen parameter. Results are sorted before pagination. Allowed values are created, modified, sixtydayshits, sevendayhits, criticality, riskscore, totalhits, firstseen, lastseen and rules.Default:
null.string | null
Filters for companies based on parent company. The expected value is a Company ID.Default:
null.string | null
Filters for companies based on a single risk rule. Valid rule IDs are listed by the GET /v2/company/riskrules endpoint.Default:
null.string | null
Filters entities based on risk score, e.g. on the form [20, 80] (20 <= risk score <= 80), [20,) (20 <= risk score), or [,90) (risk score < 90). ’[’ and ’]’ are inclusive while ’(’ and ’)’ are exclusive.Default:
null.Search detection rules
Action ID:tools.recorded_future.search_detection_rules
Search for detection rules based on the provided filter. Calls POST /detection-rule/search directly.
Reference: https://docs.recordedfuture.com/reference/detection-rules-search
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string | null
Base URL of the Recorded Future API.Default:
null.string | null
Only return rules created after this point in time. Sent as filter.created.after.Default:
null.string | null
Only return rules created before this point in time. Sent as filter.created.before.Default:
null.string | null
Document Identity. Sent as filter.doc_id.Default:
null.array[string] | null
Entity ids the detection rules are associated with. Sent as filter.entities.Default:
null.integer | null
Maximum number of detection rules to return. Recorded Future defaults to 10.Default:
null.string | null
An opaque string that was received as the next_offset in the previous call when paging. It identifies the next page with additional results that did not fit within the limit.Default:
null.boolean | null
Set this to true to get tagged entities in the text. Recorded Future defaults to false.Default:
null.string | null
Free text search on the Insikt Note title published with the detection rule. Sent as filter.title.Default:
null.array[string] | null
The types of detection rule to return. Allowed values are sigma, yara, snort, nuclei and suricata. Sent as filter.types.Default:
null.string | null
Only return rules updated after this point in time. Sent as filter.updated.after.Default:
null.string | null
Only return rules updated before this point in time. Sent as filter.updated.before.Default:
null.Search domains
Action ID:tools.recorded_future.search_domains
Search for Domain entities based on a filter. Calls GET /v2/domain/search directly.
Reference: https://docs.recordedfuture.com/reference/domain-search
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string | null
Base URL of the Recorded Future API.Default:
null.string | null
The direction of the sorting by the orderBy parameter, ascending or descending. Allowed values are asc and desc.Default:
null.string | null
The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See https://docs.recordedfuture.com/reference/enrichment-field-attributes for a list of values.Default:
null.string | null
Filters entities based on the download of the first reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.Default:
null.integer | null
Offsets the pagination of the request. Note that there is a limit of returning only the top 1000 results from a search, meaning if limit plus from exceeds 1000, this will result in a Bad Request message.Default:
null.string | null
Filters entities based on the download of the latest reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.Default:
null.integer | null
Maximum number of records returned. The maximum is 1000.Default:
null.string | null
Filters entities based on presence in a single list. Requires the list ID, which can be found using the List API.Default:
null.boolean | null
Annotates the response with additional metadata explaining the response data elements.Default:
null.string | null
Sorts the search according to the chosen parameter. Results are sorted before pagination. Allowed values are created, modified, sixtydayshits, sevendayhits, criticality, riskscore, totalhits, firstseen, lastseen and rules.Default:
null.string | null
Filters for companies based on parent company. The expected value is a Company ID.Default:
null.string | null
Filters for domains based on a single risk rule. Valid rule IDs are listed by the GET /v2/domain/riskrules endpoint.Default:
null.string | null
Filters entities based on risk score, e.g. on the form [20, 80] (20 <= risk score <= 80), [20,) (20 <= risk score), or [,90) (risk score < 90). ’[’ and ’]’ are inclusive while ’(’ and ’)’ are exclusive.Default:
null.Search hashes
Action ID:tools.recorded_future.search_hashes
Search for Hash entities based on a filter. Calls GET /v2/hash/search directly.
