# Recorded Future Documentation > Recorded Future API documentation This file lists one part of the documentation. The full index is at https://docs.recordedfuture.com/llms.txt. ## API Documentation: Getting Started - [Recorded Future API Overview](https://docs.recordedfuture.com/reference/get-started.md) - [API Entitlements](https://docs.recordedfuture.com/reference/api-entitlements.md) - [LLM Instructions](https://docs.recordedfuture.com/reference/llm-instructions.md) ## API Documentation: Alerts - Search & Management - [Search for Playbook Alerts](https://docs.recordedfuture.com/reference/playbook-alerts-search.md): Searches for Playbook Alerts based on filtering conditions supplied in the body. Not specifying a filter for a property means the filter will match a Playbook Alert regardless of the property's… - [Preview Playbook Alert](https://docs.recordedfuture.com/reference/playbook-alerts-preview.md): Returns a Playbook Alert representation containing only properties shared between all alert types. - [Update Playbook Alert](https://docs.recordedfuture.com/reference/playbook-alerts-update.md): Update a Playbook Alert. Generic alert properties like status, priority and assignee may be updated, or a log message may be appended. - [Available assignees](https://docs.recordedfuture.com/reference/playbook-alerts-assignees.md): List all users that are available as possible assignees for a given Playbook Alert - [Enumerations](https://docs.recordedfuture.com/reference/playbook-alerts-metadata.md): List all metadata and enumerations common to all types of Playbook Alerts. - Domain Abuse - [Detailed Domain Abuse alert data](https://docs.recordedfuture.com/reference/playbook-alerts-domain-abuse-detail.md): Retrieve detailed information about a Domain Abuse Playbook Alert with data grouped into UI-ready panels. - [Bulk Domain Abuse alert lookup](https://docs.recordedfuture.com/reference/playbook-alerts-domain-abuse-bulk.md): Perform a detailed lookup of data panels for several alerts at once. - [Screenshot related to Domain Abuse alert](https://docs.recordedfuture.com/reference/playbook-alerts-domain-abuse-image.md): Fetch a screenshot associated with the Domain Abuse alert. - Malicious Sites - [Playbook Alerts: Malicious Sites Detail](https://docs.recordedfuture.com/reference/post_malicious-sites-playbook-alert-id.md): Retrieve detailed information about a Malicious Sites Playbook Alert with data grouped into UI-ready panels. - [Playbook Alerts: Malicious Sites Bulk](https://docs.recordedfuture.com/reference/post_malicious-sites.md): Batch-retrieve detailed intelligence for up to 250 Malicious Sites alerts in a single request. - [Playbook Alerts: Malicious Sites Screenshot](https://docs.recordedfuture.com/reference/get_malicious-sites-playbook-alert-id-image-image-id.md): Fetch a screenshot associated with the Malicious Sites alert. - [Playbook Alerts: Malicious Sites Create](https://docs.recordedfuture.com/reference/post_malicious-sites-create.md): Manually create a Malicious Sites Playbook Alert for the supplied attacker domain. The alert is created with the cause `manual` and the creator is taken from the authenticated request. If the… - Vulnerability - [Detailed Vulnerability alert data](https://docs.recordedfuture.com/reference/playbook-alerts-vulnerability-detail.md): Retrieve detailed information about a Vulnerability Playbook Alert with data grouped into UI-ready panels. - [Bulk Vulnerability alert lookup](https://docs.recordedfuture.com/reference/playbook-alerts-vulnerability-bulk.md): Perform a detailed lookup of data panels for several alerts at once. - Data Leakage on Code Repository - [Detailed Code Repository Data Leakage alert data](https://docs.recordedfuture.com/reference/playbook-alerts-code-repo-leakage-detail.md): Retrieve detailed information about a Code Repository Data Leakage Playbook Alert with data grouped into UI-ready panels. - [Bulk Code Repository Data Leakage alert lookup](https://docs.recordedfuture.com/reference/playbook-alerts-code-repo-leakage-bulk.md): Perform a detailed lookup of data panels for several alerts at once. - Third Party Risk - [Third Party Risk alert data](https://docs.recordedfuture.com/reference/playbook-alerts-third-party-risk-detail.md): Retrieve detailed information about a Third Party Risk Playbook Alert with data grouped into UI-ready panels. - [Bulk Third Party Risk alert lookup](https://docs.recordedfuture.com/reference/playbook-alerts-third-party-risk-bulk.md): Perform a detailed lookup of data panels for several alerts at once. - Identity Novel Exposures - [Detailed Identity Novel Exposures alert data](https://docs.recordedfuture.com/reference/playbook-alerts-identity-exposures-detail.md): Retrieve detailed information about a Identity Novel Exposures Playbook Alert with data grouped into UI-ready panels. - [Bulk Identity Novel Exposures alerts lookup](https://docs.recordedfuture.com/reference/playbook-alerts-identity-exposures-bulk.md): Perform a detailed lookup of data panels for several Identity Novel Exposures alerts at once. - Geopolitics Facility - [Bulk Geopolitics Facility alerts lookup](https://docs.recordedfuture.com/reference/playbook-alerts-geopolitics-facility-bulk.md): Perform a detailed lookup of data panels for several Geopolitics Facility alerts at once. - [Geopolitics Facility alert data](https://docs.recordedfuture.com/reference/playbook-alerts-geopolitics-facility-detail.md): Retrieve detailed information about a Geopolitics Facility with data grouped into UI-ready panels. - [Image content by image id](https://docs.recordedfuture.com/reference/playbook-alerts-geopolitics-facility-image.md): Fetch an image content by image id - Malware Intelligence - [Malware Report alert notification data.](https://docs.recordedfuture.com/reference/playbook-alerts-malware-report-detail.md): Retrieve detailed information about a Malware report notification with data grouped into UI-ready panels. - [Bulk Malware Report alert lookup](https://docs.recordedfuture.com/reference/playbook-alerts-malware-report-bulk.md): Retrieve detailed information about multiple Malware Report notifications with data grouped into UI-ready panels. - Payment Card Fraud - [Compromised Bank Checks alert notification data.](https://docs.recordedfuture.com/reference/playbook-alerts-bank-checks-detail.md): Retrieve detailed information about a compromised bank check notification with data grouped into UI-ready panels. - [Bulk Compromised Bank Checks alert lookup](https://docs.recordedfuture.com/reference/playbook-alerts-bank-checks-bulk.md): Retrieve detailed information about multiple compromised bank check notifications with data grouped into UI-ready panels. - [Check image by alert id](https://docs.recordedfuture.com/reference/playbook-alerts-bank-checks-image.md): Fetch a compromised bank check image content by alert id - Dark Web Brand - [Playbook Alerts: Dark Web Brand Detail](https://docs.recordedfuture.com/reference/post_dark-web-brand-playbook-alert-id.md): Retrieve detailed information about a Dark Web Brand Playbook Alert with data grouped into UI-ready panels. - [Playbook Alerts: Dark Web Brand Bulk](https://docs.recordedfuture.com/reference/post_dark-web-brand.md): Retrieve detailed intelligence for multiple Dark Web Brand alerts in a single request, with data grouped into UI-ready panels. - Social Media Impersonation - [Playbook Alerts: Social Media Impersonation Detail](https://docs.recordedfuture.com/reference/post_social-media-impersonation-playbook-alert-id.md): Retrieve detailed information about a Social Media Impersonation Playbook Alert with data grouped into UI-ready panels. - [Playbook Alerts: Social Media Impersonation Bulk](https://docs.recordedfuture.com/reference/post_social-media-impersonation.md): Retrieve detailed intelligence for multiple Social Media Impersonation alerts in a single request, with data grouped into UI-ready panels. - Cases - [Build a Case around a Reference Alert, or a Signal Alert](https://docs.recordedfuture.com/reference/cases-create.md): Create a new case linked to a reference alert (document-based) or signal alert (entity risk-based) for triage and investigation. - [Deletes one Case](https://docs.recordedfuture.com/reference/cases-delete.md): Permanently remove a single case by its ID (idempotent — already-deleted or non-existent cases return success). - [Deletes specified Cases](https://docs.recordedfuture.com/reference/cases-delete-many.md): Bulk-delete up to 100 cases by ID, with partial-success handling that distinguishes deleted from already-removed cases. - [Lookup of Cases using Case IDs](https://docs.recordedfuture.com/reference/cases-lookup-many.md): Retrieve full case details (metadata, alert context, activity history) for one or more cases by their IDs. - [Lookup a Case using its ID](https://docs.recordedfuture.com/reference/cases-lookup.md): Retrieve full case details for a single case by ID (known routing bug — prefer POST /lookup with a single ID instead). - [Searches for any Case matching the criteria](https://docs.recordedfuture.com/reference/cases-search.md): Search cases by filter criteria to get matching case IDs, which can then be passed to the lookup endpoint for full details. - [Update Assignee, Status, Priority, Title or Description of a Case](https://docs.recordedfuture.com/reference/cases-update.md): Update assignee, status, priority, title, or