Recorded Future

No entries match these filters. Clear filters

1. api-docs-c11db66c976a Oct 23, 2026 · issue 117

   Recorded Future API docs gain an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, llms.txtllms.txtA proposed convention for a plain-text file placed at a website's root to give LLMs a concise, structured summary of the site's content, helping AI agents navigate it more reliably than parsing raw HTML. index, and agent discovery endpoints for AI-native client access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Pull the full endpoint index in llms.txt format for use in an agent or automation pipeline that needs to discover available API paths.
   copy

   $ curl https://docs.recordedfuture.com/reference/llms.txt

   • Adds https://docs.recordedfuture.com/mcp as a streamable-HTTP MCP server so clients like Claude Code, Cursor, and VS Code can list and search endpoints, read schemas, and execute test requests against live OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. definitions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds reference/llms.txt as a complete index of all API endpoints with links to per-endpoint Markdown documentation, following the llms.txt standard.
   • Adds an Agent Skills index and API catalog as standard discovery endpoints for agents, with the catalog linking to every raw OpenAPI definition on the site.

   3 details in Everything

2. docs update Oct 11, 2026 · issue 102

   Recorded Future adds company-search API endpoint to discover and triage Company entities by risk score, industry, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Find all companies in your scope with a risk score of 50 or above, sorted by highest risk first, to prioritise third-party triage.
   copy

   $ curl -X GET 'https://api.recordedfuture.com/company-search?freetext=Acme&riskScore=%5B50%2C%29&orderBy=riskscore&direction=desc&limit=100' -H 'X-RFToken: <your_api_token>'

   Page through all matching companies when results exceed the default 10-record limit, using offset-based pagination to stay within the 10,000-record ceiling.
   copy

   $ curl -X GET 'https://api.recordedfuture.com/company-search?industry=Technology&orderBy=lastseen&direction=desc&limit=1000&from=1000' -H 'X-RFToken: <your_api_token>'

   • Adds GET /company-search endpoint to search the Recorded Future Intelligence Cloud for Company entities using freetext name search and structured filters including riskScore (numeric range, e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ [50,)), riskRule, industry, domicile (country entity ID), parent (parent company ID), and list (list ID).
   • Supports date filters firstSeen and lastSeen, sorting via orderBy (riskscore, criticality, firstseen, lastseen) and direction (asc, desc) on the company-search endpoint.
   • Returns paginated results (offset-based, limit max 1,000, limit + from cannot exceed 10,000; default limit of 10) with matching company entities, risk assessment data, and timestamps under data.results, with counts as a sibling of data.
   • Exposes Company-specific criticality labels — Informational, Moderate, High, and Very High — distinct from the Unusual, Suspicious, Malicious, Very Malicious labels used for IPs, domains, and hashes.

   4 details in Everything

3. docs update Oct 10, 2026 · issue 101

   New POST /sources/publish-reports endpoint lets practitioners push threat intel reports into Recorded Future for async enrichment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds a POST /sources/publish-reports endpoint to publish one or more threat intelligence reports to a custom source for asynchronous processing and enrichment by Recorded Future.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Requires at least one observable per report using Recorded Future's prefixed entity format: ip:, idn:, hash:, or url: prefixes for IPs, domains, hashes, and URLs respectively.
   • Supports optional mitre: prefix for MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. technique references, TLP classification for sharing controls, and malware / threatActor entity ID fields per report.
   • Uses externalId field in each submitted report as the caller's correlation key — the endpoint returns HTTP 202 with no body and no job ID for tracking async processing.
   • Returns HTTP 422 before processing begins if any malware, threat actor, or TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. entity IDs are invalid; use the Entity: Match endpoint to convert names into valid entity IDs.

   5 details in Everything

4. docs update Oct 10, 2026 · issue 101

   Recorded Future adds sources-update API endpoint to update metadata on custom intelligence sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Returns the full updated source object including updatedAt timestamp; responds with 404 if the source UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. does not exist.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

   └──▷ BREAKING ON UPGRADE

   • !Omitting the name field from the request body causes a server error — it must always be provided even when only updating description.
5. docs update Oct 10, 2026 · issue 101

   Recorded Future adds a GET endpoint that returns the full catalog of ~90 IP risk rules with criticality, descriptions, and live IP counts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds the IP Risk Rules endpoint that returns the complete catalog of ~90 IP risk rules — including rule name (the riskRule filter value), criticality level, description, and current count of IPs triggering each rule — with no parameters required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Exposes riskRule filter values discoverable via the new endpoint for use with IP Address: Search and IP risk list downloads.
   • Returns live IP counts per rule (ranging from zero to over 100 million) so practitioners can estimate result set sizes before downloading filtered risk lists.
   • Adds the IP Risk Rules endpoint that returns the complete catalog of ~90 IP risk rules — including rule name (the riskRule filter value), criticality level, description, and current count of IPs triggering each rule — with no parameters required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Returns live IP counts per rule (ranging from zero to over 100 million) so practitioners can estimate result set sizes before downloading filtered risk lists.

