What this endpoint does

This endpoint retrieves enrichment data for a specific vulnerability (identified by CVE ID) from a third-party Intelligence Card extension integrated into the Recorded Future platform. Available extensions include EPSS (Exploit Prediction Scoring System), ReversingLabs, AlienVault, IBM X-Force, BitSight, Mandiant, and Meta Threat Exchange, among others. Most extensions require that your organization has pre-configured credentials for the corresponding third-party service within the Recorded Future platform; without this, requests will return a credentials error. The EPSS extension works without additional configuration and returns daily-updated exploit probability scores and percentile rankings from the FIRST.org EPSS model. Use the Vulnerability: Search or Vulnerability: Lookup endpoint to find CVE IDs needed for this call.

Response data

The response contains a data object whose structure varies entirely depending on which extension is queried, since each provider returns different intelligence. For example, the EPSS extension returns the CVE identifier, a daily-refreshed exploit probability score (the likelihood of exploitation in the next 30 days), a percentile ranking relative to all scored CVEs, the scoring date, and a reference link to the FIRST.org EPSS project. An optional metadata object provides explanatory annotations about the response fields when requested.