description on an existing case. - [Retrieve all eligible assignees for a Case](https://docs.recordedfuture.com/reference/cases-eligible-assignees.md): List users in an organization who are eligible to be assigned to a specific case, with optional name or email filtering. ## API Documentation: Alert API - Alert (deprecated) - [Fetch alert by id](https://docs.recordedfuture.com/reference/get_alert-id.md): Fetch an alert by id. This endpoint includes all available fields in the response. - [Search for alerts](https://docs.recordedfuture.com/reference/get_search.md): Search for alerts based on a set of filters. - [Search for alerts with extra details](https://docs.recordedfuture.com/reference/get_search-details.md): Search for alerts based on a set of filters. This endpoint includes more data compared to the regular search endpoint. - Alert - [Search for alert rules.](https://docs.recordedfuture.com/reference/get_rule.md): Search for alert rules based on a set of filters. - [Update one or several alerts](https://docs.recordedfuture.com/reference/post_update.md): Updates one or several alerts. It's possible to update assignee, status and a note tied to the triggered alert. There are two types of statuses, the recommended "statusInPortal" and the legacy… - Alert V3 - [Search for alerts](https://docs.recordedfuture.com/reference/get_v3.md): Search for alerts based on a set of filters. Using the fields parameter the response can be set to include a set of fields. If no fields parameter is set, all available fields will be included in… - [Fetch a flat collection of hits](https://docs.recordedfuture.com/reference/get_v3-hits.md): Returns only a flat array of all hits (the Intelligence Cloud data that caused the alert to trigger) for one or several alerts. This endpoint will also include the alert ID and a numeric index for… - [Fetch raw image data](https://docs.recordedfuture.com/reference/get_v3-image.md): Fetch the raw image data of an image tied to an alert. - [Fetch alert by id](https://docs.recordedfuture.com/reference/get_v3-alert-id.md): Fetch an alert by id. Using the fields parameter the response can be set to include a set of fields. If no fields parameter is set, all available fields will be included in the response. For better… ## API Documentation: Analyst Notes - Configuration - [Analyst Notes: Available Topics](https://docs.recordedfuture.com/reference/analyst-note-available-topics.md) - [Analyst Notes: Note Attributes](https://docs.recordedfuture.com/reference/analyst-note-note-attributes.md) - [Analyst Notes: Serialization Options](https://docs.recordedfuture.com/reference/analyst-note-serialization-options.md) - Search & Lookup - [Analyst Notes: Search](https://docs.recordedfuture.com/reference/analyst-note-search.md): Search published analyst notes from your enterprise and Insikt Group. - [Analyst Notes: Lookup](https://docs.recordedfuture.com/reference/analyst-note-lookup.md): Retrieve a specific analyst note by its ID with configurable serialization level. - [Analyst Notes: Attachment](https://docs.recordedfuture.com/reference/analyst-note-attachment.md): Download the binary attachment file associated with an analyst note. - [Analyst Notes: Export](https://docs.recordedfuture.com/reference/analyst-note-export.md): Export an analyst note as a rendered PDF or HTML file. - Publishing - [Analyst Notes: Draft](https://docs.recordedfuture.com/reference/analyst-note-draft.md): Create a draft analyst note in the database without publishing it. - [Analyst Notes: Preview](https://docs.recordedfuture.com/reference/analyst-note-preview.md): Preview a rendered analyst note with entity resolution without saving it. - [Analyst Notes: Publish](https://docs.recordedfuture.com/reference/analyst-note-publish.md): Publish an analyst note, making it visible to your organization. - [Analyst Notes: Delete](https://docs.recordedfuture.com/reference/analyst-note-delete.md): Permanently delete an analyst note owned by your organization. ## API Documentation: Attack Surface Intelligence - Project - [List Projects](https://docs.recordedfuture.com/reference/project-list_projects.md): Retrieve the projects your user has access to. - Assets - [Search Assets](https://docs.recordedfuture.com/reference/assets-search_assets.md): Search assets in a project, with filtering, sorting and pagination. Filter with the `filter` field. Each field supports a subset of the operators `eq`, `neq`, `in`, `nin`, `start`, `end` and… - [Find Assets](https://docs.recordedfuture.com/reference/assets-find_assets.md): Find assets in a project using filters passed as query parameters. A more lightweight alternative to POST /_search for simpler queries. Some query parameters are not filters but control pagination,… - [Read Asset](https://docs.recordedfuture.com/reference/assets-read_asset.md): Retrieve a specific asset by its ID within a project. Use the `additional_fields` to specify any extra information you want returned about the asset. By default only `custom_tags` is returned;… - [List Asset Exposures](https://docs.recordedfuture.com/reference/assets-list_asset_exposures.md): Retrieve the list of exposures for an asset. Each exposure includes its `signature`, `vulnerabilities`, the `instances` with the port it was present on, and more as described by response schema. - [Get Filters](https://docs.recordedfuture.com/reference/assets-get_filters.md): Retrieve the available filters for assets in the project. The return values are unfiltered so represents a "top-level" set of filter values. A custom set of filter can be requested by passing a… - [Get Filters With Filter](https://docs.recordedfuture.com/reference/assets-get_filters_with_filter.md): Retrieve available filters for assets in project similar to `GET` endpoint. Include filter parameters in the request body to get filter values based on a filtered assets, similar to `/_search`. The… - [Apply Tag To Asset](https://docs.recordedfuture.com/reference/assets-apply_tag_to_asset.md): Apply a single user-defined tag to a specific asset. As tagging is an asynchronous operation, the API will wait up to 2 seconds for the backend to complete but if it is still not complete in that… - [Remove Tag From Asset](https://docs.recordedfuture.com/reference/assets-remove_tag_from_asset.md): Remove a specific user-defined tag from an asset. NOTE: If the tag is not on the asset, the request will be treated as successful. As tagging is an asynchronous operation, the API will wait up to 2… - [Bulk Add Remove Asset Tags](https://docs.recordedfuture.com/reference/assets-bulk_add_remove_asset_tags.md): Add and remove tags from the given asset. As tagging is an asynchronous operation, the API will wait up to 2 seconds for the backend to complete but if it is still not complete in that time, the… - Tagging - [Get Tags](https://docs.recordedfuture.com/reference/tagging-get_tags.md): Request the user-defined tags for the project. - [Get Custom Tag Task Status](https://docs.recordedfuture.com/reference/tagging-get_custom_tag_task_status.md): Get asset tagging status when it wasn't complete during first attempt NOTE: Even if the response includes `complete: true` there may still be a slight delay before requests allow for filtering or… - [Bulk Add Remove Assets](https://docs.recordedfuture.com/reference/tagging-bulk_add_remove_assets.md): Bulk tag assets within the project. This method allows you, on an asset-by-asset, basis to add and remove tags which may be applied to them. As tagging is an asynchronous operation, the API will… - [Bulk Tag Assets By Filter](https://docs.recordedfuture.com/reference/tagging-bulk_tag_assets_by_filter-1.md): Bulk tag assets in the project by filter, same filters as used in the `_search` endpoint can be used. This method allows you to add and remove tags which may be applied to assets matching the… - [Add Tag](https://docs.recordedfuture.com/reference/tagging-add_tag.md): Add a new user-defined tag to the project to be added to assets later. If the tag already exists, it will be returned without error. - Exposures - [List Exposures](https://docs.recordedfuture.com/reference/exposures-list_exposures.md): Retrieve the exposure signatures found on assets in the project, along with the count of affected assets for each signature. The list can be filtered by CVE, CVSS score, CWE or severity, or searched… - [Get Exposure Assets](https://docs.recordedfuture.com/reference/exposures-get_exposure_assets.md): Retrieve the assets for a specific `signature_id`. If `next_cursor` is present in the response, it can be used to fetch the next page of results by passing it as `cursor`. - [Get Exposure Evidence](https://docs.recordedfuture.com/reference/exposures-get_exposure_evidence-1.md): Fetch scan evidence for the given evidence identifiers. - Rules - [Get Static Assets](https://docs.recordedfuture.com/reference/rules-get_static_assets.md): Gets static assets for your project using the path parameter `project_id`. The response will include a list of static assets with their detail. The returned data can be filtered by `asset`,… - [Add Static Assets](https://docs.recordedfuture.com/reference/rules-add_static_assets.md): Allows you to perform bulk operations on static asset rules for your project. Rules can either be added or removed in bulk, with a maximum of 1000 rules per request. To update a rule, applies for… - Signatures - [List