   1 more in Everything

6. docs update Oct 10, 2026 · issue 101

   Recorded Future documents the IP Lookup endpoint with field-level control over enrichment categories including risk, AI insights, and scanner behavior.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Triage a suspicious IP during an incident — pull risk score, AI insights, MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. links, and geolocation in one call.
   copy

   $ curl -G 'https://api.recordedfuture.com/v2/ip/ip:1.2.3.4' \
     --data-urlencode 'fields=entity,risk,aiInsights,links,intelCard,location' \
     -H 'X-RFToken: <api_token>'

   Investigate scanning activity — check whether an IP is a known global scanner, which ports and countries it targets, and whether neighboring CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. IPs are also risky.
   copy

   $ curl -G 'https://api.recordedfuture.com/v2/ip/ip:1.2.3.4' \
     --data-urlencode 'fields=scanner,riskyCIDRIPs,dnsPortCert' \
     -H 'X-RFToken: <api_token>'

   Discover all valid enrichment field names before building an integration, so the fields parameter is never rejected.
   copy

   $ curl 'https://api.recordedfuture.com/v2/ip/fields' \
     -H 'X-RFToken: <api_token>'

   • Adds GET /v2/ip/{id} IP Lookup endpoint returning enrichment data for a single IP, controlled by a fields parameter; the IP entity ID format is ip: followed by the address (e.g., ip:1.2.3.4).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports entity,risk,aiInsights,links,intelCard,location as core triage fields, returning risk score (0-99), criticality label, triggered rule evidence with source citations, AI-generated analysis, MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. techniques, threat actors, malware relationships, an Intelligence Card URL, and geolocation with ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. and network ownership.
   • Supports dnsPortCert field for DNS resolutions and open ports, scanner field for scanning behavior verdicts and targeted countries, and riskyCIDRIPs field for other risky IPs in the same CIDR block.
   • Exposes GET /v2/ip/fields to programmatically list all valid field names available for the fields parameter.

   4 details in Everything

7. docs update Oct 10, 2026 · issue 101

   Recorded Future adds IP Search API endpoint with CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. range, geolocation, risk-rule filtering, and optional enrichment fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds GET /ip-search endpoint to search IP addresses by risk score range, riskRule, first/last seen dates, range (CIDR block or IP range, e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ 64.227.176.0/20), and location (geography), returning up to 1,000 results per page.
   • Adds fields parameter to control enrichment sections returned per IP result — including entity, risk, location, links, and aiInsights — defaulting to basic entity identification only when omitted.
   • Adds orderBy and direction parameters (e.g. orderBy=riskscore&direction=desc) to sort results by risk score, recency, or hit counts.
   • Returns offset-based pagination via limit (default 10, max 1,000) and from parameters, with data.results array and a counts sibling reporting page and total match counts.

   4 details in Everything

8. docs update Oct 9, 2026 · issue 098

   Recorded Future: Supports sorting results by risk score, criticality, total or recent reference counts, or chronological fields via the new endpoint.

   └──▷ TRY IT
   Pull the top high-risk domains (criticality-sorted) with risk rule breakdowns for triage — useful in a morning threat-intel workflow.
   copy

   $ curl -X GET 'https://api.recordedfuture.com/domain-search?limit=50&from=0&fields=entity,risk' \
     -H 'X-RFToken: <your_api_token>' \
     -H 'Accept: application/json'

   Page through results beyond the first 50 matches when a bulk domain sweep exceeds the default page size.
   copy

   $ curl -X GET 'https://api.recordedfuture.com/domain-search?limit=100&from=100&fields=entity,risk' \
     -H 'X-RFToken: <your_api_token>' \
     -H 'Accept: application/json'

   • Returns composite risk score (0–99), criticality level, and per-rule breakdowns (sighting counts, source descriptions, timestamps, mitigation notes) when risk data is requested.
   • Returns paginated results under data.results with counts as a sibling of data; limit defaults to 10, maximum 1,000, and limit + from cannot exceed 1,000.
   • Supports enrichment field selection to control which data is returned per domain result — consult the Enrichment: Field Attributes reference for all available field options.

   3 details in Everything

9. docs update Oct 9, 2026 · issue 098

   New GET /company-risk-rules endpoint returns the full catalog of Recorded Future company risk rules for use as API filter values.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Retrieve all valid riskRule filter values before constructing a targeted Company: Search query — useful when you want to filter by a specific concern like exposed credentials or typosquat domains.
   copy

   $ curl -X GET 'https://api.recordedfuture.com/company-risk-rules' -H 'X-RFToken: <your_api_token>' -H 'Accept: application/json'

   • Adds a new GET /company-risk-rules endpoint that returns the complete catalog of Company entity risk rules, including machine-readable name values accepted by the riskRule filter on the Company: Search endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Each rule in the response includes a human-readable description, criticality level (Informational, Moderate, High, Very High), a count of companies currently triggering that rule, and mappings to NIST Cybersecurity FrameworkNIST Cybersecurity FrameworkThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. controls (e.g., DE.CM-1, PR.DS-5) and Recorded Future Functional Categories (e.g., Security Incidents, Malicious Network Activity).
   • Results are nested under data.results and the endpoint takes no parameters, always returning the full active rule set.

   3 details in Everything

10. docs update Oct 9, 2026 · issue 098

    Recorded Future: Risk data responses now include a composite risk score (0–99), criticality level, and per-rule breakdowns for cyber attacks, exposed credentials⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Resolve a domain to its Recorded Future company entity ID and pull a risk score — the first step before chaining into the Lookup Company by ID or List Company References endpoints.
    copy

    $ curl -X GET 'https://docs.recordedfuture.com/reference/company-lookup-by-domain?domain=google.com&fields=risk' -H 'X-RFToken: <your_api_token>' -H 'Accept: application/json'

11. docs update Oct 9, 2026 · issue 098

    Recorded Future adds a Company Lookup endpoint for enriching Company entities by Recorded Future ID via REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds GET /company-lookup endpoint to retrieve enrichment data for a Company entity by its Recorded Future ID, with field selection via the fields parameter supporting risk, intelCard, counts, analystNotes, and relatedEntities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds metadata=true query parameter to the Company Lookup endpoint to return self-documenting type annotations on every response field.
    • Company entities support risk scoring with triggered-rule evidence and criticality labels but explicitly do not support aiInsights or links fields.

