> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Recorded Future

> Reference for the Tracecat Recorded Future integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Add entity to list

Action ID: `tools.recorded_future.add_entity_to_list`

Add an entity to the list listId. Calls POST /list/\{listId}/entity/add directly.

Reference: [https://docs.recordedfuture.com/reference/lists-add-entity](https://docs.recordedfuture.com/reference/lists-add-entity)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="entity" type="object" required>
  Entity to add, given either as \{"id": "\<entity id>"} or as \{"type": "\<entity type>", "name": "\<entity name>"}. Different lists have different limitations in terms of entity types, some lists have no limitations in terms of entity types, consult the specific list you are trying to update.
</ParamField>

<ParamField path="listId" type="string" required>
  Id of list or named watch list.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="context" type="object | null">
  Context to store with the list entry.

  Default: `null`.
</ParamField>

## Enrich indicators

Action ID: `tools.recorded_future.enrich_indicators`

Returns risk score and risk rules for the submitted indicators. Handles both individual and batch lookups up to 1000 IOCs per request. Calls POST /soar/v3/enrichment directly.

Reference: [https://docs.recordedfuture.com/reference/soar-enrich](https://docs.recordedfuture.com/reference/soar-enrich)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="companybydomain" type="array[string] | null">
  Company domains to enrich.

  Default: `null`.
</ParamField>

<ParamField path="domain" type="array[string] | null">
  Domains to enrich.

  Default: `null`.
</ParamField>

<ParamField path="hash" type="array[string] | null">
  Hashes to enrich.

  Default: `null`.
</ParamField>

<ParamField path="ip" type="array[string] | null">
  IP addresses to enrich.

  Default: `null`.
</ParamField>

<ParamField path="metadata" type="boolean | null">
  Annotates the response with additional metadata explaining the response data elements.

  Default: `null`.
</ParamField>

<ParamField path="url" type="array[string] | null">
  URLs to enrich.

  Default: `null`.
</ParamField>

<ParamField path="vulnerability" type="array[string] | null">
  Vulnerabilities to enrich.

  Default: `null`.
</ParamField>

## Get alert

Action ID: `tools.recorded_future.get_alert`

Fetch an alert by id. Calls GET /alert/v3/\{alert\_id} directly.

Reference: [https://docs.recordedfuture.com/reference/alerts-get-by-id](https://docs.recordedfuture.com/reference/alerts-get-by-id)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="alert_id" type="string" required>
  Id of alert to fetch.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="fields" type="string | null">
  Fields to include in the response. If no specific fields are requested, all available fields are included in the response. Values should be separated by comma. Available fields are ai\_insights, enriched\_entities, hits, id, log, owner\_organisation\_details, review, rule, title, triggered\_by, type and url.

  Default: `null`.
</ParamField>

<ParamField path="taggedText" type="boolean | null">
  Include text tags.

  Default: `null`.
</ParamField>

## Get list entities

Action ID: `tools.recorded_future.get_list_entities`

Get entities on the list listId. Calls GET /list/\{listId}/entities directly.

Reference: [https://docs.recordedfuture.com/reference/lists-entities](https://docs.recordedfuture.com/reference/lists-entities)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="listId" type="string" required>
  Id of list or named watch list.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

## Get playbook alert

Action ID: `tools.recorded_future.get_playbook_alert`

Returns a Playbook Alert representation containing only properties shared between all alert types. Calls GET /playbook-alert/common/\{playbook\_alert\_id} directly.

Reference: [https://docs.recordedfuture.com/reference/playbook-alerts-preview](https://docs.recordedfuture.com/reference/playbook-alerts-preview)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="playbook_alert_id" type="string" required>
  The unique id of a specific Playbook Alert.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

## List alert hits

Action ID: `tools.recorded_future.list_alert_hits`

Returns only a flat array of all hits (the Intelligence Cloud data that caused the alert to trigger) for one or several alerts. Calls GET /alert/v3/hits directly.

Reference: [https://docs.recordedfuture.com/reference/alerts-get-hits](https://docs.recordedfuture.com/reference/alerts-get-hits)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="ids" type="string" required>
  Alert ids separated by comma.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="taggedText" type="boolean | null">
  Include text tags.

  Default: `null`.
</ParamField>

## List triage contexts

Action ID: `tools.recorded_future.list_triage_contexts`

Lookup all available risk contexts. Calls GET /soar/v3/triage/contexts directly.

Reference: [https://docs.recordedfuture.com/reference/soar-get-contexts](https://docs.recordedfuture.com/reference/soar-get-contexts)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

## Lookup analyst note

Action ID: `tools.recorded_future.lookup_analyst_note`

Lookup a specific Analyst Note. Calls POST /analyst-note/lookup/\{note\_id} directly.

Reference: [https://docs.recordedfuture.com/reference/analyst-note-lookup](https://docs.recordedfuture.com/reference/analyst-note-lookup)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="note_id" type="string" required>
  Note id.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="escape_html" type="boolean | null">
  Determines if HTML tags are escaped, applied only when tagged\_text is true and tagged\_text\_format is html.

  Default: `null`.
</ParamField>

<ParamField path="serialization" type="string | null">
  Entity serialization level. When set to id, only the entity id will be included. Setting it to min leads to the id and name being included and setting it to full means that each entity will have the id, name, type, isThreatActor flag and possibly a description included in the response. Allowed values are id, min and full.

  Default: `null`.
</ParamField>

<ParamField path="tagged_text" type="boolean | null">
  Determines if the \<entity>\</entity> tags should be inline with entities in the note title and text.

  Default: `null`.
</ParamField>

<ParamField path="tagged_text_format" type="string | null">
  Output format for inline tags when tagged\_text is true. Allowed values are html and markdown. Recorded Future defaults to html.

  Default: `null`.
</ParamField>

## Lookup company

Action ID: `tools.recorded_future.lookup_company`

Lookup a Company entity by id. Calls GET /v2/company/\{id} directly.

Reference: [https://docs.recordedfuture.com/reference/company-lookup](https://docs.recordedfuture.com/reference/company-lookup)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Company entity id.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="fields" type="string | null">
  The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See [https://docs.recordedfuture.com/reference/enrichment-field-attributes](https://docs.recordedfuture.com/reference/enrichment-field-attributes) for a list of values.

  Default: `null`.
</ParamField>

<ParamField path="metadata" type="boolean | null">
  Annotates the response with additional metadata explaining the response data elements.