Signatures](https://docs.recordedfuture.com/reference/signatures-list_signatures-1.md): List signatures matching the given filters. Unlike `/exposures`, signatures don't need to be related to an asset in the project, and don't include affected asset information. If `next_cursor` is… - [Get Signature](https://docs.recordedfuture.com/reference/signatures-get_signature-1.md): Fetch data for a signature by its `signature_id`. The signature does not need to be related to an exposure in your project. Use `additional_fields` to specify additional enrichments to include in… ## API Documentation: Autonomous Threat Operations - Intelligence Sources - [Get Sources](https://docs.recordedfuture.com/reference/sources-list.md): List all custom intelligence sources in your account. - [Create Source](https://docs.recordedfuture.com/reference/sources-create.md): Register a new custom intelligence source as a container for publishing threat reports. - [Get Source](https://docs.recordedfuture.com/reference/sources-get.md): Retrieve metadata for a specific custom intelligence source. - [Update Source](https://docs.recordedfuture.com/reference/sources-update.md): Modify the name or description of an existing custom intelligence source. - [Publish Reports](https://docs.recordedfuture.com/reference/sources-publish-reports.md): Submit threat intelligence reports with observables, TTPs, and threat actor associations to a custom source. - Threat Hunting - [Get Pending Jobs](https://docs.recordedfuture.com/reference/threat-hunting-jobs-pending.md): Poll for threat hunt jobs awaiting execution by an integration. - [Get Job Indicators](https://docs.recordedfuture.com/reference/threat-hunting-job-indicators.md): Fetch threat indicators from a completed hunt job, optionally enriched with risk scores. - [Get Job Detection Rules](https://docs.recordedfuture.com/reference/threat-hunting-job-rules.md): Fetch detection rules from a threat hunt job scoped to its time window. - [Update Job Status](https://docs.recordedfuture.com/reference/threat-hunting-job-status.md): Transition a threat hunt job through its lifecycle (started, completed, failed) with optional outcome details. - [Query Profiles](https://docs.recordedfuture.com/reference/threat-hunting-profiles-query.md): Discover threat hunting profiles configured for your organization with schedules and lookback windows. - Threat Detection - [Query Profiles](https://docs.recordedfuture.com/reference/threat-detection-profiles-query.md): Discover threat detection profiles with continuously-updated indicators and detection rules. - [Get Profile Indicators](https://docs.recordedfuture.com/reference/threat-detection-profile-indicators.md): Fetch continuously-updated threat indicators from a detection profile with optional risk score enrichment. - [Get Profile Detection Rules](https://docs.recordedfuture.com/reference/threat-detection-profile-rules.md): Fetch deployable detection rules (Sigma, Snort, YARA) from a detection profile. - Threat Prevention - [Query Profiles](https://docs.recordedfuture.com/reference/threat-prevention-profiles-query.md): Discover threat prevention profiles with curated block lists of confirmed-malicious indicators. - [Get Profile Indicators](https://docs.recordedfuture.com/reference/threat-prevention-profile-indicators.md): Fetch the block list of confirmed-malicious indicators from a prevention profile. - [Get Profile Detection Rules](https://docs.recordedfuture.com/reference/threat-prevention-profile-rules.md): Fetch supplementary detection rules from a prevention profile tagged with MITRE ATT&CK techniques. ## API Documentation: Collective Insights - [Collective Insights: Overview](https://docs.recordedfuture.com/reference/collective-insights.md) - Detections - [Submit detected IOCs to the Collective Insights](https://docs.recordedfuture.com/reference/collective-insights-submit-detections.md): This operation sends a list of indicators of compromise (IOC) detections to Collective Insights. Submissions are associated with the API key's enterprise and are used to provide enhanced intelligence… - Search - [Search Collective Insights events](https://docs.recordedfuture.com/reference/collective-insights-search.md): Search previously submitted events processed in Collective Insights analysis and enriched with associated threat entities (threat actors, malware, TTPs). This operation allows querying enriched… - Exclusions - [Create an exclusion list item](https://docs.recordedfuture.com/reference/collective-insights-create-exclusion.md): Creates a new exclusion list item for the specified organization. - [List exclusion list items for an organization](https://docs.recordedfuture.com/reference/collective-insights-list-exclusions.md): Returns a page of exclusion list items for the specified organization, newest change first. - [List audit log records for an organization's exclusion list](https://docs.recordedfuture.com/reference/collective-insights-list-exclusion-audit-log.md): Returns a page of the audit log for the specified organization's exclusion list. A record is created for every create, update, and delete operation on an exclusion list item. Records are returned… - [Delete an exclusion list item](https://docs.recordedfuture.com/reference/collective-insights-delete-exclusion.md): Deletes an exclusion list item for the specified organization. - [Update the comment on an exclusion list item](https://docs.recordedfuture.com/reference/collective-insights-update-exclusion.md): Updates the comment on an existing exclusion list item. ## API Documentation: Detection Rules - Search & Associations - [Search Detection Rules](https://docs.recordedfuture.com/reference/detection-rules-search.md): Search Insikt Group detection rules with deployable YARA, Sigma, and Snort source code. - [Associated Entities](https://docs.recordedfuture.com/reference/detection-rules-associated-entities.md): List all entities linked to at least one detection rule, usable as search filters. - [Associated Entity Types](https://docs.recordedfuture.com/reference/detection-rules-associated-entity-types.md): List entity type categories that appear across Insikt Group detection rules. ## API Documentation: Enrichment and Risk Lists - [Enrichment: Field Attributes](https://docs.recordedfuture.com/reference/enrichment-field-attributes.md) - Company - [Search for Company entities based on a filter](https://docs.recordedfuture.com/reference/company-search.md): Find companies by name, risk score, industry, or risk rules with paginated risk assessment results. - [Lookup a Company entity by id](https://docs.recordedfuture.com/reference/company-lookup.md): Get full company enrichment including risk scoring, triggered-rule evidence, analyst notes, and relationships. - [Lookup Company by domain](https://docs.recordedfuture.com/reference/company-lookup-by-domain.md): Resolve a domain to its associated company entity with risk scoring and threat intelligence enrichment. - [List Company risk rules.](https://docs.recordedfuture.com/reference/company-risk-rules.md): Get the catalog of company risk rules with criticality levels, entity counts, and NIST CSF codes. - Domain - [Search for Domain entities based on a filter](https://docs.recordedfuture.com/reference/domain-search.md): Find domains by risk score, risk rules, dates, or list membership with paginated enrichment results. - [Lookup a Domain entity by id](https://docs.recordedfuture.com/reference/domain-lookup.md): Get full domain enrichment including risk scoring, AI insights, and relationships to threat actors and attack infrastructure. - [List Domain risk rules](https://docs.recordedfuture.com/reference/domain-risk-rules.md): Get the catalog of ~78 domain risk rules with criticality levels, entity counts, and MITRE ATT&CK codes. - [Fetch Domain risk list](https://docs.recordedfuture.com/reference/domain-risk-list.md): Download domains filtered by risk rule in CSV/Splunk or STIX format for SIEM and firewall integration. - [Stat a domain risk list](https://docs.recordedfuture.com/reference/domain-stat-risk-list.md): Check domain risk list for changes via ETag headers without downloading the full file. - [Lookup a Domain entity by id by querying an Intelligence Card extension](https://docs.recordedfuture.com/reference/domain-lookup-extension.md): Get third-party enrichment for a domain from extensions like SecurityTrails, VirusTotal, or Shodan. - [Fetch Domain risk list demo events](https://docs.recordedfuture.com/reference/domain-demo-events.md): Get simulated Squid proxy logs with risky domains for testing SIEM integrations, refreshed every four hours. - Hash - [Search for Hash entities based on a filter](https://docs.recordedfuture.com/reference/hash-search.md): Find file hashes by risk score, risk rules, algorithm type, or dates with paginated enrichment results. - [Lookup a Hash entity by id](https://docs.recordedfuture.com/reference/hash-lookup.md): Get full hash enrichment including risk scoring, malware family attribution, and MITRE ATT&CK mappings. - [List Hash risk rules](https://docs.recordedfuture.com/reference/hash-risk-rules.md): Get the catalog of hash risk rules with criticality levels, entity counts, and malware-focused MITRE ATT&CK codes. - [Fetch Hash risk list](https://docs.recordedfuture.com/reference/hash-risk-list.md): Download file hashes filtered by risk rule in CSV/Splunk or STIX