    3 details in Everything

12. docs update Oct 9, 2026 · issue 098

    Recorded Future: New Company Search endpoint searches the Intelligence Cloud for Company entities with risk assessment data and timestamps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Find all companies in your supply chain with a risk score of 50 or above, sorted by highest risk first, to prioritise third-party risk reviews.
    copy

    $ curl --request GET \
      --url 'https://api.recordedfuture.com/company/search?riskScore=%5B50%2C%29&orderBy=riskscore&direction=desc&limit=100' \
      --header 'X-RFToken: <your_api_token>'

    Page through all high-risk companies in a specific industry to feed a batch enrichment pipeline, staying within the 10,000-record offset cap.
    copy

    $ curl --request GET \
      --url 'https://api.recordedfuture.com/company/search?riskScore=%5B50%2C%29&industry=<industry_entity_id>&limit=1000&from=0' \
      --header 'X-RFToken: <your_api_token>'

    • Supports structured filters: riskScore (numeric range, e.g. [50,)), riskRule, industry, domicile (country entity ID), parent (parent company ID), and list (list ID).
    • Supports date filters firstSeen and lastSeen, plus orderBy (riskscore, criticality, firstseen, lastseen) and direction (asc, desc) for sorting results.
    • Company entities use distinct criticality labels — Informational, Moderate, High, and Very High — separate from the Unusual/Suspicious/Malicious/Very Malicious labels used for IPs, domains, and hashes.

    3 details in Everything

13. docs update Oct 9, 2026 · issue 098

    Recorded Future documents the /v2/{entity_type}/fields endpoint for controlling enrichment data blocks on Search and Lookup requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Discover which field names are valid for IP enrichment before crafting a lookup request.
    copy

    $ curl -H 'X-RFToken: <api_token>' 'https://api.recordedfuture.com/v2/ip/fields'

    Fetch a vulnerability lookup with only CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v4, lifecycle stage, and linked malware to reduce payload size in an automated pipeline.
    copy

    $ curl -H 'X-RFToken: <api_token>' 'https://api.recordedfuture.com/v2/vulnerability/<vuln_id>?fields=cvssv4,lifecycleStage,linkedMalware'

    Pull IP enrichment with VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection./proxy history and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. mappings for an indicator under investigation.
    copy

    $ curl -H 'X-RFToken: <api_token>' 'https://api.recordedfuture.com/v2/ip/<ip_address>?fields=risk,riskMapping,vpnHistory,proxyHistory,location'

    • Adds the GET /v2/{entity_type}/fields endpoint, which returns the list of valid field names that can be passed via the fields query parameter on Search and Lookup requests to control which data blocks are included in each entity result.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports fields selection across seven entity types: ip, domain, hash, url, vulnerability, company, and malware.
    • Documents common fields available on all entity types: aiInsights, analystNotes, counts, entity, intelCard, metrics, relatedEntities, sightings, and timestamps.
    • Documents widely available fields with per-entity-type availability: risk, riskMapping, enterpriseLists, links (requires specific access permissions), and threatLists.
    • Documents IP-specific fields: dnsPortCert, location, riskyCIDRIPs, scanner, vpnCurrent, vpnHistory, proxyCurrent, and proxyHistory.

    +3 more show less

    • Documents hash-specific fields: fileHashes (MD5, SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications., SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data.) and hashAlgorithm.
    • Documents vulnerability-specific fields: commonNames, cpe, cpe22uri, cvss, cvssRatings, cvssv3, cvssv3Cna, cvssv3Nvd, cvssv3Rfva, cvssv4, cvssv4Cna, cvssv4Nvd, cvssv4Rfva, lifecycleStage, linkedMalware, nvdDescription, nvdReferences, rawrisk, and relatedLinks.
    • Documents company-specific field curated and malware-specific field categories.

    8 details in Everything

14. docs update Oct 9, 2026 · issue 098

    New reference API endpoint exposes entity type taxonomy for Insikt Group detection rules; response is a flat JSON array requiring no parameters.

    • New detection Detection Rules: Associated Entity Types endpoint
15. docs update Oct 9, 2026 · issue 098

    New no-parameter API endpoint returns a flat JSON array of ~9,800 entities across ~37 types, feeding the filter.entities field in Detection Rules: Search.

    • Adds Detection Rules: Associated Entities endpoint that returns all ~9,800 Recorded Future entities (hashes, malware families, URLs, MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. identifiers, and ~37 entity types total) linked to at least one Insikt Group detection rule, with no parameters required.
    • New detectionReturned entity IDs are valid inputs for the filter.entities array in the Detection Rules: Search endpoint, enabling a two-step workflow: resolve entity IDs from a threat of interest, then retrieve matching YARA, Sigma, or Snort rules.

    2 details in Everything

16. docs update Oct 9, 2026 · issue 098

    New POST Detection Rules Search endpoint returns YARAYARAA pattern-matching language and engine, maintained by VirusTotal, that lets analysts write rules describing file or memory content so cyber tools can classify or hunt for malware at scale., SigmaSigmaAn open, vendor-neutral rule format for describing patterns in log data, maintained by the Sigma project community, giving cyber tools a shared detection language that converts into platform-specific queries., and SnortSnortAn open-source network intrusion detection and prevention system maintained by Cisco that inspects packet payloads against signature rules, giving cyber tools a proven engine for real-time threat detection. rule source with MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. mappings and cursor-based pagination.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Retrieve the next page of YARA rules by passing the next_offset value returned from a previous response.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/detection-rules/search' \
      -H 'X-RFToken: <your_api_token>' \
      -H 'Content-Type: application/json' \
      -d '{"type": "yara", "offset": "<next_offset_value>"}'

    • Supports filtering by rule type (yara/sigma/snort), creation or update date ranges, associated entity IDs, note title text, or specific document ID.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Each result in the rules array includes content (full rule source ready for deployment), file_name (suggested filename), and entities (MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. techniques, malware families, file hashes, and threat actors mapped to the rule).
    • Response includes result array of detection rule notes, count, total_count, and next_offset pagination cursor, each with Insikt Group note id, type, title, description, and timestamps.