  Default: `null`.
</ParamField>

<ParamField path="taggedText" type="boolean | null">
  Enable or disable entity tags in text fragments.

  Default: `null`.
</ParamField>

## Lookup company by domain

Action ID: `tools.recorded_future.lookup_company_by_domain`

Retrieve a company by a domain it owns. Calls GET /v2/company/by\_domain/\{domain} directly.

Reference: [https://docs.recordedfuture.com/reference/company-lookup-by-domain](https://docs.recordedfuture.com/reference/company-lookup-by-domain)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="domain" type="string" required>
  Domain owned by Company.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="fields" type="string | null">
  The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See [https://docs.recordedfuture.com/reference/enrichment-field-attributes](https://docs.recordedfuture.com/reference/enrichment-field-attributes) for a list of values.

  Default: `null`.
</ParamField>

<ParamField path="metadata" type="boolean | null">
  Annotates the response with additional metadata explaining the response data elements.

  Default: `null`.
</ParamField>

## Lookup domain

Action ID: `tools.recorded_future.lookup_domain`

Lookup a Domain entity by id. Calls GET /v2/domain/\{id} directly.

Reference: [https://docs.recordedfuture.com/reference/domain-lookup](https://docs.recordedfuture.com/reference/domain-lookup)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Domain entity id.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="fields" type="string | null">
  The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See [https://docs.recordedfuture.com/reference/enrichment-field-attributes](https://docs.recordedfuture.com/reference/enrichment-field-attributes) for a list of values.

  Default: `null`.
</ParamField>

<ParamField path="metadata" type="boolean | null">
  Annotates the response with additional metadata explaining the response data elements.

  Default: `null`.
</ParamField>

<ParamField path="taggedText" type="boolean | null">
  Enable or disable entity tags in text fragments.

  Default: `null`.
</ParamField>

## Lookup entity

Action ID: `tools.recorded_future.lookup_entity`

Lookup entity by its ID. Calls GET /entity-match/entity/\{id} directly.

Reference: [https://docs.recordedfuture.com/reference/entity-lookup](https://docs.recordedfuture.com/reference/entity-lookup)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Entity ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

## Lookup hash

Action ID: `tools.recorded_future.lookup_hash`

Lookup a Hash entity by id. Calls GET /v2/hash/\{id} directly.

Reference: [https://docs.recordedfuture.com/reference/hash-lookup](https://docs.recordedfuture.com/reference/hash-lookup)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Hash entity id.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="fields" type="string | null">
  The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See [https://docs.recordedfuture.com/reference/enrichment-field-attributes](https://docs.recordedfuture.com/reference/enrichment-field-attributes) for a list of values.

  Default: `null`.
</ParamField>

<ParamField path="metadata" type="boolean | null">
  Annotates the response with additional metadata explaining the response data elements.

  Default: `null`.
</ParamField>

<ParamField path="taggedText" type="boolean | null">
  Enable or disable entity tags in text fragments.

  Default: `null`.
</ParamField>

## Lookup IP

Action ID: `tools.recorded_future.lookup_ip`

Lookup a IP address entity by id. Calls GET /v2/ip/\{id} directly.

Reference: [https://docs.recordedfuture.com/reference/ip-lookup](https://docs.recordedfuture.com/reference/ip-lookup)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  IP address entity id.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="fields" type="string | null">
  The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See [https://docs.recordedfuture.com/reference/enrichment-field-attributes](https://docs.recordedfuture.com/reference/enrichment-field-attributes) for a list of values.

  Default: `null`.
</ParamField>

<ParamField path="metadata" type="boolean | null">
  Annotates the response with additional metadata explaining the response data elements.

  Default: `null`.
</ParamField>

<ParamField path="taggedText" type="boolean | null">
  Enable or disable entity tags in text fragments.

  Default: `null`.
</ParamField>

## Lookup malware

Action ID: `tools.recorded_future.lookup_malware`

Lookup a Malware entity by id. Calls GET /v2/malware/\{id} directly.

Reference: [https://docs.recordedfuture.com/reference/malware-lookup](https://docs.recordedfuture.com/reference/malware-lookup)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Malware entity id.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="fields" type="string | null">
  The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See [https://docs.recordedfuture.com/reference/enrichment-field-attributes](https://docs.recordedfuture.com/reference/enrichment-field-attributes) for a list of values.

  Default: `null`.
</ParamField>

<ParamField path="metadata" type="boolean | null">
  Annotates the response with additional metadata explaining the response data elements.

  Default: `null`.
</ParamField>

<ParamField path="taggedText" type="boolean | null">
  Enable or disable entity tags in text fragments.

  Default: `null`.
</ParamField>

## Lookup URL

Action ID: `tools.recorded_future.lookup_url`

Lookup a URL entity by id. Calls GET /v2/url/\{id} directly.

Reference: [https://docs.recordedfuture.com/reference/url-lookup](https://docs.recordedfuture.com/reference/url-lookup)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  URL entity id.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="fields" type="string | null">
  The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See [https://docs.recordedfuture.com/reference/enrichment-field-attributes](https://docs.recordedfuture.com/reference/enrichment-field-attributes) for a list of values.

  Default: `null`.
</ParamField>

<ParamField path="metadata" type="boolean | null">
  Annotates the response with additional metadata explaining the response data elements.

  Default: `null`.
</ParamField>

<ParamField path="taggedText" type="boolean | null">
  Enable or disable entity tags in text fragments.

  Default: `null`.
</ParamField>

## Lookup vulnerability

Action ID: `tools.recorded_future.lookup_vulnerability`

Lookup a Vulnerability entity by id. Calls GET /v2/vulnerability/\{id} directly.

Reference: [https://docs.recordedfuture.com/reference/vulnerability-lookup](https://docs.recordedfuture.com/reference/vulnerability-lookup)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Vulnerability entity id.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="fields" type="string | null">
  The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See [https://docs.recordedfuture.com/reference/enrichment-field-attributes](https://docs.recordedfuture.com/reference/enrichment-field-attributes) for a list of values.

  Default: `null`.
</ParamField>

<ParamField path="metadata" type="boolean | null">
  Annotates the response with additional metadata explaining the response data elements.

  Default: `null`.
</ParamField>

<ParamField path="taggedText" type="boolean | null">
  Enable or disable entity tags in text fragments.

  Default: `null`.
</ParamField>

## Match entities

Action ID: `tools.recorded_future.match_entities`

Match entities by name and (optionally) type. Calls POST /entity-match/match directly.