format for SIEM and EDR integration. - [Stat a hash risk list](https://docs.recordedfuture.com/reference/hash-stat-risk-list.md): Check hash risk list for changes via ETag headers without downloading the full file. - [Lookup a Hash entity by id by querying an Intelligence Card extension](https://docs.recordedfuture.com/reference/hash-lookup-extension.md): Get third-party enrichment for a hash from extensions like PolySwarm, VirusTotal, or ReversingLabs. - [Fetch Hash risk list demo events](https://docs.recordedfuture.com/reference/hash-demo-events.md): Get simulated Symantec EP logs with risky file hashes for testing SIEM/EDR integrations, refreshed every four hours. - IP - [Search for IP Address entities based on a filter](https://docs.recordedfuture.com/reference/ip-search.md): Find IP addresses by risk score, threat rules, dates, or geolocation with paginated enrichment results. - [Lookup a IP Address entity by id](https://docs.recordedfuture.com/reference/ip-lookup.md): Get full IP enrichment including risk scoring, geolocation, DNS, open ports, and threat actor relationships. - [List IP Address risk rules](https://docs.recordedfuture.com/reference/ip-risk-rules.md): Get the catalog of ~90 IP risk rules with criticality levels, entity counts, and MITRE ATT&CK codes. - [Fetch IP Address risk list](https://docs.recordedfuture.com/reference/ip-risk-list.md): Download IP addresses filtered by risk rule in CSV/Splunk or STIX format for SIEM and firewall integration. - [Stat a IP Address risk list](https://docs.recordedfuture.com/reference/ip-stat-risk-list.md): Check IP address risk list for changes via ETag headers without downloading the full file. - [Lookup a IP Address entity by id by querying an Intelligence Card extension](https://docs.recordedfuture.com/reference/ip-lookup-extension.md): Get third-party enrichment for an IP from extensions like Shodan, GreyNoise, Censys, or VirusTotal. - [Fetch IP Address risk list demo events](https://docs.recordedfuture.com/reference/ip-demo-events.md): Get simulated Juniper NetScreen syslogs with risky IPs for testing SIEM integrations, refreshed every four hours. - Malware - [Search for Malware entities based on a filter](https://docs.recordedfuture.com/reference/malware-search.md): Find malware families and tools by name or filter criteria; malware entities do not have risk scores. - [Lookup a Malware entity by id](https://docs.recordedfuture.com/reference/malware-lookup.md): Get full malware enrichment including classification, MITRE ATT&CK mappings, and threat actor associations. - [Lookup a Malware entity by id by querying an Intelligence Card extension](https://docs.recordedfuture.com/reference/malware-lookup-extension.md): Get third-party enrichment for a malware entity from Intelligence Card extensions. - URL - [Search for URL entities based on a filter](https://docs.recordedfuture.com/reference/url-search.md): Find URLs by risk score, risk rules, or date ranges with paginated enrichment results. - [Lookup a URL entity by id](https://docs.recordedfuture.com/reference/url-lookup.md): Get full URL enrichment including risk scoring, AI threat analysis, and malware family relationships. - [List URL risk rules](https://docs.recordedfuture.com/reference/url-risk-rules.md): Get the catalog of ~40 URL risk rules with criticality levels, entity counts, and MITRE ATT&CK codes. - [Fetch URL risk list](https://docs.recordedfuture.com/reference/url-risk-list.md): Download URLs filtered by risk rule in CSV/Splunk or STIX format for SIEM and web proxy integration. - [Stat a URL risk list](https://docs.recordedfuture.com/reference/url-stat-risk-list.md): Check URL risk list for changes via ETag headers without downloading the full file. - [Lookup a URL entity by id by querying an Intelligence Card extension](https://docs.recordedfuture.com/reference/url-lookup-extension.md): Get third-party enrichment for a URL from extensions like VirusTotal, Kaspersky, or Mandiant. - [Fetch URL risk list demo events](https://docs.recordedfuture.com/reference/url-demo-events.md): Get simulated Squid proxy logs with risky URLs for testing SIEM integrations, refreshed every four hours. - Vulnerability - [Search for Vulnerability entities based on a filter](https://docs.recordedfuture.com/reference/vulnerability-search.md): Find vulnerabilities by CVSS score, risk score, exploitation status, or affected product for patch prioritization. - [Lookup a Vulnerability entity by id](https://docs.recordedfuture.com/reference/vulnerability-lookup.md): Get full CVE enrichment including severity, exploitation status, and threat actor and malware linkages. - [List Vulnerability risk rules](https://docs.recordedfuture.com/reference/vulnerability-risk-rules.md): Get the catalog of vulnerability risk rules with criticality levels, entity counts, and exploitation-focused MITRE ATT&CK codes. - [Fetch Vulnerability risk list](https://docs.recordedfuture.com/reference/vulnerability-risk-list.md): Download CVEs filtered by risk rule in CSV or STIX format for vulnerability management and patching. - [Stat a Vulnerability risk list](https://docs.recordedfuture.com/reference/vulnerability-stat-risk-list.md): Check vulnerability risk list for changes via ETag headers without downloading the full file. - [Lookup a Vulnerability entity by id by querying an Intelligence Card extension](https://docs.recordedfuture.com/reference/vulnerability-lookup-extension.md): Get third-party enrichment for a vulnerability from extensions like EPSS, ReversingLabs, or AlienVault. - [Fetch Vulnerability risk list demo events](https://docs.recordedfuture.com/reference/vulnerability-demo-events.md): Get simulated vulnerability scan findings in NDJSON format for testing parsing logic, refreshed every four hours. ## API Documentation: Entity Match - Matching & Lookup - [Match](https://docs.recordedfuture.com/reference/entity-match.md): Resolve human-readable entity names to Recorded Future entity IDs using fuzzy matching, with an optional type filter to narrow results to specific entity categories. - [Lookup](https://docs.recordedfuture.com/reference/entity-lookup.md): Resolve an RF entity ID to its name, type, and aliases. - [Entity Types and ID Prefixes](https://docs.recordedfuture.com/reference/available-entity-types.md): Recorded Future entity ID prefixes for building IDs directly, plus every entity type value accepted by the Entity Match type filter. Type values are case sensitive. ## API Documentation: Fusion - File Operations - [Fetch a feed file](https://docs.recordedfuture.com/reference/fusion-files-get.md): Download a file from the Fusion file system by path, including Fusion flow outputs and public Recorded Future-managed files. - [Upload a feed file](https://docs.recordedfuture.com/reference/fusion-files-upload.md): Upload a file to your organization's Fusion file system, making it available for Fusion flows or retrieval via the download endpoint. - [Delete a feed file](https://docs.recordedfuture.com/reference/fusion-files-delete.md): Remove a file from your organization's Fusion file system by path (public Recorded Future-managed files cannot be deleted). - Directory & Metadata - [Fetch the content of a directory](https://docs.recordedfuture.com/reference/fusion-files-list-directory.md): List files and subdirectories in a Fusion file system directory to discover available outputs before downloading. - [Stat a feed file](https://docs.recordedfuture.com/reference/fusion-files-stat.md): Check file metadata (ETag, Last-Modified) without downloading content, enabling efficient polling for changes before a full download. ## API Documentation: Identity Intelligence - Detections - [Detections](https://docs.recordedfuture.com/reference/identity-detections.md): Retrieve identity exposure detections with novel-only filtering and malware family attribution. - Credentials - [Search](https://docs.recordedfuture.com/reference/identity-search.md): Find compromised identities across breach data and stealer logs for one or more domains. - [Lookup](https://docs.recordedfuture.com/reference/identity-lookup.md): Retrieve full exposure history for specific email addresses, usernames, or credential hashes. - [Lookup passwords for exposure](https://docs.recordedfuture.com/reference/identity-password.md): Checks if specified passwords were exposed. - [Hostname Lookup](https://docs.recordedfuture.com/reference/identity-hostname.md): Find credentials compromised from a specific hostname (e.g., internal servers, VPN endpoints). - [IP Lookup](https://docs.recordedfuture.com/reference/identity-ip.md): Find credentials compromised from a specific IP address or IP range. - [Incident Report](https://docs.recordedfuture.com/reference/identity-incident-report.md): Get a detailed exposure incident report for a single malware log, including compromised credentials, device details, and malware attribution. - [Dump Metadata Search](https://docs.recordedfuture.com/reference/identity-dump-metadata.md): Search metadata for data dumps and breach databases by name. ## API Documentation: Links - Links - [Search for links](https://docs.recordedfuture.com/reference/post_search.md): Search for validated relationships between entities in the Links graph. Links represent technically validated relationships between entities — established through sandbox analysis, infrastructure… - Metadata - [Technical analysis