Reference: https://docs.recordedfuture.com/reference/hash-search
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string | null
Filters hash entities based on hash algorithm. Allowed values are MD5, SHA-1, SHA-256, SHA-512, SSDEEP and SHA-384.Default:
null.string | null
Base URL of the Recorded Future API.Default:
null.string | null
The direction of the sorting by the orderBy parameter, ascending or descending. Allowed values are asc and desc.Default:
null.string | null
The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See https://docs.recordedfuture.com/reference/enrichment-field-attributes for a list of values.Default:
null.string | null
Filters entities based on the download of the first reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.Default:
null.integer | null
Offsets the pagination of the request. Note that there is a limit of returning only the top 1000 results from a search, meaning if limit plus from exceeds 1000, this will result in a Bad Request message.Default:
null.string | null
Filters entities based on the download of the latest reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.Default:
null.integer | null
Maximum number of records returned. The maximum is 1000.Default:
null.string | null
Filters entities based on presence in a single list. Requires the list ID, which can be found using the List API.Default:
null.boolean | null
Annotates the response with additional metadata explaining the response data elements.Default:
null.string | null
Sorts the search according to the chosen parameter. Results are sorted before pagination. Allowed values are created, modified, sixtydayshits, sevendayhits, criticality, riskscore, totalhits, firstseen, lastseen and rules.Default:
null.string | null
Filters for hashes based on a single risk rule. Valid rule IDs are listed by the GET /v2/hash/riskrules endpoint.Default:
null.string | null
Filters entities based on risk score, e.g. on the form [20, 80] (20 <= risk score <= 80), [20,) (20 <= risk score), or [,90) (risk score < 90). ’[’ and ’]’ are inclusive while ’(’ and ’)’ are exclusive.Default:
null.Search IP addresses
Action ID:tools.recorded_future.search_ips
Search for IP Address entities based on a filter. Calls GET /v2/ip/search directly.
Reference: https://docs.recordedfuture.com/reference/ip-search
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string | null
Base URL of the Recorded Future API.Default:
null.string | null
The direction of the sorting by the orderBy parameter, ascending or descending. Allowed values are asc and desc.Default:
null.string | null
The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See https://docs.recordedfuture.com/reference/enrichment-field-attributes for a list of values.Default:
null.string | null
Filters entities based on the download of the first reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.Default:
null.integer | null
Offsets the pagination of the request. Note that there is a limit of returning only the top 1000 results from a search, meaning if limit plus from exceeds 1000, this will result in a Bad Request message.Default:
null.string | null
Filters entities based on the download of the latest reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.Default:
null.integer | null
Maximum number of records returned. The maximum is 1000.Default:
null.string | null
Filters entities based on presence in a single list. Requires the list ID, which can be found using the List API.Default:
null.string | null
Filters for IPs based on location expressed as RF ID.Default:
null.boolean | null
Annotates the response with additional metadata explaining the response data elements.Default:
null.string | null
Sorts the search according to the chosen parameter. Results are sorted before pagination. Allowed values are created, modified, sixtydayshits, sevendayhits, criticality, riskscore, totalhits, firstseen, lastseen and rules.Default:
null.string | null
Range of IPs to search for, expressed as start-end or CIDR.Default:
null.string | null
Filters for IPs based on a single risk rule. Valid rule IDs are listed by the GET /v2/ip/riskrules endpoint.Default:
null.string | null
Filters entities based on risk score, e.g. on the form [20, 80] (20 <= risk score <= 80), [20,) (20 <= risk score), or [,90) (risk score < 90). ’[’ and ’]’ are inclusive while ’(’ and ’)’ are exclusive.Default:
null.Search links
Action ID:tools.recorded_future.search_links
Search for links related to one or more entities. The Entity Match API may be used to determine the ID for a certain entity. Calls POST /links/search directly.