Reference: [https://docs.recordedfuture.com/reference/entity-match](https://docs.recordedfuture.com/reference/entity-match)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="name" type="string" required>
  Entity name to match for.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Number of entities to include in the response. The maximum is 100 and Recorded Future defaults to 10.

  Default: `null`.
</ParamField>

<ParamField path="type" type="array[string] | null">
  Entity types to match for.

  Default: `null`.
</ParamField>

## Publish analyst note

Action ID: `tools.recorded_future.publish_analyst_note`

Publish an Analyst Note from a JSON object. Calls POST /analyst-note/publish directly.

Reference: [https://docs.recordedfuture.com/reference/analyst-note-publish](https://docs.recordedfuture.com/reference/analyst-note-publish)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="text" type="string" required>
  Note text. Sent as attributes.text.
</ParamField>

<ParamField path="title" type="string" required>
  Note title. Sent as attributes.title.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="context_entities" type="array[string] | null">
  Entity ids. Context entities or note entities must be specified. Each entity must exist as a note entity. Sent as attributes.context\_entities.

  Default: `null`.
</ParamField>

<ParamField path="detection_rules" type="array[string] | null">
  Entity ids for detection rules. Sent as attributes.detection\_rules.

  Default: `null`.
</ParamField>

<ParamField path="escape_html" type="boolean | null">
  Determines if HTML tags are escaped, applied only when tagged\_text is true.

  Default: `null`.
</ParamField>

<ParamField path="labels" type="array[string] | null">
  Entity ids for the note labels. Sent as attributes.labels.

  Default: `null`.
</ParamField>

<ParamField path="note_entities" type="array[string] | null">
  Entity ids. Either note entities or context entities must be specified. Each entity must exist as a note entity. Sent as attributes.note\_entities.

  Default: `null`.
</ParamField>

<ParamField path="note_id" type="string | null">
  The id of an existing note to edit.

  Default: `null`.
</ParamField>

<ParamField path="resolve_entities" type="boolean | null">
  Determines if the entity resolver should be used on the note title and text for automated tagging of entities. Recorded Future defaults to true.

  Default: `null`.
</ParamField>

<ParamField path="serialization" type="string | null">
  Entity serialization level. When set to id, only the entity id will be included. Setting it to min leads to the id and name being included and setting it to full means that each entity will have the id, name, type, isThreatActor flag and possibly a description included in the response. Allowed values are id, min and full.

  Default: `null`.
</ParamField>

<ParamField path="source" type="string | null">
  Entity id for note source.

  Default: `null`.
</ParamField>

<ParamField path="tagged_text" type="boolean | null">
  Determines if the \<entity>\</entity> tags should be inline with entities in the note title and text.

  Default: `null`.
</ParamField>

<ParamField path="topic" type="array[string] | null">
  Array of entity ids for the topics, see [https://docs.recordedfuture.com/reference/analyst-note-available-topics](https://docs.recordedfuture.com/reference/analyst-note-available-topics) for available ones. Sent as attributes.topic.

  Default: `null`.
</ParamField>

<ParamField path="validated_on" type="string | null">
  Date when analyst note was validated. Sent as attributes.validated\_on.

  Default: `null`.
</ParamField>

## Remove entity from list

Action ID: `tools.recorded_future.remove_entity_from_list`

Remove an entity from the list listId. Calls POST /list/\{listId}/entity/remove directly.

Reference: [https://docs.recordedfuture.com/reference/lists-remove-entity](https://docs.recordedfuture.com/reference/lists-remove-entity)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="entity" type="object" required>
  Entity to remove, given either as \{"id": "\<entity id>"} or as \{"type": "\<entity type>", "name": "\<entity name>"}.
</ParamField>

<ParamField path="listId" type="string" required>
  Id of list or named watch list.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

## Search alert rules

Action ID: `tools.recorded_future.search_alert_rules`

Search for alert rules based on a set of filters. Calls GET /alert/v2/rule directly.

Reference: [https://docs.recordedfuture.com/reference/alerts-search-rules](https://docs.recordedfuture.com/reference/alerts-search-rules)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="freetext" type="string | null">
  Filter by any text.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Maximum number of items to include. The maximum is 1000 and Recorded Future defaults to 10.

  Default: `null`.
</ParamField>

<ParamField path="taggedText" type="boolean | null">
  Include text tags.

  Default: `null`.
</ParamField>

## Search alerts

Action ID: `tools.recorded_future.search_alerts`

Search for alerts based on a set of filters. Calls GET /alert/v3 directly.

Reference: [https://docs.recordedfuture.com/reference/alerts-search](https://docs.recordedfuture.com/reference/alerts-search)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="alertRule" type="string | null">
  Filter by alert rule id.

  Default: `null`.
</ParamField>

<ParamField path="assignee" type="string | null">
  Filter by a specific assigned user, using the email address associated with that user account, or use NONE to explicitly match against unassigned alerts.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="direction" type="string | null">
  Sort direction based on the triggered timestamp. Allowed values are asc and desc.

  Default: `null`.
</ParamField>

<ParamField path="fields" type="string | null">
  Fields to include in the response. If no specific fields are requested, all available fields are included in the response. Values should be separated by comma. Available fields are ai\_insights, enriched\_entities, hits, id, log, owner\_organisation\_details, review, rule, title, triggered\_by, type and url.

  Default: `null`.
</ParamField>

<ParamField path="freetext" type="string | null">
  Filter by any text.

  Default: `null`.
</ParamField>

<ParamField path="from" type="integer | null">
  Offset search from previous result. The API may only return the first 1000 results, meaning that limit + from cannot exceed 1000.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Maximum number of items to include. The maximum is 1000 and Recorded Future defaults to 10.

  Default: `null`.
</ParamField>

<ParamField path="orderby" type="string | null">
  Sort order. The only allowed value is triggered.

  Default: `null`.
</ParamField>

<ParamField path="statusInPortal" type="string | null">
  Filter by review status. Allowed values are New, Resolved, Pending, Dismissed and Flag for Tuning.

  Default: `null`.
</ParamField>

<ParamField path="taggedText" type="boolean | null">
  Include text tags.

  Default: `null`.
</ParamField>

<ParamField path="triggered" type="string | null">
  The triggered time itself has millisecond precision, but can be searched for using parameters of higher granularity on the form \[x, y], which is interpreted as beginning of x until end of y.