event types](https://docs.recordedfuture.com/reference/get_metadata-events.md): Returns a list of available types of technical analysis sources for the link, like Malware Analysis. This can be used to indicate which technical sources that should be included in a search query. - [Target entity types](https://docs.recordedfuture.com/reference/get_metadata-entities.md): Return a list of available types of target entities, this can be used to indicate which entity types should be returned for a query. - [Link sections](https://docs.recordedfuture.com/reference/get_metadata-sections.md): Return a list of available types of links, representing different relationships between target entities and linked entities. ## API Documentation: Lists - [Lists: Supported Entities](https://docs.recordedfuture.com/reference/lists-supported-entities.md) - List Management - [/list/create](https://docs.recordedfuture.com/reference/lists-create.md): Creates a new empty list and returns its metadata including the list ID. - [/list/search](https://docs.recordedfuture.com/reference/lists-search.md): Searches for lists matching optional name, type, and limit filters. - [/list/{listId}/info](https://docs.recordedfuture.com/reference/lists-info.md): Returns metadata for a specific list including name, type, timestamps, and ownership details. - [/list/{listId}/status](https://docs.recordedfuture.com/reference/lists-status.md): Returns the processing status and entity count for a specific list. - Entity Operations - [/list/{listId}/entities](https://docs.recordedfuture.com/reference/lists-entities.md): Returns all entities in the specified list as a JSON array with no pagination. - [/list/{listId}/entity/add](https://docs.recordedfuture.com/reference/lists-add-entity.md): Adds a single entity to the specified list, optionally with context metadata. - [/list/{listId}/entity/remove](https://docs.recordedfuture.com/reference/lists-remove-entity.md): Removes a single entity from the specified list. - [/list/{listId}/textEntries](https://docs.recordedfuture.com/reference/lists-text-entries.md): Returns unstructured text entries stored in the specified list as a JSON array. - Third Parties Watch List Tags - [/list/{listId}/entitiesWithTags](https://docs.recordedfuture.com/reference/lists-entities-with-tags.md): Returns all entities in the specified list along with their assigned tags. - [/list/{listId}/entity/tags](https://docs.recordedfuture.com/reference/lists-replace-entity-tags.md): Replaces all tags on an entity in a Third-Parties Watch List. - [Lists: Available Tags](https://docs.recordedfuture.com/reference/lists-available-tags.md) ## API Documentation: Malware Intelligence - Queries and Reporting - [Query Malware Intelligence data with query language](https://docs.recordedfuture.com/reference/malware-intelligence-query.md): Find and aggregate sandbox artifacts using structured query language. - [Query Malware Intelligence data with natural language](https://docs.recordedfuture.com/reference/malware-intelligence-query-nl.md): Find sandbox artifacts using plain English instead of structured query syntax. - [Query Malware Intelligence data with lists of entities](https://docs.recordedfuture.com/reference/malware-intelligence-query-iocs.md): Find sandbox artifacts by matching against lists of known IOCs instead of query expressions. - [Fetch sandbox reports for a given sha256 hash and query](https://docs.recordedfuture.com/reference/malware-intelligence-sandbox-reports.md): Retrieve detailed behavioral and static analysis reports for a specific sample, ranked by sandbox score. - Auto YARA - [Create an Auto YARA job](https://docs.recordedfuture.com/reference/yara-create-job.md): Generate YARA detection rules by analyzing common byte patterns across malware samples. - [Get all jobs created by user](https://docs.recordedfuture.com/reference/yara-list-jobs.md): List all Auto YARA jobs with status and coverage data, excluding rule text. - [Edit an Auto YARA job](https://docs.recordedfuture.com/reference/yara-edit-job.md): Update the generated YARA rule on an existing job with revised detection logic. - [Get result of a job](https://docs.recordedfuture.com/reference/yara-get-job.md): Retrieve a completed Auto YARA job's generated rule, byte patterns, and sample coverage analysis. - [Delete a Job](https://docs.recordedfuture.com/reference/yara-delete-job.md): Permanently delete an Auto YARA job and its generated rules. - [Retry a Job](https://docs.recordedfuture.com/reference/yara-retry-job.md): Reprocess a failed Auto YARA job without creating a new one. - Auto Sigma - [Create a Auto Sigma job](https://docs.recordedfuture.com/reference/sigma-create-job.md): Generate Sigma detection rules from observed behavioral patterns across malware samples. - [Get all jobs created by user](https://docs.recordedfuture.com/reference/sigma-list-jobs.md): List all Auto Sigma jobs with status and pagination support. - [Get result of a job](https://docs.recordedfuture.com/reference/sigma-get-job.md): Retrieve a specific Auto Sigma job's status, configuration, and generated detection rules. - [Delete a Job](https://docs.recordedfuture.com/reference/sigma-delete-job.md): Permanently delete an Auto Sigma job and its generated rules. - [Update a Sigma Rule](https://docs.recordedfuture.com/reference/sigma-update-job.md): Classify a Sigma rule's detection quality and optionally update its YAML content. - [Retry a Job](https://docs.recordedfuture.com/reference/sigma-retry-job.md): Reprocess a failed Auto Sigma job without creating a new one. ## API Documentation: Payment Fraud Intelligence - Data Retrieval - [Get resulted file for the task](https://docs.recordedfuture.com/reference/pfi-pickup-data.md): Download the completed results of a PFI bulk data task in NDJSON or CSV format. - Images - [Create task to prepare bank account images for download.](https://docs.recordedfuture.com/reference/pfi-bank-account-images.md): Queue bank account document images for download by record IDs. - [Create task to prepare checks images for download.](https://docs.recordedfuture.com/reference/pfi-check-images.md): Queue check document images for download by record IDs. - Scanning Queue - [Adds new domains to the customer specific scanning queue](https://docs.recordedfuture.com/reference/pfi-add-scan-domains.md): Submit up to 10,000 domains to your organization's custom Magecart e-skimmer scanning queue. - [Empties the customer specific scanning queue](https://docs.recordedfuture.com/reference/pfi-clear-scan-queue.md): Remove all domains from your organization's custom Magecart scanning queue. - Bulk Data Requests - [Generate and run new a pipeline from bank account preset input](https://docs.recordedfuture.com/reference/pfi-bank-account-data.md): Queue a bulk export of compromised bank account records scoped to your organization. - [Generate and run new a pipeline from full card preset input](https://docs.recordedfuture.com/reference/pfi-full-card-data.md): Queue a bulk export of compromised full payment card records scoped to your organization. - [Generate and run new a pipeline from partial card input](https://docs.recordedfuture.com/reference/pfi-partial-card-data.md): Queue a bulk export of compromised partial card records with BIN-level data from e-skimmer activity. - [Generate and run new a pipeline from partial card sold input](https://docs.recordedfuture.com/reference/pfi-sold-partial-card-data.md): Queue a bulk export of partial card records filtered by sold date rather than first-observed date. - [Generate and run new a pipeline from bank check preset input](https://docs.recordedfuture.com/reference/pfi-check-data.md): Queue a bulk export of compromised bank check records for your organization. - [Generate and run new a pipeline from CPP preset input](https://docs.recordedfuture.com/reference/pfi-cpp-merchant-data.md): Queue a bulk export of Common Point of Purchase (CPP) merchant records identifying potential points-of-compromise. - [Generate and run new a pipeline from magecart domain input](https://docs.recordedfuture.com/reference/pfi-magecart-domain-data.md): Queue a bulk export of Magecart domain records tracking detected JavaScript card-skimming activity. - [Generate and run new a pipeline from magecart merchant input](https://docs.recordedfuture.com/reference/pfi-magecart-merchant-data.md): Queue a bulk export of merchant-level Magecart records enriched with merchant name and MID. - [Generate and run new a pipeline from magescanner scans input](https://docs.recordedfuture.com/reference/pfi-magescanner-scan-data.md): Queue a bulk export of Magescanner scan results for e-commerce card-skimming threat visibility. - [Generate and run new a pipeline from checker preset input](https://docs.recordedfuture.com/reference/pfi-tester-merchant-data.md): Queue a bulk export of tester merchant records used by fraudsters to validate stolen cards. - Task Management - [Get tasks in queue](https://docs.recordedfuture.com/reference/pfi-list-tasks.md): Retrieve all PFI bulk data tasks in the queue, most recent first. - [Get task status](https://docs.recordedfuture.com/reference/pfi-delete-task.md): Remove a queued PFI bulk data task before it starts executing. - [Get task status](https://docs.recordedfuture.com/reference/pfi-task-status.md): Poll the processing status of a PFI bulk data task to determine when results are