What this endpoint does

Retrieves malware enrichment data from a specific third-party intelligence provider integrated into the Recorded Future platform. Requires pre-configured provider credentials — unconfigured providers return 401. Obtain malware entity IDs via Malware: Search or Malware: Lookup.

The extension path parameter must be one of these exact lowercase strings (the prose description uses different capitalization — use these values):

reversinglabs — malware classification and sample analysis
mandiant — threat actor associations and campaign intelligence
xforce — IBM X-Force threat intelligence
bitsight — BitSight security ratings
facebookte — Facebook Threat Exchange
hunter_malware — Hunter malware intelligence

Response data

Returns provider-specific enrichment data — schema varies by provider. Each returns a different intelligence structure depending on their specialty. Returns 401 when provider credentials are not configured for your organization.

200Result of operation