Collective Insights API Overview

The Collective Insights API is a bidirectional intelligence pipeline designed to bridge the gap between internal security events and external threat intelligence. It transforms siloed detections into a unified, enriched intelligence stream that can be programmatically managed.

By leveraging this API, security teams move from simply detecting a threat to understanding it within the context of the global threat landscape.

Core Functions & Endpoints

The API operates through two primary functional capabilities: Ingestion and Retrieval. It additionally allows Refinement of your detection stream.

1. Ingest & Enrich (/detections)

Push telemetry from any security tool (SIEM, EDR, Firewall, or SOAR) into the Recorded Future Intelligence Cloud.

• Standardize Telemetry: Accept indicators and metadata, immediately mapping them against Recorded Future's global holdings.
• Enrich Detections: Submitted telemetry is converted into Enriched Events that link to specific Malware families, Threat Actors, and MITRE ATT&CK® techniques.

2. Query & Extract (/search)

Programmatic access to your organization's entire history of enriched detections.

• Unified Visibility: Aggregate detections from API submissions, built-in Recorded Future integrations, Autonomous Threat Operations, and Sandbox results into a single queryable interface.
• Granular Intelligence Retrieval: Filter indicator history by malware, actors, or T-codes. Refine results by specific IOCs, integrations, and automations using inclusion or exclusion logic for precise analysis.
• Automation Foundation: Export enriched events to external platforms like data lakes, custom dashboards, or automated ticketing systems.

3. Manage & Refine (/exclusions)

Control what enters your enriched detection stream by excluding known-noisy or trusted indicators before they skew analysis.

• Reduce Noise: Suppress observables, IP ranges, or device names that are known-benign, internally sanctioned, or otherwise not worth enriching, keeping the Search results focused on genuine threats.
• Full Lifecycle Management: Create, list, update, and delete exclusion list items for your organization, each with a required comment documenting the reason for exclusion.
• Auditability: Every change to the exclusion list is tracked in an organization-level audit log, so analysts can see who excluded what, and when.

Getting Started

To use these endpoints, you must have an active Recorded Future module license and a valid API Token.

• To Ingest: Review the Submit Detections guide to begin sending telemetry.
• To Analyze: Visit the Search documentation to learn how to query your enriched data.
• To Refine: See the Exclusions documentation to manage what gets excluded from your enriched stream.