    3 details in Everything

17. announced Oct 9, 2026 · issue 103

    Recorded Future launches AI Infrastructure Indicator Lists — curated IP, CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network., and domain feeds for shadow AI discovery and policy enforcement, free with Cyber Operations lic⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Before enforcing blocks, baseline 30-90 days of DNS and proxy logs against the full list to discover shadow AI traffic — then segment by service provider in the Comment field and Risk Score to prioritise action.
    📍In the Recorded Future platform, navigate to the AI Infrastructure Indicator List, then run it against your historical DNS and proxy logs. Filter the results by the provider in the Comment field and sort by Risk Score to identify vibe-coding and Chinese AI tools as the highest-priority undiscovered categories.
    • Adds two new curated indicator lists — AI Infrastructure and Chinese AI Infrastructure — containing IP addresses, CIDR ranges, and domains with Risk Scores and Comment fields (provider, verification date, association method) for identifying AI-related network traffic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Exposes AI Infrastructure Indicator Lists via the List API, with daily retrieval recommended and weekly list refresh cadence.
    • Each indicator's Comment field encodes service attribution, verification date, and association method (Live JSON, Official documentation, BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes./WHOIS, or Community/OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats.) to support per-vendor enforcement policies rather than flat block rules.
    • Covers general-purpose AI assistants, AI coding assistants, vibe-coding tools, AI search tools, voice/audio AI tools, AI video tools, Chinese-domiciled AI tools, and autonomous AI agents across both lists.
    • Available at no additional cost to customers with a Cyber Operations or Threat Intelligence Module license.

    5 details in Everything

18. docs update Oct 8, 2026 · issue 097

    Recorded Future adds a bulk lookup endpoint for up to 250 Social Media Impersonation Playbook Alerts in one request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds POST /social-media-impersonation bulk endpoint to hydrate up to 250 Social Media Impersonation Playbook Alert IDs in a single request, returning UI-ready panels covering status, impersonating profile evidence summary, and change log.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports an optional panels field in the request body to limit the response to only the specific panels needed.

    2 details in Everything

19. docs update Oct 8, 2026 · issue 097

    New POST /social-media-impersonation-playbook/{alert-id} endpoint exposes Social Media Impersonation alert detail — account metadata, matched assets, assessments, workflow state, and history — via API.

    • New detectionAdds POST /social-media-impersonation-playbook/{alert-id} endpoint returning UI-ready panels: evidence summary (platform, profile URL, display name, handle, bio, creation date, post and follower counts, private flag), matched company/executive assets, assessments, workflow status, and alert history log.

    1 detail in Everything

20. docs update Oct 8, 2026 · issue 097

    Recorded Future: Adds POST /dark-web-brand endpoint to fetch UI-ready panel data for up to 250 Dark Web Brand Playbook Alerts in one request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

21. docs update Oct 8, 2026 · issue 097

    New POST /dark-web-brand-playbook-alert/{id} endpoint enables API-based triage of Dark Web Brand Playbook Alerts, returning status, evidence, and change log.

    • New detectionAdds POST /dark-web-brand-playbook-alert/{id} endpoint to retrieve workflow state, priority, assignee, matched targets, screenshot references, and source-specific evidence for a single Dark Web Brand Playbook Alert.

    1 detail in Everything

22. docs update Oct 6, 2026 · issue 096

    Adds sigma-retry-job API endpoint to resubmit failed Auto Sigma jobs; returns {retried: true/false} based on job state.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

23. docs update Oct 6, 2026 · issue 096

    Recorded Future adds DELETE endpoint for Auto SigmaSigmaAn open, vendor-neutral rule format for describing patterns in log data, maintained by the Sigma project community, giving cyber tools a shared detection language that converts into platform-specific queries. jobs, permanently removing a job and its generated Sigma rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

24. docs update Oct 6, 2026 · issue 096

    New GET /sigma/job API endpoint polls Auto Sigma job status and retrieves YAML Sigma rules and behavioral patterns from malware sandbox analysis.

    • New detectionAdds GET /sigma/job endpoint returning job status (CREATED, RUNNING, FINISHED, FAILED), generated Sigma rules as complete YAML documents, malware family sample counts, and behavioral patterns (process images, command-line patterns) once the job reaches FINISHED state.

    1 detail in Everything

25. docs update Oct 6, 2026 · issue 096

    Recorded Future adds POST /malware-intelligence endpoint to list all Auto Sigma jobs with pagination support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Paginate through all your Auto Sigma jobs to find failed ones that need a retry.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/malware-intelligence' \
      -H 'X-RFToken: <your-token>' \
      -H 'Content-Type: application/json' \
      -d '{"get_jobs": {"limit": 100, "offset": 0}}'

    • Adds POST https://api.recordedfuture.com/malware-intelligence (get_jobs) endpoint to list all Auto Sigma jobs created by the authenticated user, paginated via limit (default 10, max 1000) and offset parameters, authenticated with X-RFToken header.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Returns per-job malware family counts and processing status (finished, processing, or failed) across all Auto Sigma jobs, enabling bulk monitoring without fetching individual job details.