  Default: `null`.
</ParamField>

## Search analyst notes

Action ID: `tools.recorded_future.search_analyst_notes`

Search for published analyst notes, either from within the enterprise or from Insikt Group. Calls POST /analyst-note/search directly.

Reference: [https://docs.recordedfuture.com/reference/analyst-note-search](https://docs.recordedfuture.com/reference/analyst-note-search)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="entity" type="string | null">
  Entity id.

  Default: `null`.
</ParamField>

<ParamField path="escape_html" type="boolean | null">
  Determines if HTML tags are escaped, applied only when tagged\_text is true and tagged\_text\_format is html.

  Default: `null`.
</ParamField>

<ParamField path="from" type="string | null">
  Offset the result based on next\_offset from a previous search response.

  Default: `null`.
</ParamField>

<ParamField path="label" type="string | null">
  Search string to match against note labels.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Maximum number of references from which notes are fetched, at most 1000. Recorded Future defaults to 10.

  Default: `null`.
</ParamField>

<ParamField path="published" type="string | null">
  Notes published after this date, absolute like 2024-01-01 or relative like -3d.

  Default: `null`.
</ParamField>

<ParamField path="serialization" type="string | null">
  Entity serialization level. When set to id, only the entity id will be included. Setting it to min leads to the id and name being included and setting it to full means that each entity will have the id, name, type, isThreatActor flag and possibly a description included in the response. Allowed values are id, min and full.

  Default: `null`.
</ParamField>

<ParamField path="source" type="string | null">
  Entity id for note source.

  Default: `null`.
</ParamField>

<ParamField path="tagged_text" type="boolean | null">
  Determines if the \<entity>\</entity> tags should be inline with entities in the note title and text.

  Default: `null`.
</ParamField>

<ParamField path="tagged_text_format" type="string | null">
  Output format for inline tags when tagged\_text is true. Allowed values are html and markdown. Recorded Future defaults to html.

  Default: `null`.
</ParamField>

<ParamField path="title" type="string | null">
  Search string to match against note titles.

  Default: `null`.
</ParamField>

<ParamField path="topic" type="string | null">
  Topic entity id, see [https://docs.recordedfuture.com/reference/analyst-note-available-topics](https://docs.recordedfuture.com/reference/analyst-note-available-topics) for available ones.

  Default: `null`.
</ParamField>

## Search companies

Action ID: `tools.recorded_future.search_companies`

Search for Company entities based on a filter. Calls GET /v2/company/search directly.

Reference: [https://docs.recordedfuture.com/reference/company-search](https://docs.recordedfuture.com/reference/company-search)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="direction" type="string | null">
  The direction of the sorting by the orderBy parameter, ascending or descending. Allowed values are asc and desc.

  Default: `null`.
</ParamField>

<ParamField path="domicile" type="string | null">
  Filters for companies based on domicile. The expected value is a valid Entity ID for a country. The Entity Match API is available to lookup country Entity IDs.

  Default: `null`.
</ParamField>

<ParamField path="fields" type="string | null">
  The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See [https://docs.recordedfuture.com/reference/enrichment-field-attributes](https://docs.recordedfuture.com/reference/enrichment-field-attributes) for a list of values.

  Default: `null`.
</ParamField>

<ParamField path="firstSeen" type="string | null">
  Filters entities based on the download of the first reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.

  Default: `null`.
</ParamField>

<ParamField path="freetext" type="string | null">
  Freetext.

  Default: `null`.
</ParamField>

<ParamField path="from" type="integer | null">
  Offsets the pagination of the request. Note that there is a limit of returning only the top 1000 results from a search, meaning if limit plus from exceeds 1000, this will result in a Bad Request message.

  Default: `null`.
</ParamField>

<ParamField path="industry" type="string | null">
  Filters for companies based on industry. The expected value is a Industry ID.

  Default: `null`.
</ParamField>

<ParamField path="lastSeen" type="string | null">
  Filters entities based on the download of the latest reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Maximum number of records returned. The maximum is 1000.

  Default: `null`.
</ParamField>

<ParamField path="list" type="string | null">
  Filters entities based on presence in a single list. Requires the list ID, which can be found using the List API.

  Default: `null`.
</ParamField>

<ParamField path="metadata" type="boolean | null">
  Annotates the response with additional metadata explaining the response data elements.

  Default: `null`.
</ParamField>

<ParamField path="orderBy" type="string | null">
  Sorts the search according to the chosen parameter. Results are sorted before pagination. Allowed values are created, modified, sixtydayshits, sevendayhits, criticality, riskscore, totalhits, firstseen, lastseen and rules.

  Default: `null`.
</ParamField>

<ParamField path="parent" type="string | null">
  Filters for companies based on parent company. The expected value is a Company ID.

  Default: `null`.
</ParamField>

<ParamField path="riskRule" type="string | null">
  Filters for companies based on a single risk rule. Valid rule IDs are listed by the GET /v2/company/riskrules endpoint.

  Default: `null`.
</ParamField>

<ParamField path="riskScore" type="string | null">
  Filters entities based on risk score, e.g. on the form \[20, 80] (20 \<= risk score \<= 80), \[20,) (20 \<= risk score), or \[,90) (risk score \< 90). '\[' and ']' are inclusive while '(' and ')' are exclusive.

  Default: `null`.
</ParamField>

## Search detection rules

Action ID: `tools.recorded_future.search_detection_rules`

Search for detection rules based on the provided filter. Calls POST /detection-rule/search directly.

Reference: [https://docs.recordedfuture.com/reference/detection-rules-search](https://docs.recordedfuture.com/reference/detection-rules-search)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="created_after" type="string | null">
  Only return rules created after this point in time. Sent as filter.created.after.

  Default: `null`.
</ParamField>

<ParamField path="created_before" type="string | null">
  Only return rules created before this point in time. Sent as filter.created.before.

  Default: `null`.
</ParamField>

<ParamField path="doc_id" type="string | null">
  Document Identity. Sent as filter.doc\_id.

  Default: `null`.
</ParamField>

<ParamField path="entities" type="array[string] | null">
  Entity ids the detection rules are associated with. Sent as filter.entities.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Maximum number of detection rules to return. Recorded Future defaults to 10.

  Default: `null`.
</ParamField>

<ParamField path="offset" type="string | null">
  An opaque string that was received as the next\_offset in the previous call when paging. It identifies the next page with additional results that did not fit within the limit.