ready. ## API Documentation: Risk - Company Risk Rules - [Get a single active risk rule with enriched evidence](https://docs.recordedfuture.com/reference/risk-get-active-risk-rule.md): Fetch a single active risk rule for a company with paginated, rule-type-specific enriched evidence (open ports, leaked credentials, vulnerable products). - Risk History - [Search for risk history](https://docs.recordedfuture.com/reference/risk-search-risk-history.md): Returns change events (not daily snapshots) for the risk score, criticality, and individual risk rules of one or more entities, so you can see when each value became active and when it was replaced. ## API Documentation: Sandbox - Environment - [List geolocations](https://docs.recordedfuture.com/reference/sandbox-list-geolocations.md): List available VPN exit points and regional tags for geographic routing in sandbox analysis. - [List resources](https://docs.recordedfuture.com/reference/sandbox-list-resources.md): List available sandbox VM images, platforms, and capacity limits for profile creation. - Profiles - [List profiles](https://docs.recordedfuture.com/reference/sandbox-list-profiles.md): List all reusable analysis profiles configured for your organization. - [Create profile](https://docs.recordedfuture.com/reference/sandbox-create-profile.md): Create a reusable sandbox analysis profile defining OS, locale, network, timeout, and browser settings. - [Get profile](https://docs.recordedfuture.com/reference/sandbox-get-profile.md): Retrieve a single analysis profile by UUID or name. - [Update profile](https://docs.recordedfuture.com/reference/sandbox-update-profile.md): Fully replace an existing analysis profile configuration (omitted optional fields reset to defaults). - [Delete profile](https://docs.recordedfuture.com/reference/sandbox-delete-profile.md): Permanently remove an analysis profile without affecting previously analyzed samples. - Submissions - [List samples](https://docs.recordedfuture.com/reference/sandbox-list-samples.md): List sandbox samples in reverse chronological order with optional ownership filtering. - [Submit a sample](https://docs.recordedfuture.com/reference/sandbox-submit-sample.md): Submit a file or URL for sandbox malware analysis via upload, fetch, or import modes. - [Get sample details](https://docs.recordedfuture.com/reference/sandbox-get-sample.md): Retrieve a sample's analysis tasks and current processing status. - [Search samples](https://docs.recordedfuture.com/reference/sandbox-search.md): Search sandbox analyses by hash, malware family, tag, or network indicator. - [Delete a sample](https://docs.recordedfuture.com/reference/sandbox-delete-sample.md): Permanently delete a sample and all associated analysis data. - [Set analysis profile](https://docs.recordedfuture.com/reference/sandbox-select-profile.md): Resume a paused interactive-mode submission by selecting analysis profiles for behavioral execution. - Streaming - [Stream all sample events](https://docs.recordedfuture.com/reference/sandbox-stream-all-events.md): Stream real-time NDJSON state-change events for all visible samples without replaying existing state. - [Stream sample events](https://docs.recordedfuture.com/reference/sandbox-stream-sample-events.md): Stream a sample's current state and real-time updates, auto-closing when analysis reaches terminal status. - Reports - [Get static analysis report](https://docs.recordedfuture.com/reference/sandbox-get-static-report.md): Retrieve the static analysis report with file metadata, hashes, PE structure, and YARA matches available before behavioral execution completes. - [Get dynamic analysis report](https://docs.recordedfuture.com/reference/sandbox-get-dynamic-report.md): Retrieve the full behavioral analysis report with process trees, network flows, signatures, and malware configurations. - [Get overview report](https://docs.recordedfuture.com/reference/sandbox-get-sample-overview.md): Retrieve the comprehensive overview report with malware config, signatures, IOCs, and MITRE ATT&CK mappings. - [Get sample summary](https://docs.recordedfuture.com/reference/sandbox-get-sample-summary.md): Retrieve a mid-level analysis summary with per-task threat scores, behavior tags, and signature counts. - [Get URL scan report](https://docs.recordedfuture.com/reference/sandbox-get-url-scan-report.md): Retrieve the URL scan report with Chromium CDP data including HTTP requests, redirects, cookies, and certificates. - [Get URL scan screenshot](https://docs.recordedfuture.com/reference/sandbox-get-url-scan-screenshot.md): Retrieve the PNG screenshot captured during URL scan analysis. - Downloads - [Download original sample](https://docs.recordedfuture.com/reference/sandbox-download-sample.md): Download the originally submitted sample file as unencrypted binary. - [Download sample archive (TAR)](https://docs.recordedfuture.com/reference/sandbox-download-archive-tar.md): Download all analysis artifacts for a completed sample as an uncompressed TAR archive. - [Download sample archive (ZIP)](https://docs.recordedfuture.com/reference/sandbox-download-archive-zip.md): Download all analysis artifacts for a completed sample as a compressed ZIP archive. - Task Artifacts - [Download task file](https://docs.recordedfuture.com/reference/sandbox-download-task-file.md): Download a specific file artifact dropped or extracted during behavioral execution. - [Get behavioral logs](https://docs.recordedfuture.com/reference/sandbox-get-task-logs.md): Download raw kernel/system monitor logs capturing every process, file, registry, and network event from a behavioral task. - [Download PCAP](https://docs.recordedfuture.com/reference/sandbox-download-pcap.md): Download the raw PCAP network capture from a behavioral task (unencrypted traffic only). - [Download PCAPNG](https://docs.recordedfuture.com/reference/sandbox-download-pcapng.md): Download the PCAPNG network capture from a behavioral task, including decrypted HTTPS via embedded TLS key logs. - YARA Rules - [List YARA rules](https://docs.recordedfuture.com/reference/sandbox-list-yara-rules.md): List all custom YARA rule filenames accessible by your account. - [Create YARA rule](https://docs.recordedfuture.com/reference/sandbox-create-yara-rule.md): Add a custom YARA rule compiled and validated server-side for automatic matching in future analyses. - [Get YARA rule](https://docs.recordedfuture.com/reference/sandbox-get-yara-rule.md): Retrieve a YARA rule's source code, compilation status, and any warnings. - [Update YARA rule](https://docs.recordedfuture.com/reference/sandbox-update-yara-rule.md): Update a YARA rule's source code and optionally rename it, with server-side recompilation. - [Delete YARA rule](https://docs.recordedfuture.com/reference/sandbox-delete-yara-rule.md): Permanently remove a YARA rule while preserving existing match results. ## API Documentation: SOAR - Enrichment & Triage - [Fetch risk information for a set of indicators](https://docs.recordedfuture.com/reference/soar-enrich.md): Retrieve risk scores, triggered rules, and evidence for up to 1,000 indicators across six entity types in a single batch call. - [Lookup all available risk contexts](https://docs.recordedfuture.com/reference/soar-get-contexts.md): Retrieve configuration for the malware, phishing, and c2 risk contexts, including default thresholds used by the triage endpoint. - [Triage multiple IOC entities](https://docs.recordedfuture.com/reference/soar-triage-batch.md): Evaluate up to 1,000 indicators against a specific risk context (malware, phishing, or c2) and return a boolean verdict based on context-specific sub-scores. ## API Documentation: STIX TAXII Feeds - [STIX TAXII: Overview](https://docs.recordedfuture.com/reference/stix-taxii-overview.md) - [STIX TAXII: 1.x Service](https://docs.recordedfuture.com/reference/stix-taxii-1x-service.md) - [STIX TAXII: 2.1 Service](https://docs.recordedfuture.com/reference/stix-taxii-21-service.md) - [STIX TAXII: Collections](https://docs.recordedfuture.com/reference/stix-taxii-collections.md) ## API Documentation: Takedowns - [Takedown API](https://docs.recordedfuture.com/reference/takedown-api.md): This is the API for requesting and monitoring takedowns. Provided by Phishfort ## API Documentation: Threat Maps - All Maps - [Available Threat Maps](https://docs.recordedfuture.com/reference/available-threat-maps.md): List all threat maps accessible to the current API token with their organization IDs and map types. - Actors Threat Map - [Threat Actor Threat Map](https://docs.recordedfuture.com/reference/threat-actor-threat-map.md): Rank threat actors by risk to your primary organization using intent and opportunity scores. - [Threat Actor Threat Map for Organization](https://docs.recordedfuture.com/reference/threat-actor-threat-map-org.md): Rank threat actors by risk to a specific organization in a multi-org enterprise. - [Threat Actor Search](https://docs.recordedfuture.com/reference/threat-actor-search.md): Search Recorded Future's threat actor database by name, alias, or classification. - [Threat Actor Categories](https://docs.recordedfuture.com/reference/threat-actor-categories.md): Retrieve the full threat actor category taxonomy used across Recorded Future. - Malware Threat Map - [Malware Threat Map](https://docs.recordedfuture.com/reference/malware-threat-map.md): Rank malware families by prevalence and