Reference: https://docs.recordedfuture.com/reference/links-search
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
array[string]
required
IDs of entities to return links for. If more than one ID is provided, it is equivalent of calling this endpoint once for each, condensed into one call.
string | null
Base URL of the Recorded Future API.Default:
null.array[string] | null
Filter on entities linked to a link. Sent as filters.technical.connected_entities.Default:
null.array[string] | null
Only return these types of entities. Possible values are listed by the links metadata endpoint. Sent as filters.entity_types.Default:
null.array[string] | null
Filter on specific types of technical sources. Sent as filters.technical.events.Default:
null.integer | null
The maximum number of returned entities per type. Indicators are sorted by risk prior to filtering. Sent as limits.per_entity_type.Default:
null.string | null
Predefined levels of search depth. A larger scope may yield more linked entities, at the cost of increased latency. Allowed values are small, medium and large. Sent as limits.search_scope.Default:
null.array[string] | null
Only return links categorized under these sections. Possible values are listed by the links metadata endpoint. Sent as filters.sections.Default:
null.array[string] | null
Types of sources to use. Allowed values are technical and insikt. Sent as filters.sources.Default:
null.string | null
Time range for links from technical sources. As an ISO Date (2022-01-01) or relative to today (-7d). Maximum of 1825 days from today. Sent as filters.technical.timeframe.Default:
null.Search lists
Action ID:tools.recorded_future.search_lists
Find lists based on a query. Calls POST /list/search directly.
Reference: https://docs.recordedfuture.com/reference/lists-search
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string | null
Base URL of the Recorded Future API.Default:
null.integer | null
Maximum number of lists to return. The maximum is 100 and Recorded Future defaults to 25.Default:
null.string | null
Search string to match against list names.Default:
null.string | null
Type of list to search for. Allowed values are entity, source, text, custom, ip, domain, tech_stack, industry, brand, partner, industry_peer, location, supplier, vulnerability, company, hash, operation, attacker, target, method and executive. Recorded Future defaults to entity.Default:
null.Search playbook alerts
Action ID:tools.recorded_future.search_playbook_alerts
Searches for Playbook Alerts based on filtering conditions supplied in the body. Only Playbook Alerts matching all specified criteria are included in the response. Calls POST /playbook-alert/search directly.
Reference: https://docs.recordedfuture.com/reference/playbook-alerts-search
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
array[string] | null
Return Playbook Alerts with this assignee. Valid assignees can be listed in /playbook-alert/metadata/assignees.Default:
null.string | null
Base URL of the Recorded Future API.Default:
null.array[string] | null
Return Playbook Alerts with this category. Allowed values are domain_abuse, malicious_sites, cyber_vulnerability, code_repo_leakage, third_party_risk, identity_novel_exposures, geopolitics_facility, dark_web and socmed_impersonation.Default:
null.string | null
Created at or after this point in time. Sent as created_range.from.Default:
null.string | null
Created before or at this point in time. Sent as created_range.until.Default:
null.string | null
Order results ascending or descending. Allowed values are asc and desc.Default:
null.array[string] | null
Entity of the alert (ID). For Domain Abuse alerts the entity is the attacker domain and for Vulnerability Alerts the entity is the CVE.Default:
null.integer | null
Pagination limit, show items up to this limit. Offset + limit cannot exceed 10 000.Default:
null.string | null
Allows pagination by using next_offset from previous search response.Default:
null.string | null
Order results by created or modified data. Allowed values are created and modified.Default:
null.array[string] | null
Return Playbook Alerts with either of the organisations as owner.Default:
null.array[string] | null
Return Playbook Alerts with this priority. Allowed values are High, Moderate and Informational. If omitted or empty, all priorities will be selected.Default:
null.array[string] | null
Return Playbook Alerts with this status. Allowed values are New, InProgress, Dismissed and Resolved. If omitted or empty, all statuses will be selected.Default:
null.string | null
Updated at or after this point in time. Sent as updated_range.from.Default:
null.string | null
Updated before or at this point in time. Sent as updated_range.until.Default:
null.Search risk history
Action ID:tools.recorded_future.search_risk_history
Search for risk history of score, criticality and risk rules for entities for a specific date range. The response includes actual risks (when removed date is absent) and historical risks (when removed date is in requested date range). Calls POST /risk/history directly.
