Each attribute serves a specific purpose: title and text contain your note content; note_entities identifies the primary threats or indicators the note addresses; context_entities captures related entities mentioned for context; topic categorizes your intelligence type; labels enable integration with external ticketing or case management systems; and validation_urls links to original source materials.
Attributes
| Attribute | Required | Description |
|---|---|---|
title | Yes | Title of the analyst note. Entities found in the title are automatically tagged as note_entities by the NLP engine. |
text | Yes | Body content of the analyst note. Entities found in the text are automatically tagged as context_entities by the NLP engine. |
note_entities | Yes* | Primary entities that the note is about. At least one note_entity or context_entity is required to publish. These are the main threats, indicators, or subjects the note addresses. Entity IDs must be in Recorded Future format (e.g., "idn:example.com", "ip:192.0.2.1", "hash:abc123..."). Use the Entity: Match endpoint to convert names to IDs. |
context_entities | No* | Related entities mentioned in the note for context. These are secondary entities that provide background or connections. Same ID format requirements as note_entities. *At least one note_entity or context_entity is required to publish. |
topic | No | Topic or category of the analyst note. Must be a valid Recorded Future topic ID — see the Analyst Notes: Available Topics reference for the list of valid IDs. |
labels | No | User-defined string values for integration with external systems such as ticketing platforms or incident response tools. Can be used as unique identifiers to link the note to records in other systems. |
validation_urls | No | Source URLs that validate or support the information in the note. Must be formatted as Recorded Future URL entities, prefixed with "url:" (e.g., "url:https://example.com/advisory"). |
How NLP entity processing works
When you submit note content to the Preview or Publish endpoints, Recorded Future's NLP engine automatically:
- Scans the title and body text for recognizable entities (IPs, domains, hashes, vulnerabilities, malware, etc.)
- Tags entities found in the title as
note_entities - Tags entities found in the body text as
context_entities
You can review these automated assignments using the Analyst Notes: Preview endpoint and modify them before calling Analyst Notes: Publish. This lets you correct any misclassifications — for example, promoting a context_entity to a note_entity if it's actually a primary subject of the note.