opportunity scores for your primary organization. - [Malware Threat Map for Organization](https://docs.recordedfuture.com/reference/malware-threat-map-org.md): Rank malware families by prevalence and opportunity scores for a specific organization. - [Malware Categories](https://docs.recordedfuture.com/reference/malware-categories.md): Retrieve the full malware classification taxonomy with valid category identifiers for filtering. ## API Documentation: RiskRecon V0 - IndustryTrends - [Gets Industry trends data given a TOE id](https://docs.recordedfuture.com/reference/customerapiswebv0industrytrendscontrollerindustry_trends.md): Gets Industry trends data given a TOE id - Portfolio - [Portfolio member data including company description and domain ratings by security domain. If you are reading this and were filtering by analysis_id, please switch over to TOE_ID at your earliest convenience](https://docs.recordedfuture.com/reference/customerapiswebv0portfoliocontrollerportfolio_member_by_analysis_id.md): Portfolio member data including company description and domain ratings by security domain. If you are reading this and were filtering by analysis_id, please switch over to TOE_ID at your earliest… ## API Documentation: RiskRecon CPE V0 - CPE - [query service by product and version, language and security_criteria using the query params](https://docs.recordedfuture.com/reference/cpewebcpecontrollerquery_with_language.md): query service by product and version, language and security_criteria using the query params - [query threat_intel service by ip or host_name using the query params](https://docs.recordedfuture.com/reference/cpewebcpecontrollerthreat_intel_query.md): query threat_intel service by ip or host_name using the query params. Each is optional but one is required. - [query vulnerabilities by product and version using the query param](https://docs.recordedfuture.com/reference/cpewebcpecontrollerquery.md): query vulnerabilities by product and version using the query param - [query language and security_criteria using the query params](https://docs.recordedfuture.com/reference/cpewebcpecontrollerraw_language.md): query language and security_criteria using the query params - [lookup product association with given cves](https://docs.recordedfuture.com/reference/cpewebcpecontrollercve_product_lookup.md): lookup product association with a given cves ## API Documentation: RiskRecon V1 - Action Plans - [This resource returns action plan configurations both automated and manual for a given TOE.](https://docs.recordedfuture.com/reference/getactionplanconfig.md): This API returns action plan configurations both automated and manual for a given TOE. The end-user needs to input the TOE ID (toe_id) for a given action plan in the API request. - [This resource sends action plan email to recipients of a TOE.](https://docs.recordedfuture.com/reference/shareactionplan.md): This API sends action plan findings to internal and external recipients. The end-user needs to input the TOE ID (toe_id) for a given action plan in the API request. Recipients and frequency are… - [This resource returns a list of finding details from an action plan of a TOE.](https://docs.recordedfuture.com/reference/getactionplanfindings.md): This API returns a list of findings for a given action plan of a TOE. The end-user needs to input the TOE ID (toe_id) for a given action plan in the API request. - [This resource tracks and reports a vendors progress in addressing action plan issues.](https://docs.recordedfuture.com/reference/actionplanissueprogress.md): RiskRecon automatically reports each vendor’s progress in addressing their action plan issues. This API returns issue progress for a given action plan. - [This resource returns a vendor's action plan issue summary.](https://docs.recordedfuture.com/reference/getactionplanissuesummary.md): This API returns a list of issue summaries for a given action plan. There are no parameters for this use case. The end-user needs to input the TOE ID (toe_id) for a given action plan in the API… - [This API returns the count of current action plan issues per their severity and priority.](https://docs.recordedfuture.com/reference/getactionplanprioritymatrix.md): This API returns the counts of action plans as per their severity and priority. Found issues are assigned a Priority and Severity index. The end-user needs to input the TOE ID (toe_id) for a given… - [This API returns the vendor status summary counts of a given action plan.](https://docs.recordedfuture.com/reference/getactionplanvendorstatussummarycounts.md): This API returns the vendor status summary counts of a given action plan. The end-user needs to input the TOE ID (toe_id) for a given action plan in the API request. In this scenario, the following… - Alerts - [This resource returns Alerting Issues from new scans in their portfolio based on the users alert settings.](https://docs.recordedfuture.com/reference/getalertingnewissues.md): This resource returns Alerting Issues from new scans in their portfolio based on the users alert settings. Alert settings can be changed at… - [This resource returns any rating/score changes from new scans in the users portfolio based on the users alert settings.](https://docs.recordedfuture.com/reference/getalertingscorechanges.md): This resource returns any rating/score changes from new scans in the users portfolio based on the users alert settings. Alert settings can be changed at… - Analyses - [:: Legacy Route Please use getToeRatings :: This resource returns the most recent `Analysis` object by the TOE identifier. Trend data is only included if `include_trend` query param is added.](https://docs.recordedfuture.com/reference/getanalysisratings.md): :: Legacy Route Please use getToeRatings :: This resource returns the most recent `Analysis` object by the TOE identifier. This includes the security domain and criteria ratings. Trend data is only… - [:: Legacy Route Please use getToeRatings :: This resource returns a collection of historical `Analysis` objects by the TOE identifier.](https://docs.recordedfuture.com/reference/gethistoricalanalysisratings.md): :: Legacy Route Please use getTOERatings :: This resource returns a collection of historical `Analysis` objects by the TOE identifier. This includes the security domain and criteria ratings for each… - Compliance - [This resource returns an list of custom and industry standards.](https://docs.recordedfuture.com/reference/getriskstandards.md): This resource returns an list of custom and industry standards. Each standard has a number of controls. Some of these will be mapped to RiskRecon security domain and criteria and will have the… - [This resource returns risk standard controls associated with a TOE id and a particular custom or industry standard.](https://docs.recordedfuture.com/reference/getriskstandardscontrols.md): This resource returns risk standard controls associated with a TOE id and a particular custom or industry standard. The risk standard id can be obtained from the /v1/compliance/{toe_id} response.… - Data Loss Events - [This resource returns a collection of `BreachEvent` objects.](https://docs.recordedfuture.com/reference/getbreachevents.md): This resource returns a collection of `DataLossEvent` objects for a portfolio. This is for the entire portfolio and has pagination unlike the data_loss_events route. - [:: Legacy Route :: This resource returns a collection of `DataLossEvent` objects.](https://docs.recordedfuture.com/reference/getdatalossevents.md): "::Legacy Route please use portfolio_data_loss_events:: This resource returns a collection of `DataLossEvent` objects for a given TOE id. This are referred to as Breach Events in the RiskRecon site." - Display Name - [This resource returns a mapping of security_criteria labels and their current display names in the RiskRecon portal.](https://docs.recordedfuture.com/reference/getcriteriadisplaynames.md): This resource returns a mapping of security_criteria labels and their current display names in the RiskRecon portal. It also includes if the security_criteria is currently rated and if it is… - [This resource returns a mapping of security_domain labels and their current display names in the RiskRecon portal.](https://docs.recordedfuture.com/reference/getdomaindisplaynames.md): This resource returns a mapping of security_domain labels and their current display names in the RiskRecon portal. It also includes if the security_domain is currently rated and if it is deprecated. - Findings - [This resource returns a list of findings for latest analysis for a given TOE.](https://docs.recordedfuture.com/reference/getpaginatedfindings.md): This use case describes how the Findings API is used to retrieve a list of findings for the latest analysis for a TOE. The toe_id is passed in the API request. In this scenario, all findings for that… - [:: Legacy Route :: This resource returns a list of findings for latest analysis for a given TOE.](https://docs.recordedfuture.com/reference/getfindings.md): ::Legacy Route please use findings_paginated:: This use case describes how the Findings API is used to retrieve a list of findings for the latest analysis for a TOE. The toe_id is passed in the API… - Hosts - [This resource returns a list of Hosts for latest analysis for a given TOE.](https://docs.recordedfuture.com/reference/gethosts.md): This resource returns a