What this endpoint does

This endpoint searches for malware family entities in the Recorded Future knowledge base using free-text name matching, date range filters, and sorting options. Malware entities represent tracked malware families and tools (such as AsyncRAT, Cobalt Strike, or Rhadamanthys), not individual file samples. Use the freetext parameter to search by malware name, and the fields parameter to control which enrichment data is included for each result. The malware entity ID returned by this search (an opaque string like Yzaz0L) is required for the Malware Lookup and Malware Extension endpoints. Note that malware entities do not have risk scores — unlike IOC entity types (IP, domain, hash, URL), requesting the risk field will return a warning.

Response data

The response contains a results array where each entry includes the malware entity identification (with an opaque alphanumeric ID, human-readable name, and entity type) plus any enrichment sections specified in the fields parameter. Available enrichment fields include aiInsights for AI-generated threat analysis, links for validated relationships to MITRE ATT&CK techniques and threat actors, intelCard for the Intelligence Card URL, timestamps for first/last seen dates, and sightings for recent source references. A counts object reports how many results were returned and the total matching the query. Each page returns up to 1,000 results with a maximum pagination window of 10,000.