API Documentation

Malware Intelligence: Query by IOCs

post
https://api.recordedfuture.com/malware-intelligence/v1/query_iocs

Find sandbox artifacts by matching against lists of known IOCs instead of query expressions.

Body Params
sha256_list
array of strings

Lists of indicators of compromise (IOCs) grouped by type.

sha256_list
ip_list
array of strings

Lists of indicators of compromise (IOCs) grouped by type.

ip_list
domain_list
array of strings

Lists of indicators of compromise (IOCs) grouped by type.

domain_list
url_list
array of strings

Lists of indicators of compromise (IOCs) grouped by type.

url_list
string
enum
required

Field of Malware Intelligence data to return data for

string
enum
Defaults to and

Query operator for building malware intelligence search expressions.

Allowed:
date
required

Earliest date to include in the query (cannot be before 2023-11-01)

date

Latest date to include in the query, defaults to today in UTC

boolean

Only include samples submitted by your enterprise in the query (defaults to false)

integer

Page number to return. Pages are zero-indexed. (Defaults to 0)

boolean

Include sandbox score in the response

boolean

Include universal report and intelligence card URLs in the response

boolean

Whether to sanitize returned results. When omitted the service will default to false.

Response

Updated about 1 month ago

Language
Credentials
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json

Updated about 1 month ago