Reference: https://docs.recordedfuture.com/reference/risk-search-risk-history
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
array[string]
required
Entity ids to return risk history for.
string | null
Base URL of the Recorded Future API.Default:
null.string | null
Default value is minus 30 days from the to date or current date if the to date is missing.Default:
null.string | null
Default value is plus 30 days from the from date or current date if the from date is missing.Default:
null.Search URLs
Action ID:tools.recorded_future.search_urls
Search for URL entities based on a filter. Calls GET /v2/url/search directly.
Reference: https://docs.recordedfuture.com/reference/url-search
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string | null
Base URL of the Recorded Future API.Default:
null.string | null
The direction of the sorting by the orderBy parameter, ascending or descending. Allowed values are asc and desc.Default:
null.string | null
The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See https://docs.recordedfuture.com/reference/enrichment-field-attributes for a list of values.Default:
null.string | null
Filters entities based on the download of the first reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.Default:
null.string | null
Freetext.Default:
null.integer | null
Offsets the pagination of the request. Note that there is a limit of returning only the top 1000 results from a search, meaning if limit plus from exceeds 1000, this will result in a Bad Request message.Default:
null.string | null
Filters entities based on the download of the latest reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.Default:
null.integer | null
Maximum number of records returned. The maximum is 1000.Default:
null.string | null
Filters entities based on presence in a single list. Requires the list ID, which can be found using the List API.Default:
null.boolean | null
Annotates the response with additional metadata explaining the response data elements.Default:
null.string | null
Sorts the search according to the chosen parameter. Results are sorted before pagination. Allowed values are created, modified, sixtydayshits, sevendayhits, criticality, riskscore, totalhits, firstseen, lastseen and rules.Default:
null.string | null
Filters for URLs based on a single risk rule. Valid rule IDs are listed by the GET /v2/url/riskrules endpoint.Default:
null.string | null
Filters entities based on risk score, e.g. on the form [20, 80] (20 <= risk score <= 80), [20,) (20 <= risk score), or [,90) (risk score < 90). ’[’ and ’]’ are inclusive while ’(’ and ’)’ are exclusive.Default:
null.Search vulnerabilities
Action ID:tools.recorded_future.search_vulnerabilities
Search for Vulnerability entities based on a filter. Calls GET /v2/vulnerability/search directly.
Reference: https://docs.recordedfuture.com/reference/vulnerability-search
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string | null
Base URL of the Recorded Future API.Default:
null.string | null
Filters for vulnerabilities based on affected products using the CPE identifier system.Default:
null.string | null
Filters for vulnerabilities based on CVSS score (from most trusted source), e.g. on the form [8.0, 9.0] (8.0 <= CVSS score <= 9.0).Default:
null.string | null
Filters for vulnerabilities based on CVSS v3 score, e.g. on the form [8.0, 9.0] (8.0 <= CVSS v3 score <= 9.0).Default:
null.string | null
The direction of the sorting by the orderBy parameter, ascending or descending. Allowed values are asc and desc.Default:
null.string | null
The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See https://docs.recordedfuture.com/reference/enrichment-field-attributes for a list of values.Default:
null.string | null
Filters entities based on the download of the first reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.Default:
null.string | null
Freetext.Default:
null.integer | null
Offsets the pagination of the request. Note that there is a limit of returning only the top 1000 results from a search, meaning if limit plus from exceeds 1000, this will result in a Bad Request message.Default:
null.string | null
Filters entities based on the download of the latest reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.Default:
null.integer | null
Maximum number of records returned. The maximum is 1000.Default:
null.string | null
Filters entities based on presence in a single list. Requires the list ID, which can be found using the List API.Default:
null.boolean | null
Annotates the response with additional metadata explaining the response data elements.Default:
null.string | null
Sorts the search according to the chosen parameter. Results are sorted before pagination. Allowed values are created, modified, sixtydayshits, sevendayhits, criticality, riskscore, totalhits, firstseen, lastseen and rules.Default:
null.string | null
RF ID of affected product.Default:
null.string | null
Filters for vulnerabilities based on a single risk rule. Valid rule IDs are listed by the GET /v2/vulnerability/riskrules endpoint.Default:
null.string | null
Filters entities based on risk score, e.g. on the form [20, 80] (20 <= risk score <= 80), [20,) (20 <= risk score), or [,90) (risk score < 90). ’[’ and ’]’ are inclusive while ’(’ and ’)’ are exclusive.Default:
null.Triage indicators
Action ID:tools.recorded_future.triage_indicators
Triage multiple IOC entities for a specific context with up to 1000 IOCs per request. Calls POST /soar/v3/triage/contexts/{context_name} directly.