list of Hosts for latest analysis for a given TOE. This includes domain and netblock information as well. - Integration Routes - [The Integration Routes API provides a list of URLs for the security domains within the Security Profile section of the RiskRecon Portal.](https://docs.recordedfuture.com/reference/getintegrationroutes.md): The Integration Routes API provides a list of URLs for the security domains within the Security Profile section of the RiskRecon Portal. If one of the URLs is followed by an unauthenticated user,… - [The Integration Routes Details API provides a list of URLs for the detailed views within each security domain in the Security Profile and its corresponding risk_dimensions section of the RiskRecon Portal.](https://docs.recordedfuture.com/reference/getintegrationroutesdetails.md): The Integration Routes Details API provides a list of URLs for the detailed views within each security domain in the Security Profile and its corresponding risk_dimensions section of the RiskRecon… - Portfolio - [This endpoint is for requesting to add new TOEs (targets of evaluation) to your portfolio.](https://docs.recordedfuture.com/reference/bulktoerequest.md): This is a bulk request for requesting to add new TOEs (targets of evaluation) to your portfolio. The request must have at least one item but no more than 25 per request. - [This endpoint adds and updates subscription licenses for a TOE.](https://docs.recordedfuture.com/reference/changesubscription.md): This request sets the list of subscription licenses that determine whether a TOE appears in your portfolio, and for which risk dimensions. The currently available Risk Dimensions are CYBER and… - [This resource gets the customer's risk relationship folders names and slugs.](https://docs.recordedfuture.com/reference/getriskrelationshipsfolders.md): This resource gets the customer's risk relationship folders names and slugs. The slug will be used in requests that require the risk relationship. Risk relationships can be updated here… - [This resource returns the default subscription_level for bulk toe requests for your customer.](https://docs.recordedfuture.com/reference/getsubscriptionlevelconfig.md): This resource returns the default subscription_level for bulk toe requests for your customer if it has been set. This can be set if you want all /v1/portfolio/bulk_add requests to have the same… - [This resource sets the default subscription_level for bulk toe requests for your customer.](https://docs.recordedfuture.com/reference/setsubscriptionlevelconfig.md): This resource sets the default subscription_level for bulk toe requests for your customer if it has been set. This can be set if you want all /v1/portfolio/bulk_add requests to have the same… - Subsidiaries - [This route returns a collection of `Subsidiary` objects associated with a toe.](https://docs.recordedfuture.com/reference/getsubsidiariesbytoeid.md): This route returns a collection of `Subsidiary` objects associated with a toe. Any TOEs that appear to be a subsidiary of the provided TOE id are returned in the response. - Target Of Evaluation TOE - [This resource returns a collection of `TOE` objects mapped to a customer.](https://docs.recordedfuture.com/reference/gettoes.md): This API retrieves a collection of TOE objects mapped to a customer. This include overall ratings and some domain rating information for the current analysis of the provided TOE id. As a TOE can have… - [This resource gets a `TOE` object by its identifier.](https://docs.recordedfuture.com/reference/gettoesbytoeid.md): This resource gets a `TOE` object by its identifier. This include overall ratings and some domain rating information for the current analysis of the provided TOE id. - [This endpoint adds an existing TOE to the users portfolio.](https://docs.recordedfuture.com/reference/addcompanytotoebytoeid.md): This endpoint adds an existing TOE to the users portfolio. The toe_id and other information can be obtained from the /v1/toes/by_domains response. - [This endpoint allows a user to update the internal_ids and/or internal_name of an existing `TOE` by its identifier.](https://docs.recordedfuture.com/reference/updatetoesbytoeid.md): This endpoint allows a user to update the internal_ids and/or internal_name of an existing `TOE` by its identifier. These can be used to map a TOE in the RiskRecon system to an entity in the users… - [This endpoint deletes an existing TOE to the users portfolio.](https://docs.recordedfuture.com/reference/deletetoebytoeid.md): User can delete a TOE from their portfolio by providing the toe_id in endpoint. - [This resource returns a collection of `TOE` objects mapped to a customer.](https://docs.recordedfuture.com/reference/getpaginatedtoes.md): This API retrieves a collection of TOE objects mapped to a customer. This include overall ratings and some domain rating information for the current analysis of the provided TOE id. As a TOE can have… - [This endpoint allows the user to search for a TOE by a valid domain or hostname.](https://docs.recordedfuture.com/reference/gettoebydomain.md): This endpoint allows the user to search for a TOE by a valid domain or hostname. The user must provide a valid domain or hostname in domain query param. - [This endpoint allows the user to search for Company name, TOE ID by a valid CVE.](https://docs.recordedfuture.com/reference/gettoebycve.md): This endpoint allows the user to search for Company name, TOE ID by a valid CVE. The user must provide a valid cve in query param. - [Get the current or historical overall, domain and criteria ratings for a given TOE and a given risk dimension.](https://docs.recordedfuture.com/reference/gettoeratings.md): Get the current or historical overall, domain and criteria ratings for a given TOE and a given risk dimension. Privacy can only be returned if privacy is enabled for your customer and you have a… - [This endpoint moves an existing TOE from one risk relationship folder to another](https://docs.recordedfuture.com/reference/movetoerequest.md): User can move a TOE from one risk relationship folder to another by providing the toe_id and relationship folder slug in request. Relationship folder slug can be retrieved from… - Users - [The User route is used to get all the user data for one’s organization.](https://docs.recordedfuture.com/reference/getuserdata.md): The User route is used to get all the user data for one’s organization. There currently are no filters or params. - TOE Reports - [This resource allows the ordering and downloading of toe reports](https://docs.recordedfuture.com/reference/requestpdfreport.md): This endpoint provides the ordering of the following toe reports: - Executive Report - The Executive Report (executive-report) provides an executive summary of the RiskRecon ratings and security… - [This resource returns the list of active report request.](https://docs.recordedfuture.com/reference/requestpdfreportstatus.md): This resource returns all report requests submitted in the last 24 hours by the client. - [This resource returns the PDF report.](https://docs.recordedfuture.com/reference/downloadpdfreport.md): This resource gets the PDF report. - Reports - [Get portfolio ratings report](https://docs.recordedfuture.com/reference/getpaginatedportfolioratingsreport.md): Retrieves a paginated list of portfolio ratings with their changes over time - Privacy - [This resource returns a collection of `EnforcementAction` objects.](https://docs.recordedfuture.com/reference/getenforcementactions.md): This resource returns a collection of `EnforcementAction` in portfolio. ## API Documentation: RiskRecon V2 - Finding - [Streaming Newline delimited JSON response containing findings for latest analysis for a given TOE, security domain and security criteria. Swagger didn't have a way of showing this so please don't let the schema of mislead you with the array of findings](https://docs.recordedfuture.com/reference/customerapiswebv2findingcontrollerby_security_criteria.md): Streaming Newline delimited JSON response containing findings for latest analysis for a given TOE, security domain and security_criteria. Use include_all param to include all findings.… - [Streaming Newline delimited JSON response containing findings for latest analysis for a given TOE and security domain. Swagger didn't have a way of showing this so please don't let the schema of mislead you with the array of findings](https://docs.recordedfuture.com/reference/customerapiswebv2findingcontrollerby_security_domain.md): Streaming Newline delimited JSON response containing findings for latest analysis for a given TOE and security domain. Use include_all param to include all findings. Unfortunately, swagger UI can't… - [Retrieve finding given toe id and finding id](https://docs.recordedfuture.com/reference/customerapiswebv2findingcontrollershow.md): Retrieve finding given toe id and finding id - [Streaming Newline delimited JSON response containing findings for latest analysis for a given TOE. Swagger didn't have a way of showing this so please don't let the schema of mislead you with the array of findings](https://docs.recordedfuture.com/reference/customerapiswebv2findingcontrollerindex.md): Streaming Newline delimited JSON response containing findings for latest analysis for a given TOE. Use include_all param to include all findings. Swagger didn't have a way of showing this so please…