Get full hash enrichment including risk scoring, malware family attribution, and MITRE ATT&CK mappings.
What this endpoint does
This endpoint retrieves detailed intelligence about a specific file hash (SHA256, SHA1, or MD5) from the Recorded Future Intelligence Cloud. You can use the raw hash value directly as the ID. For security workflows, use entity,risk,aiInsights,links,intelCard,fileHashes,hashAlgorithm as the fields parameter to get actionable intelligence at ~5KB. The hash-specific fileHashes field is particularly important as it returns all known algorithm variants (SHA256, SHA1, MD5) for cross-referencing across systems that index by different hash types. The links field for hashes is especially rich — it contains malware signature names from multiple AV engines, MITRE ATT&CK behavioral techniques observed during sandbox execution, and malware family attribution, all derived from MalwareAnalysis events. For deeper link investigation with filtering and batch support, use the dedicated Links: Search endpoint. Avoid requesting relatedEntities, analystNotes, metrics, and counts as these are either redundant with links or non-actionable. Call GET /v2/hash/fields to list valid field names programmatically, or consult the Enrichment: Field Attributes reference.
Response data
The response contains a single hash entity populated with the requested enrichment fields. The risk field provides a composite score, criticality level, and evidence details including sandbox verdicts and multi-source detection results. The aiInsights field returns a concise AI-generated summary of sandbox findings. The links field for hashes is dominated by MalwareAnalysis events and organizes sandbox-derived intelligence into sections: "Indicators & Detection Rules" containing malware signature detections from multiple AV engines, and "Actors, Tools & TTPs" containing MITRE ATT&CK techniques observed during execution and malware family attribution. The fileHashes field lists all algorithm variants of the same file, and hashAlgorithm identifies which algorithm was used for the queried hash. The intelCard field provides a pivot URL to the Recorded Future UI.