  Default: `null`.
</ParamField>

<ParamField path="tagged_entities" type="boolean | null">
  Set this to true to get tagged entities in the text. Recorded Future defaults to false.

  Default: `null`.
</ParamField>

<ParamField path="title" type="string | null">
  Free text search on the Insikt Note title published with the detection rule. Sent as filter.title.

  Default: `null`.
</ParamField>

<ParamField path="types" type="array[string] | null">
  The types of detection rule to return. Allowed values are sigma, yara, snort, nuclei and suricata. Sent as filter.types.

  Default: `null`.
</ParamField>

<ParamField path="updated_after" type="string | null">
  Only return rules updated after this point in time. Sent as filter.updated.after.

  Default: `null`.
</ParamField>

<ParamField path="updated_before" type="string | null">
  Only return rules updated before this point in time. Sent as filter.updated.before.

  Default: `null`.
</ParamField>

## Search domains

Action ID: `tools.recorded_future.search_domains`

Search for Domain entities based on a filter. Calls GET /v2/domain/search directly.

Reference: [https://docs.recordedfuture.com/reference/domain-search](https://docs.recordedfuture.com/reference/domain-search)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="direction" type="string | null">
  The direction of the sorting by the orderBy parameter, ascending or descending. Allowed values are asc and desc.

  Default: `null`.
</ParamField>

<ParamField path="fields" type="string | null">
  The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See [https://docs.recordedfuture.com/reference/enrichment-field-attributes](https://docs.recordedfuture.com/reference/enrichment-field-attributes) for a list of values.

  Default: `null`.
</ParamField>

<ParamField path="firstSeen" type="string | null">
  Filters entities based on the download of the first reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.

  Default: `null`.
</ParamField>

<ParamField path="from" type="integer | null">
  Offsets the pagination of the request. Note that there is a limit of returning only the top 1000 results from a search, meaning if limit plus from exceeds 1000, this will result in a Bad Request message.

  Default: `null`.
</ParamField>

<ParamField path="lastSeen" type="string | null">
  Filters entities based on the download of the latest reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Maximum number of records returned. The maximum is 1000.

  Default: `null`.
</ParamField>

<ParamField path="list" type="string | null">
  Filters entities based on presence in a single list. Requires the list ID, which can be found using the List API.

  Default: `null`.
</ParamField>

<ParamField path="metadata" type="boolean | null">
  Annotates the response with additional metadata explaining the response data elements.

  Default: `null`.
</ParamField>

<ParamField path="orderBy" type="string | null">
  Sorts the search according to the chosen parameter. Results are sorted before pagination. Allowed values are created, modified, sixtydayshits, sevendayhits, criticality, riskscore, totalhits, firstseen, lastseen and rules.

  Default: `null`.
</ParamField>

<ParamField path="parent" type="string | null">
  Filters for companies based on parent company. The expected value is a Company ID.

  Default: `null`.
</ParamField>

<ParamField path="riskRule" type="string | null">
  Filters for domains based on a single risk rule. Valid rule IDs are listed by the GET /v2/domain/riskrules endpoint.

  Default: `null`.
</ParamField>

<ParamField path="riskScore" type="string | null">
  Filters entities based on risk score, e.g. on the form \[20, 80] (20 \<= risk score \<= 80), \[20,) (20 \<= risk score), or \[,90) (risk score \< 90). '\[' and ']' are inclusive while '(' and ')' are exclusive.

  Default: `null`.
</ParamField>

## Search hashes

Action ID: `tools.recorded_future.search_hashes`

Search for Hash entities based on a filter. Calls GET /v2/hash/search directly.

Reference: [https://docs.recordedfuture.com/reference/hash-search](https://docs.recordedfuture.com/reference/hash-search)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="algorithm" type="string | null">
  Filters hash entities based on hash algorithm. Allowed values are MD5, SHA-1, SHA-256, SHA-512, SSDEEP and SHA-384.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="direction" type="string | null">
  The direction of the sorting by the orderBy parameter, ascending or descending. Allowed values are asc and desc.

  Default: `null`.
</ParamField>

<ParamField path="fields" type="string | null">
  The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See [https://docs.recordedfuture.com/reference/enrichment-field-attributes](https://docs.recordedfuture.com/reference/enrichment-field-attributes) for a list of values.

  Default: `null`.
</ParamField>

<ParamField path="firstSeen" type="string | null">
  Filters entities based on the download of the first reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.

  Default: `null`.
</ParamField>

<ParamField path="from" type="integer | null">
  Offsets the pagination of the request. Note that there is a limit of returning only the top 1000 results from a search, meaning if limit plus from exceeds 1000, this will result in a Bad Request message.

  Default: `null`.
</ParamField>

<ParamField path="lastSeen" type="string | null">
  Filters entities based on the download of the latest reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Maximum number of records returned. The maximum is 1000.

  Default: `null`.
</ParamField>

<ParamField path="list" type="string | null">
  Filters entities based on presence in a single list. Requires the list ID, which can be found using the List API.

  Default: `null`.
</ParamField>

<ParamField path="metadata" type="boolean | null">
  Annotates the response with additional metadata explaining the response data elements.

  Default: `null`.
</ParamField>

<ParamField path="orderBy" type="string | null">
  Sorts the search according to the chosen parameter. Results are sorted before pagination. Allowed values are created, modified, sixtydayshits, sevendayhits, criticality, riskscore, totalhits, firstseen, lastseen and rules.

  Default: `null`.
</ParamField>

<ParamField path="riskRule" type="string | null">
  Filters for hashes based on a single risk rule. Valid rule IDs are listed by the GET /v2/hash/riskrules endpoint.

  Default: `null`.
</ParamField>

<ParamField path="riskScore" type="string | null">
  Filters entities based on risk score, e.g. on the form \[20, 80] (20 \<= risk score \<= 80), \[20,) (20 \<= risk score), or \[,90) (risk score \< 90). '\[' and ']' are inclusive while '(' and ')' are exclusive.

  Default: `null`.
</ParamField>

## Search IP addresses

Action ID: `tools.recorded_future.search_ips`

Search for IP Address entities based on a filter. Calls GET /v2/ip/search directly.

Reference: [https://docs.recordedfuture.com/reference/ip-search](https://docs.recordedfuture.com/reference/ip-search)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="direction" type="string | null">
  The direction of the sorting by the orderBy parameter, ascending or descending. Allowed values are asc and desc.