    2 details in Everything

26. docs update Oct 6, 2026 · issue 096

    New Auto Sigma job API creates async jobs scoped by query, start_date, and end_date; returns a job_id to poll status and manage generated rules.

    • New detectionAdds POST Auto Sigma job endpoint with query, start_date, and end_date parameters to scope malware sample selection, with a start_date floor of 2023-11-01.
    • Returns a job_id (UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.) usable with Get Sigma Job, Retry Sigma Rule, and Update Sigma Rule endpoints to poll status, retrieve rules, retry failures, and update rules.

    2 details in Everything

27. docs update Oct 6, 2026 · issue 096

    Recorded Future adds Auto YARA retry endpoint to resubmit failed YARA rule generation jobs without creating new ones.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

28. docs update Oct 6, 2026 · issue 096

    New GET /yara-get-job API endpoint retrieves Auto YARA job results, hex byte patterns, and sample coverage analysis for rule deployment.

    • New detection Auto YARA job result retrieval endpoint
29. docs update Oct 6, 2026 · issue 096

    Recorded Future adds YARA Edit Job API endpoint to update YARAYARAA pattern-matching language and engine, maintained by VirusTotal, that lets analysts write rules describing file or memory content so cyber tools can classify or hunt for malware at scale. rule strings on existing Auto YARA jobs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

30. docs update Oct 6, 2026 · issue 096

    Recorded Future adds GET /malware-intelligence Auto YARA job listing endpoint for monitoring rule-generation status.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Poll all Auto YARA jobs to find finished ones before fetching the generated rule — useful in CI or hunt workflows to check status without retrieving full output.
    copy

    $ curl -s -H 'X-RFToken: <your-token>' https://api.recordedfuture.com/malware-intelligence | jq '.[] | select(.status == "completed") | .id'

    • Returns coverage data per job indicating which submitted malware hashes shared enough common patterns to produce a YARA rule versus which were too unique to cluster.
    • Full YARA rule text and pattern details are intentionally omitted from the list response — use the Get YARA Job endpoint with a specific job ID to retrieve complete output.

    2 details in Everything

31. docs update Oct 6, 2026 · issue 096

    New POST /yara/create-job API enables asynchronous YARA rule generation from up to 100 malware SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hashes, with a full job management lifecycle.

    • New detectionAdds POST /yara/create-job endpoint to create asynchronous Auto YARA jobs that analyze up to 100 malware samples (identified by SHA-256 hashes) and generate YARA detection rules from common hexadecimal byte patterns.
    • Returns a job_id (UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.) usable with Get YARA Job, Edit YARA Job, Retry YARA Job, and Delete YARA Job endpoints to manage the full YARA rule generation lifecycle.
    • Supports an optional query field on job creation to record the query used to find the sample hashes for reference, without affecting sample selection.

    3 details in Everything

32. docs update Oct 6, 2026 · issue 096

    New GET /malware-intelligence/sandbox-reports endpoint retrieves full sandbox analysis for a SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. sample, including MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. mappings, process trees, and C2 configs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Retrieve the top sandbox report for a specific malware sample after discovering its hash via behavioral query — useful for pivoting from a cluster of suspicious samples to full dynamic analysis of a single one.
    copy

    $ curl -X GET 'https://api.recordedfuture.com/malware-intelligence/sandbox-reports?sha256=<sha256>&query=<malware_intelligence_query>&limit=1' -H 'Authorization: Bearer <token>' -H 'Accept: application/json'

    Pull up to 3 sandbox reports for the same sample to compare results across different behavioral profiles (e.g., behavioral1, behavioral2, behavioral3), ordered by highest sandbox score.
    copy

    $ curl -X GET 'https://api.recordedfuture.com/malware-intelligence/sandbox-reports?sha256=<sha256>&query=<malware_intelligence_query>&limit=3' -H 'Authorization: Bearer <token>' -H 'Accept: application/json'

    • Adds the Malware Intelligence: Sandbox Reports endpoint, which retrieves full sandbox analysis reports for a specific malware sample identified by its sha256 parameter and a query parameter using the Malware Intelligence query language.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports a limit parameter (range 1–10, default 1) to control how many reports are returned, ordered by highest sandbox score first.
    • Each report's dynamic section includes network flows with destination IPs and ports, DNS requests, HTTP sequences, process trees with command lines, MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. mappings with severity scores, extracted C2 servers and encryption keys, and dropped files with hashes.
    • Each report's static section includes file hashes, size, extensions, and static analysis signatures; the pe section (Windows executables) includes imports, exports, sections, digital signatures, and import hash; and metadata includes industry and sector classifications.
    • Integrates with Malware Intelligence: Query to discover sample hashes by behavioral criteria, Malware Intelligence: Query Natural Language for natural-language sample discovery, and Malware Intelligence: Query by IOCs for IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself.-based lookups.

