What this endpoint does

Returns all Recorded Future entities (~9,800) that are linked to at least one detection rule in the Insikt Group library. The entity IDs returned here are valid inputs for the filter.entities array in Detection Rules: Search. Typical workflow: call this endpoint to find entity IDs matching a threat of interest (e.g., a specific malware family or MITRE ATT&CK technique), then pass those IDs to search for relevant YARA/Sigma/Snort rules. For the taxonomy of entity type categories, see Detection Rules: Associated Entity Types. No parameters required.

Response data

Returns the complete entity catalog in a single call as a flat JSON array (not wrapped in a data envelope) — filter client-side by type or name to narrow results. The list spans ~37 entity types including hashes, malware families, URLs, and MITRE ATT&CK identifiers.