  Default: `null`.
</ParamField>

<ParamField path="fields" type="string | null">
  The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See [https://docs.recordedfuture.com/reference/enrichment-field-attributes](https://docs.recordedfuture.com/reference/enrichment-field-attributes) for a list of values.

  Default: `null`.
</ParamField>

<ParamField path="firstSeen" type="string | null">
  Filters entities based on the download of the first reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.

  Default: `null`.
</ParamField>

<ParamField path="from" type="integer | null">
  Offsets the pagination of the request. Note that there is a limit of returning only the top 1000 results from a search, meaning if limit plus from exceeds 1000, this will result in a Bad Request message.

  Default: `null`.
</ParamField>

<ParamField path="lastSeen" type="string | null">
  Filters entities based on the download of the latest reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Maximum number of records returned. The maximum is 1000.

  Default: `null`.
</ParamField>

<ParamField path="list" type="string | null">
  Filters entities based on presence in a single list. Requires the list ID, which can be found using the List API.

  Default: `null`.
</ParamField>

<ParamField path="location" type="string | null">
  Filters for IPs based on location expressed as RF ID.

  Default: `null`.
</ParamField>

<ParamField path="metadata" type="boolean | null">
  Annotates the response with additional metadata explaining the response data elements.

  Default: `null`.
</ParamField>

<ParamField path="orderBy" type="string | null">
  Sorts the search according to the chosen parameter. Results are sorted before pagination. Allowed values are created, modified, sixtydayshits, sevendayhits, criticality, riskscore, totalhits, firstseen, lastseen and rules.

  Default: `null`.
</ParamField>

<ParamField path="range" type="string | null">
  Range of IPs to search for, expressed as start-end or CIDR.

  Default: `null`.
</ParamField>

<ParamField path="riskRule" type="string | null">
  Filters for IPs based on a single risk rule. Valid rule IDs are listed by the GET /v2/ip/riskrules endpoint.

  Default: `null`.
</ParamField>

<ParamField path="riskScore" type="string | null">
  Filters entities based on risk score, e.g. on the form \[20, 80] (20 \<= risk score \<= 80), \[20,) (20 \<= risk score), or \[,90) (risk score \< 90). '\[' and ']' are inclusive while '(' and ')' are exclusive.

  Default: `null`.
</ParamField>

## Search links

Action ID: `tools.recorded_future.search_links`

Search for links related to one or more entities. The Entity Match API may be used to determine the ID for a certain entity. Calls POST /links/search directly.

Reference: [https://docs.recordedfuture.com/reference/links-search](https://docs.recordedfuture.com/reference/links-search)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="entities" type="array[string]" required>
  IDs of entities to return links for. If more than one ID is provided, it is equivalent of calling this endpoint once for each, condensed into one call.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="connected_entities" type="array[string] | null">
  Filter on entities linked to a link. Sent as filters.technical.connected\_entities.

  Default: `null`.
</ParamField>

<ParamField path="entity_types" type="array[string] | null">
  Only return these types of entities. Possible values are listed by the links metadata endpoint. Sent as filters.entity\_types.

  Default: `null`.
</ParamField>

<ParamField path="events" type="array[string] | null">
  Filter on specific types of technical sources. Sent as filters.technical.events.

  Default: `null`.
</ParamField>

<ParamField path="per_entity_type" type="integer | null">
  The maximum number of returned entities per type. Indicators are sorted by risk prior to filtering. Sent as limits.per\_entity\_type.

  Default: `null`.
</ParamField>

<ParamField path="search_scope" type="string | null">
  Predefined levels of search depth. A larger scope may yield more linked entities, at the cost of increased latency. Allowed values are small, medium and large. Sent as limits.search\_scope.

  Default: `null`.
</ParamField>

<ParamField path="sections" type="array[string] | null">
  Only return links categorized under these sections. Possible values are listed by the links metadata endpoint. Sent as filters.sections.

  Default: `null`.
</ParamField>

<ParamField path="sources" type="array[string] | null">
  Types of sources to use. Allowed values are technical and insikt. Sent as filters.sources.

  Default: `null`.
</ParamField>

<ParamField path="timeframe" type="string | null">
  Time range for links from technical sources. As an ISO Date (2022-01-01) or relative to today (-7d). Maximum of 1825 days from today. Sent as filters.technical.timeframe.

  Default: `null`.
</ParamField>

## Search lists

Action ID: `tools.recorded_future.search_lists`

Find lists based on a query. Calls POST /list/search directly.

Reference: [https://docs.recordedfuture.com/reference/lists-search](https://docs.recordedfuture.com/reference/lists-search)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Maximum number of lists to return. The maximum is 100 and Recorded Future defaults to 25.

  Default: `null`.
</ParamField>

<ParamField path="name" type="string | null">
  Search string to match against list names.

  Default: `null`.
</ParamField>

<ParamField path="type" type="string | null">
  Type of list to search for. Allowed values are entity, source, text, custom, ip, domain, tech\_stack, industry, brand, partner, industry\_peer, location, supplier, vulnerability, company, hash, operation, attacker, target, method and executive. Recorded Future defaults to entity.

  Default: `null`.
</ParamField>

## Search playbook alerts

Action ID: `tools.recorded_future.search_playbook_alerts`

Searches for Playbook Alerts based on filtering conditions supplied in the body. Only Playbook Alerts matching all specified criteria are included in the response. Calls POST /playbook-alert/search directly.

Reference: [https://docs.recordedfuture.com/reference/playbook-alerts-search](https://docs.recordedfuture.com/reference/playbook-alerts-search)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="assignee" type="array[string] | null">
  Return Playbook Alerts with this assignee. Valid assignees can be listed in /playbook-alert/metadata/assignees.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="category" type="array[string] | null">
  Return Playbook Alerts with this category. Allowed values are domain\_abuse, malicious\_sites, cyber\_vulnerability, code\_repo\_leakage, third\_party\_risk, identity\_novel\_exposures, geopolitics\_facility, dark\_web and socmed\_impersonation.

  Default: `null`.
</ParamField>

<ParamField path="created_from" type="string | null">
  Created at or after this point in time. Sent as created\_range.from.

  Default: `null`.
</ParamField>

<ParamField path="created_until" type="string | null">
  Created before or at this point in time. Sent as created\_range.until.

  Default: `null`.
</ParamField>

<ParamField path="direction" type="string | null">
  Order results ascending or descending. Allowed values are asc and desc.