    5 details in Everything

33. docs update Oct 6, 2026 · issue 096

    Recorded Future adds malware-intelligence-query-iocs endpoint to search sandbox analysis DB by SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data., IP, domain, or URL IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. lists⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Pivot from a set of known malicious IPs and domains to discover related MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. techniques observed in sandbox samples since a specific date.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/malware-intelligence/query-iocs' \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{
        "ip_list": ["198.51.100.42", "203.0.113.7"],
        "domain_list": ["evil-c2.example.com"],
        "field": "ttp",
        "operator": "or",
        "start_date": "2024-01-01",
        "page": 0
      }'

    Find all sandbox samples (SHA256) that match a list of known-bad hashes AND a known-bad domain, then retrieve sandbox scores and portal links for triage.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/malware-intelligence/query-iocs' \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{
        "sha256_list": ["e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"],
        "domain_list": ["malware-staging.example.net"],
        "field": "sha256",
        "operator": "and",
        "start_date": "2023-11-01",
        "page": 0
      }'

    • New POST endpoint Malware Intelligence: Query IOCs accepts sha256_list, ip_list, domain_list, and url_list parameters to pivot across Recorded Future's malware sandbox analysis database using known indicators.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • The field parameter controls which artifact type is aggregated in results — supported values include sha256 (related samples), ip_address (network infrastructure), and ttp (MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. techniques).
    • The operator parameter controls multi-list logic: and (default) requires matches across all provided IOC lists; or matches any.
    • The start_date parameter is required and cannot predate 2023-11-01.
    • When field is sha256, response includes file extension types, MITRE ATT&CK tactic tags, and optionally sandbox-specific scores and portal links.

    +2 more show less

    • Pagination is zero-indexed via the page parameter; the total_pages field in the response indicates how many pages are available.
    • Each result carries the artifact value, a count of sandbox samples it appeared in, and a Recorded Future risk score.

    7 details in Everything

34. docs update Oct 6, 2026 · issue 096

    Recorded Future adds a natural-language malware sandbox query endpoint that auto-generates and returns the equivalent structured query.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • New Malware Intelligence: Query NL endpoint accepts plain-English descriptions to search Recorded Future's malware sandbox analysis database, returning matching artifacts and the auto-generated executedQuery so practitioners can pivot to the structured Malware Intelligence: Query endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Response includes totalPages for paginated iteration over sandbox artifact results.

    2 details in Everything

35. docs update Oct 6, 2026 · issue 096

    Recorded Future: New POST /malware-intelligence/query endpoint queries malware sandbox database using Malware Intelligence query language with dynamic behavior filters⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Find all domains contacted by sandbox samples communicating on port 5353 since early 2024, to hunt for DNS-over-mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing. C2 patterns.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/malware-intelligence/query' \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{
        "query": "dynamic.network.flows.dst_port == 5353",
        "field": "domain",
        "start_date": "2024-01-01"
      }'

    Aggregate SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hashes of sandbox samples, enriched with MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. tags and portal report links, to feed into a threat-intel pipeline.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/malware-intelligence/query' \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{
        "query": "dynamic.network.flows.dst_port == 443",
        "field": "sha256",
        "start_date": "2023-11-01",
        "sandbox_score": true,
        "links": true
      }'

    • Supports start_date parameter (required; earliest value 2023-11-01) to bound sandbox analysis results, with paginated response including name, count, risk score, and total_pages.

    1 detail in Everything

36. docs update Oct 6, 2026 · issue 096

    Recorded Future documents available entity tags and their API names for the Lists: Replace Entity Tags endpoint⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Documents the full set of tags (57 named values such as tier0, critical, pci_dss, hipaa, gdpr, dora, iso_27001, sox, internet_facing, unpatched, false_positive, and more) that can be applied to entities on company-type lists via the Lists: Replace Entity Tags endpoint, with a limit of 9 tags per entity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Clarifies that while the Recorded Future UI organizes tags into logical groups (risk tiers, compliance frameworks, supply chain classification), the API treats them as a flat list and requires the API Name column values in requests.

    2 details in Everything

37. docs update Oct 6, 2026 · issue 096

    New POST /dark-web/brand-playbook/alert/{id} endpoint exposes workflow state, priority, assignee, evidence, and change log for Dark Web Brand Playbook Alerts.

    • New integration Dark Web Brand Playbook Alert API endpoint
38. docs update Oct 6, 2026 · issue 096

    Recorded Future adds analyst note preview endpoint to validate formatting and entity linking before publishing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds a new API endpoint that returns a fully rendered preview of an analyst note — with resolved entity references and formatted text — without saving or publishing it, enabling pre-publish validation of formatting, entity linking, and content.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports a serialization parameter on the preview request body (alongside source and attributes such as title, text, and entity references) to control response detail level, matching the existing publish/draft format.

    2 details in Everything

39. docs update Oct 6, 2026 · issue 096

    New POST endpoint lets you create draft analyst notes programmatically before publishing them via the Recorded Future API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds the Analyst Notes: Draft endpoint, which accepts a JSON payload with source, attributes (title, text, entity references), and optional resolve_entities: true to stage a note for review without publishing it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Returns a report_id string (e.g., doc:wB0Rhk) usable with Analyst Notes: Lookup to retrieve the draft or Analyst Notes: Publish to make it live.

    2 details in Everything

40. docs update Oct 6, 2026 · issue 096

    Recorded Future adds an analyst note export endpoint returning rendered PDF or HTML via application/octet-stream.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

41. docs update Oct 6, 2026 · issue 096

    Recorded Future adds an API endpoint to download binary attachments from analyst notes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds a GET endpoint that downloads the raw binary attachment associated with an analyst note, returning application/octet-stream content; responds with a 404 JSON error (with message, status_code, and trace_id fields) when the note has no attachment or does not exist.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

42. docs update Oct 6, 2026 · issue 096

    Recorded Future adds analyst-note-search API endpoint with cursor-based pagination and enterprise-only filtering⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds POST /analyst-note-search endpoint to search published analyst notes across enterprise and Insikt Group content, filtering by topic, attached entities, publication date range, note source, or text.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports cursor-based pagination via next_offset in the response and from in the next request body.
    • Adds enterprise_only: true filter field to restrict results to your organization's notes, excluding Insikt Group content.
    • Returns a data array per result containing note id, source, and attributes (title, text, entities, topic, publication date, validation URLs), plus a counts object with returned and total fields.

