What this endpoint does

Searches for malware family and tool entities in the Recorded Future knowledge base. Malware entities represent tracked families and tools — not individual file samples. Use freetext for name-based search. This is the primary way to discover malware entity IDs for use in Malware: Lookup and Malware: Lookup Extension. Unlike IOC entities, malware entities do not have risk scores — do not request the risk field. Use categories for classification labels instead.

Response data

Returns matching malware entities with any enrichment fields you specified — enough to identify which malware families match your search and get their IDs for deeper lookups. Paginated with offset-based pagination; limit max 1,000 and limit + from cannot exceed 1,000. Results are under data.results, with counts as a sibling of data. The limit parameter has a default value of 10. The intention is to use pagination to get further results. Though limit can be set to higher values, depending on which fields are used for enrichment, this might result in slower queries and possibly even time outs.