  Default: `null`.
</ParamField>

<ParamField path="entity" type="array[string] | null">
  Entity of the alert (ID). For Domain Abuse alerts the entity is the attacker domain and for Vulnerability Alerts the entity is the CVE.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Pagination limit, show items up to this limit. Offset + limit cannot exceed 10 000.

  Default: `null`.
</ParamField>

<ParamField path="offset" type="string | null">
  Allows pagination by using next\_offset from previous search response.

  Default: `null`.
</ParamField>

<ParamField path="order_by" type="string | null">
  Order results by created or modified data. Allowed values are created and modified.

  Default: `null`.
</ParamField>

<ParamField path="organisation" type="array[string] | null">
  Return Playbook Alerts with either of the organisations as owner.

  Default: `null`.
</ParamField>

<ParamField path="priority" type="array[string] | null">
  Return Playbook Alerts with this priority. Allowed values are High, Moderate and Informational. If omitted or empty, all priorities will be selected.

  Default: `null`.
</ParamField>

<ParamField path="statuses" type="array[string] | null">
  Return Playbook Alerts with this status. Allowed values are New, InProgress, Dismissed and Resolved. If omitted or empty, all statuses will be selected.

  Default: `null`.
</ParamField>

<ParamField path="updated_from" type="string | null">
  Updated at or after this point in time. Sent as updated\_range.from.

  Default: `null`.
</ParamField>

<ParamField path="updated_until" type="string | null">
  Updated before or at this point in time. Sent as updated\_range.until.

  Default: `null`.
</ParamField>

## Search risk history

Action ID: `tools.recorded_future.search_risk_history`

Search for risk history of score, criticality and risk rules for entities for a specific date range. The response includes actual risks (when removed date is absent) and historical risks (when removed date is in requested date range). Calls POST /risk/history directly.

Reference: [https://docs.recordedfuture.com/reference/risk-search-risk-history](https://docs.recordedfuture.com/reference/risk-search-risk-history)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="entities" type="array[string]" required>
  Entity ids to return risk history for.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="from" type="string | null">
  Default value is minus 30 days from the to date or current date if the to date is missing.

  Default: `null`.
</ParamField>

<ParamField path="to" type="string | null">
  Default value is plus 30 days from the from date or current date if the from date is missing.

  Default: `null`.
</ParamField>

## Search URLs

Action ID: `tools.recorded_future.search_urls`

Search for URL entities based on a filter. Calls GET /v2/url/search directly.

Reference: [https://docs.recordedfuture.com/reference/url-search](https://docs.recordedfuture.com/reference/url-search)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="direction" type="string | null">
  The direction of the sorting by the orderBy parameter, ascending or descending. Allowed values are asc and desc.

  Default: `null`.
</ParamField>

<ParamField path="fields" type="string | null">
  The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See [https://docs.recordedfuture.com/reference/enrichment-field-attributes](https://docs.recordedfuture.com/reference/enrichment-field-attributes) for a list of values.

  Default: `null`.
</ParamField>

<ParamField path="firstSeen" type="string | null">
  Filters entities based on the download of the first reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.

  Default: `null`.
</ParamField>

<ParamField path="freetext" type="string | null">
  Freetext.

  Default: `null`.
</ParamField>

<ParamField path="from" type="integer | null">
  Offsets the pagination of the request. Note that there is a limit of returning only the top 1000 results from a search, meaning if limit plus from exceeds 1000, this will result in a Bad Request message.

  Default: `null`.
</ParamField>

<ParamField path="lastSeen" type="string | null">
  Filters entities based on the download of the latest reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Maximum number of records returned. The maximum is 1000.

  Default: `null`.
</ParamField>

<ParamField path="list" type="string | null">
  Filters entities based on presence in a single list. Requires the list ID, which can be found using the List API.

  Default: `null`.
</ParamField>

<ParamField path="metadata" type="boolean | null">
  Annotates the response with additional metadata explaining the response data elements.

  Default: `null`.
</ParamField>

<ParamField path="orderBy" type="string | null">
  Sorts the search according to the chosen parameter. Results are sorted before pagination. Allowed values are created, modified, sixtydayshits, sevendayhits, criticality, riskscore, totalhits, firstseen, lastseen and rules.

  Default: `null`.
</ParamField>

<ParamField path="riskRule" type="string | null">
  Filters for URLs based on a single risk rule. Valid rule IDs are listed by the GET /v2/url/riskrules endpoint.

  Default: `null`.
</ParamField>

<ParamField path="riskScore" type="string | null">
  Filters entities based on risk score, e.g. on the form \[20, 80] (20 \<= risk score \<= 80), \[20,) (20 \<= risk score), or \[,90) (risk score \< 90). '\[' and ']' are inclusive while '(' and ')' are exclusive.

  Default: `null`.
</ParamField>

## Search vulnerabilities

Action ID: `tools.recorded_future.search_vulnerabilities`

Search for Vulnerability entities based on a filter. Calls GET /v2/vulnerability/search directly.

Reference: [https://docs.recordedfuture.com/reference/vulnerability-search](https://docs.recordedfuture.com/reference/vulnerability-search)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="cpe" type="string | null">
  Filters for vulnerabilities based on affected products using the CPE identifier system.

  Default: `null`.
</ParamField>

<ParamField path="cvssScore" type="string | null">
  Filters for vulnerabilities based on CVSS score (from most trusted source), e.g. on the form \[8.0, 9.0] (8.0 \<= CVSS score \<= 9.0).

  Default: `null`.
</ParamField>

<ParamField path="cvssV3Score" type="string | null">
  Filters for vulnerabilities based on CVSS v3 score, e.g. on the form \[8.0, 9.0] (8.0 \<= CVSS v3 score \<= 9.0).

  Default: `null`.
</ParamField>

<ParamField path="direction" type="string | null">
  The direction of the sorting by the orderBy parameter, ascending or descending. Allowed values are asc and desc.

  Default: `null`.
</ParamField>

<ParamField path="fields" type="string | null">
  The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string. See [https://docs.recordedfuture.com/reference/enrichment-field-attributes](https://docs.recordedfuture.com/reference/enrichment-field-attributes) for a list of values.

  Default: `null`.
</ParamField>

<ParamField path="firstSeen" type="string | null">
  Filters entities based on the download of the first reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.

  Default: `null`.
</ParamField>

<ParamField path="freetext" type="string | null">
  Freetext.