    4 details in Everything

43. docs update Oct 6, 2026 · issue 096

    Recorded Future analyst note APIs gain a serialization parameter to control entity detail level in responses.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds the serialization parameter to all analyst note API operations (Preview, Publish, Lookup, Search), accepting "id", "min", or "full" to control how much entity detail is returned — "full" is the default, returning complete objects with id, name, type, and description; "id" returns only the bare string identifier; "min" returns an object with name only.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • The serialization level applies uniformly to all entity fields in analyst note responses, including note_entities, context_entities, and nested entity references, enabling significant payload reduction when notes reference dozens or hundreds of entities.

    2 details in Everything

44. docs update Oct 6, 2026 · issue 096

    New Cases: Eligible Assignees API endpoint lists users who can be assigned to a specific case.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

45. docs update Oct 6, 2026 · issue 096

    Recorded Future adds a Cases Update endpoint to modify case properties via the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds a PATCH /cases-update API endpoint that modifies one or more properties of an existing case identified by its TaskIdentity ID (formatted as task:<UUID>, obtainable from the Case Search endpoint), with each change recorded in the case activity log.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports unassigning a case by passing an empty string for the assignee field in the update request.

    2 details in Everything

46. docs update Oct 6, 2026 · issue 096

    Recorded Future adds POST /cases/search API endpoint for paginated case filtering by status, priority, assignee, and date range.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Retrieve all open high-priority cases assigned to a specific analyst, sorted newest-first, for triage queuing.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/cases/search' \
      -H 'X-RFToken: <your_api_token>' \
      -H 'Content-Type: application/json' \
      -d '{"status": ["New", "InProgress"], "priority": ["High"], "assignee": "<uhash>", "order_by": "created", "direction": "desc"}'

    Page through all unassigned cases by passing the cursor returned in the previous response.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/cases/search' \
      -H 'X-RFToken: <your_api_token>' \
      -H 'Content-Type: application/json' \
      -d '{"assignee": "", "offset": "<next_offset>"}'

    • Adds a POST /cases/search endpoint that filters cases by status (New, InProgress, Resolved, Dismissed), priority (Informational, Moderate, High), assignee (uhash or empty string for unassigned), and created/modified date ranges, returning matching TaskIdentity IDs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports sort control via order_by (created or modified) and direction (asc or desc) parameters on the search endpoint.
    • Implements a two-step workflow: call Cases: Search to get IDs, then pass them to Cases: Lookup Many to retrieve full case details.

    3 details in Everything

47. docs update Oct 5, 2026 · issue 095

    New POST /collective-insights/submit-detections endpoint lets practitioners push IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. detections into Collective Insights with enrichment and a debug/dry-run mode.

    • New integrationAdds POST /collective-insights/submit-detections endpoint to ingest IoC detections (IP addresses, domains, file hashes, CVEs, and URLs) into Collective Insights, with optional MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. technique codes, malware names, incident references, and source metadata fields.
    • Supports a debug option set to true to validate detection submissions without persisting them, enabling safe development-time testing.
    • Supports a summary option that returns a per-type breakdown (IP, domain, hash, vulnerability, URL) of processed IoC counts and details on any dropped detections in the response.
    • Accepts detection context fields — including detection rule, correlation, playbook, or sandbox analysis — alongside each submitted IoC.

    4 details in Everything

48. docs update Oct 5, 2026 · issue 095

    Recorded Future adds the Collective Insights API — a bidirectional pipeline with /detections, /search, and /exclusions endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds POST /detections endpoint to push telemetry from any SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents., EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device., Firewall, or SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. into the Recorded Future Intelligence Cloud, converting indicators into Enriched Events linked to malware families, Threat Actors, and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. techniques.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds GET /search endpoint for programmatic, filterable access to the full history of enriched detections — aggregating API submissions, built-in integrations, Autonomous Threat Operations, and Sandbox results into a single queryable interface.
    • Adds GET /exclusions (plus create, update, delete operations) to manage an organization-level exclusion list that suppresses known-benign observables, IP ranges, or device names from the enriched detection stream, with mandatory comments and a full audit log.

    3 details in Everything

49. docs update Oct 5, 2026 · issue 095

    New API endpoint retrieves SigmaSigmaAn open, vendor-neutral rule format for describing patterns in log data, maintained by the Sigma project community, giving cyber tools a shared detection language that converts into platform-specific queries., SnortSnortAn open-source network intrusion detection and prevention system maintained by Cisco that inspects packet payloads against signature rules, giving cyber tools a proven engine for real-time threat detection., YARAYARAA pattern-matching language and engine, maintained by VirusTotal, that lets analysts write rules describing file or memory content so cyber tools can classify or hunt for malware at scale., YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching., KQLKQLKusto Query Language, Microsoft's read-only query language for Azure Data Explorer and Microsoft Sentinel, used by cyber tools to filter, aggregate, and correlate large volumes of log and telemetry data quickly., FQL, and S1QL detection rules from Recorded Future threat prevention profiles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Returns rule content fields containing complete, deployment-ready rule text (Sigma YAML, Snort signatures, YARA rules, etc.) tagged with MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. techniques, sourced from Insikt Group research.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

50. docs update Oct 5, 2026 · issue 095

    New API endpoint retrieves block-list IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. from Recorded Future threat prevention profiles for firewall and proxy ingestion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Pull only IP and domain IOCs from a prevention profile to feed a firewall block list, with risk scores for triage.
    copy

    $ curl -G 'https://api.recordedfuture.com/threat-prevention-profile-indicators' \
      -H 'X-RFToken: <your_api_token>' \
      -H 'Content-Type: application/json' \
      --data-urlencode 'id=<profile_uuid>' \
      --data-urlencode 'type=ip' \
      --data-urlencode 'type=domain' \
      --data-urlencode 'include.risk.score=true'