Reference: https://docs.recordedfuture.com/reference/soar-triage-batch
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string
required
The context in which to evaluate the given entities. Available contexts can be fetched using the separate endpoint.
string | null
Base URL of the Recorded Future API.Default:
null.array[string] | null
Company domains to enrich.Default:
null.array[string] | null
Domains to enrich.Default:
null.string | null
Allows for an output format suitable for Splunk SOAR (previously Phantom) when set to phantom. If no value is given, the default format (used in the Enrichment endpoint) will be used.Default:
null.array[string] | null
Hashes to enrich.Default:
null.array[string] | null
IP addresses to enrich.Default:
null.boolean | null
Annotates the response with additional metadata explaining the response data elements.Default:
null.integer | null
Determines which risk score should be used to deem an entity risky. Each context has its own default value and depends on the context. Allowed values are 0 to 99.Default:
null.string | null
Determines if the set of entities are deemed risky if a single entity is above the threshold (max) or if all entities have to be above the threshold (min). The default is specified by the context but is max for all contexts currently defined.Default:
null.array[string] | null
URLs to enrich.Default:
null.array[string] | null
Vulnerabilities to enrich.Default:
null.Update alerts
Action ID:tools.recorded_future.update_alerts
Update the status, assignee or note of one or several alerts. Calls POST /alert/v2/update directly.
Reference: https://docs.recordedfuture.com/reference/alerts-update
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
array[object]
required
Alert updates, each given as {“id”: “<alert id>”} plus any of assignee (an id, uhash, username or email), statusInPortal (New, Resolved, Pending, Dismissed or Flag for Tuning) and note (new note text).
string | null
Base URL of the Recorded Future API.Default:
null.Update playbook alert
Action ID:tools.recorded_future.update_playbook_alert
Update a Playbook Alert. Generic alert properties like status, priority and assignee may be updated, or a log message may be appended. Calls PUT /playbook-alert/common/{playbook_alert_id} directly.
Reference: https://docs.recordedfuture.com/reference/playbook-alerts-update
Secrets
Required secrets:recorded_future: required valuesRECORDED_FUTURE_API_KEY.
Input fields
string
required
The unique id of a specific Playbook Alert.
array[string] | null
The ids for the types of action taken. The possible values can be found in the response from /playbook-alert/metadata/common in the actions_by_category field. Can only be set when status is set to Dismissed or Resolved.Default:
null.string | null
ID of the assignee.Default:
null.string | null
Base URL of the Recorded Future API.Default:
null.string | null
Freetext log message. Maximum of 5000 characters.Default:
null.string | null
The priority of the Playbook Alert. Allowed values are High, Moderate and Informational.Default:
null.array[string] | null
The ids for the types of action taken that should be removed. The possible values can be found in the response from /playbook-alert/metadata/common in the actions_by_category field.Default:
null.string | null
Reopen strategies can only be applied to alerts with a status of Dismissed or Resolved. Allowed combinations of status and reopen are Dismissed with Never, Resolved with Never, and Resolved with SignificantUpdates.Default:
null.string | null
The status of the Playbook Alert. Allowed values are New, InProgress, Dismissed and Resolved.Default:
null.