  Default: `null`.
</ParamField>

<ParamField path="from" type="integer | null">
  Offsets the pagination of the request. Note that there is a limit of returning only the top 1000 results from a search, meaning if limit plus from exceeds 1000, this will result in a Bad Request message.

  Default: `null`.
</ParamField>

<ParamField path="lastSeen" type="string | null">
  Filters entities based on the download of the latest reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Maximum number of records returned. The maximum is 1000.

  Default: `null`.
</ParamField>

<ParamField path="list" type="string | null">
  Filters entities based on presence in a single list. Requires the list ID, which can be found using the List API.

  Default: `null`.
</ParamField>

<ParamField path="metadata" type="boolean | null">
  Annotates the response with additional metadata explaining the response data elements.

  Default: `null`.
</ParamField>

<ParamField path="orderBy" type="string | null">
  Sorts the search according to the chosen parameter. Results are sorted before pagination. Allowed values are created, modified, sixtydayshits, sevendayhits, criticality, riskscore, totalhits, firstseen, lastseen and rules.

  Default: `null`.
</ParamField>

<ParamField path="product" type="string | null">
  RF ID of affected product.

  Default: `null`.
</ParamField>

<ParamField path="riskRule" type="string | null">
  Filters for vulnerabilities based on a single risk rule. Valid rule IDs are listed by the GET /v2/vulnerability/riskrules endpoint.

  Default: `null`.
</ParamField>

<ParamField path="riskScore" type="string | null">
  Filters entities based on risk score, e.g. on the form \[20, 80] (20 \<= risk score \<= 80), \[20,) (20 \<= risk score), or \[,90) (risk score \< 90). '\[' and ']' are inclusive while '(' and ')' are exclusive.

  Default: `null`.
</ParamField>

## Triage indicators

Action ID: `tools.recorded_future.triage_indicators`

Triage multiple IOC entities for a specific context with up to 1000 IOCs per request. Calls POST /soar/v3/triage/contexts/\{context\_name} directly.

Reference: [https://docs.recordedfuture.com/reference/soar-triage-batch](https://docs.recordedfuture.com/reference/soar-triage-batch)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="context_name" type="string" required>
  The context in which to evaluate the given entities. Available contexts can be fetched using the separate endpoint.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="companybydomain" type="array[string] | null">
  Company domains to enrich.

  Default: `null`.
</ParamField>

<ParamField path="domain" type="array[string] | null">
  Domains to enrich.

  Default: `null`.
</ParamField>

<ParamField path="format" type="string | null">
  Allows for an output format suitable for Splunk SOAR (previously Phantom) when set to phantom. If no value is given, the default format (used in the Enrichment endpoint) will be used.

  Default: `null`.
</ParamField>

<ParamField path="hash" type="array[string] | null">
  Hashes to enrich.

  Default: `null`.
</ParamField>

<ParamField path="ip" type="array[string] | null">
  IP addresses to enrich.

  Default: `null`.
</ParamField>

<ParamField path="metadata" type="boolean | null">
  Annotates the response with additional metadata explaining the response data elements.

  Default: `null`.
</ParamField>

<ParamField path="threshold" type="integer | null">
  Determines which risk score should be used to deem an entity risky. Each context has its own default value and depends on the context. Allowed values are 0 to 99.

  Default: `null`.
</ParamField>

<ParamField path="threshold_type" type="string | null">
  Determines if the set of entities are deemed risky if a single entity is above the threshold (max) or if all entities have to be above the threshold (min). The default is specified by the context but is max for all contexts currently defined.

  Default: `null`.
</ParamField>

<ParamField path="url" type="array[string] | null">
  URLs to enrich.

  Default: `null`.
</ParamField>

<ParamField path="vulnerability" type="array[string] | null">
  Vulnerabilities to enrich.

  Default: `null`.
</ParamField>

## Update alerts

Action ID: `tools.recorded_future.update_alerts`

Update the status, assignee or note of one or several alerts. Calls POST /alert/v2/update directly.

Reference: [https://docs.recordedfuture.com/reference/alerts-update](https://docs.recordedfuture.com/reference/alerts-update)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="alerts" type="array[object]" required>
  Alert updates, each given as \{"id": "\<alert id>"} plus any of assignee (an id, uhash, username or email), statusInPortal (New, Resolved, Pending, Dismissed or Flag for Tuning) and note (new note text).
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

## Update playbook alert

Action ID: `tools.recorded_future.update_playbook_alert`

Update a Playbook Alert. Generic alert properties like status, priority and assignee may be updated, or a log message may be appended. Calls PUT /playbook-alert/common/\{playbook\_alert\_id} directly.

Reference: [https://docs.recordedfuture.com/reference/playbook-alerts-update](https://docs.recordedfuture.com/reference/playbook-alerts-update)

### Secrets

Required secrets:

* `recorded_future`: required values `RECORDED_FUTURE_API_KEY`.

### Input fields

<ParamField path="playbook_alert_id" type="string" required>
  The unique id of a specific Playbook Alert.
</ParamField>

<ParamField path="added_actions_taken" type="array[string] | null">
  The ids for the types of action taken. The possible values can be found in the response from /playbook-alert/metadata/common in the actions\_by\_category field. Can only be set when status is set to Dismissed or Resolved.

  Default: `null`.
</ParamField>

<ParamField path="assignee" type="string | null">
  ID of the assignee.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Recorded Future API.

  Default: `null`.
</ParamField>

<ParamField path="log_entry" type="string | null">
  Freetext log message. Maximum of 5000 characters.

  Default: `null`.
</ParamField>

<ParamField path="priority" type="string | null">
  The priority of the Playbook Alert. Allowed values are High, Moderate and Informational.

  Default: `null`.
</ParamField>

<ParamField path="removed_actions_taken" type="array[string] | null">
  The ids for the types of action taken that should be removed. The possible values can be found in the response from /playbook-alert/metadata/common in the actions\_by\_category field.

  Default: `null`.
</ParamField>

<ParamField path="reopen" type="string | null">
  Reopen strategies can only be applied to alerts with a status of Dismissed or Resolved. Allowed combinations of status and reopen are Dismissed with Never, Resolved with Never, and Resolved with SignificantUpdates.

  Default: `null`.
</ParamField>

<ParamField path="status" type="string | null">
  The status of the Playbook Alert. Allowed values are New, InProgress, Dismissed and Resolved.

  Default: `null`.
</ParamField>