Collective Insights API Overview

The Collective Insights API is a bidirectional intelligence pipeline designed to bridge the gap between internal security events and external threat intelligence. It transforms siloed detections into a unified, enriched intelligence stream that can be programmatically managed.

By leveraging this API, security teams move from simply detecting a threat to understanding it within the context of the global threat landscape.

Core Functions & Endpoints

The API operates through two primary functional capabilities: Ingestion and Retrieval.

1. Ingest & Enrich (/detections)

Push telemetry from any security tool (SIEM, EDR, Firewall, or SOAR) into the Recorded Future Intelligence Cloud.

Standardize Telemetry: Accept indicators and metadata, immediately mapping them against Recorded Future's global holdings.
Enrich Detections: Submitted telemetry is converted into Enriched Events that link to specific Malware families, Threat Actors, and MITRE ATT&CK® techniques.

2. Query & Extract (/search)

Programmatic access to your organization's entire history of enriched detections.

Unified Visibility: Aggregate detections from API submissions, built-in Recorded Future integrations, Autonomous Threat Operations, and Sandbox results into a single queryable interface.
Granular Intelligence Retrieval: Filter indicator history by malware, actors, or T-codes. Refine results by specific IOCs, integrations, and automations using inclusion or exclusion logic for precise analysis.
Automation Foundation: Export enriched events to external platforms like data lakes, custom dashboards, or automated ticketing systems.

Getting Started

To use these endpoints, you must have an active Recorded Future module license and a valid API Token.

To Ingest: Review the Submit Detections guide to begin sending telemetry.
To Analyze: Visit the Search documentation to learn how to query your enriched data.