    Page through a large hash-only block list for endpoint tooling by passing the cursor from the previous response.
    copy

    $ curl -G 'https://api.recordedfuture.com/threat-prevention-profile-indicators' \
      -H 'X-RFToken: <your_api_token>' \
      --data-urlencode 'id=<profile_uuid>' \
      --data-urlencode 'type=hash' \
      --data-urlencode 'offset=<nextOffset_from_previous_response>'

    • Adds GET /threat-prevention-profile-indicators endpoint to retrieve confirmed-malicious IPs, domains, file hashes, and URLs from a named threat prevention profile, ready for direct ingestion into firewalls, web proxies, and endpoint tools.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports filtering by observable type (e.g., ip, domain, hash) so each downstream tool pulls only the indicator types it needs.
    • Enables risk score enrichment per indicator via include.risk.score: true to prioritize which IOCs to act on first.
    • Paginates results using opaque cursor tokens — pass the nextOffset value from one response as the offset parameter in the next request; absence of nextOffset signals the final page.

    4 details in Everything

51. docs update Oct 5, 2026 · issue 095

    New Threat Prevention Profiles Query endpoint discovers block-list profile UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. for firewalls, proxies, and endpoint tools.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Discover your organization's prevention profile UUIDs by enterprise ID so you can pipe them into the indicators endpoint for firewall block-list ingestion.
    copy

    $ curl -X POST https://api.recordedfuture.com/threat-prevention-profiles-query \
      -H 'X-RFToken: <your-api-token>' \
      -H 'Content-Type: application/json' \
      -d '{"enterprise": "uhash:XXXXXXXXXX"}'

    Fetch prevention profiles for up to 100 specific UUIDs, then forward results to the Get Profile Indicators endpoint to pull IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. for proxy enforcement.
    copy

    $ curl -X POST https://api.recordedfuture.com/threat-prevention-profiles-query \
      -H 'X-RFToken: <your-api-token>' \
      -H 'Content-Type: application/json' \
      -d '{"ids": ["<uuid-1>", "<uuid-2>"]}'

    • Adds POST /threat-prevention-profiles-query endpoint that accepts ids (array of UUIDs, max 100) or enterprise (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ uhash:XXXXXXXXXX) to discover threat prevention profiles available to your organization — returns profile UUIDs for use with the Threat Prevention: Get Profile Indicators and Threat Prevention: Get Profile Rules endpoints.
    • Threat prevention profiles represent continuously-updated block lists targeting specific threat categories for ingestion into firewalls, proxies, or endpoint tools — distinct from detection profiles used in SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents./EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. workflows.

    2 details in Everything

52. docs update Oct 5, 2026 · issue 095

    New API endpoint returns deployable detection rules per profile; rules are continuously updated and tagged with MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. techniques for threat-informed prioritization.

    • New detectionAdds Threat Detection: Get Profile Rules API endpoint to retrieve detection rules from a specific threat detection profile, filtered by filter.types; supported values are sigma, snort, yara, yaral, kql, fql, and s1ql.
    • Each rule's content field returns complete, deployable rule text (Sigma YAML, Snort signatures, KQLKQLKusto Query Language, Microsoft's read-only query language for Azure Data Explorer and Microsoft Sentinel, used by cyber tools to filter, aggregate, and correlate large volumes of log and telemetry data quickly. queries, etc.) sourced from Insikt Group research and tagged with MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. techniques, ready for direct import into a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. or EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device..

    2 details in Everything

53. docs update Oct 5, 2026 · issue 095

    New GET /threat-detection/profile/indicators endpoint retrieves continuously updated IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. filtered by type, hash algorithm, and risk score.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Pull only SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. file hashes with risk scores from a detection profile for ingestion into your SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..
    copy

    $ curl -X POST 'https://api.recordedfuture.com/threat-detection/profile/indicators' \
      -H 'X-RFToken: <api_token>' \
      -H 'Content-Type: application/json' \
      -d '{"id": "<profile_uuid>", "type": "hash", "hashAlgorithm": "SHA-256", "include": {"risk": {"score": true}}}'

    Page through a large IP indicator result set by passing the cursor token from the previous response.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/threat-detection/profile/indicators' \
      -H 'X-RFToken: <api_token>' \
      -H 'Content-Type: application/json' \
      -d '{"id": "<profile_uuid>", "type": "ip", "offset": "<nextOffset>"}'

    • Supports include.risk.score: true request field to enrich returned IOCs with risk scores and triggered rule details for prioritization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

54. docs update Oct 5, 2026 · issue 095

    New API endpoint lets orgs discover threat detection profile UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. by ids (max 100) or enterprise identifier for SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents./EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. ingestion.

    • Accepts ids (array of UUIDs, max 100) or enterprise (e.g., uhash:XXXXXXXXXX); empty body or empty ids array returns 400.
    • Detection profiles update continuously, unlike hunting profiles which require job-polling.

    2 details in Everything

    • New detection Threat Detection Profiles Query endpoint
55. docs update Oct 5, 2026 · issue 095

    Recorded Future adds Threat Hunting Profiles Query endpoint to discover profile schedules and async job workflows⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Discover all threat hunting profiles for your enterprise to determine their schedules and set your polling interval for pending jobs accordingly.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/threat-hunting/profiles/query' \
      -H 'X-RFToken: <your_api_token>' \
      -H 'Content-Type: application/json' \
      -d '{"enterprise": "uhash:XXXXXXXXXX"}'

    Query specific threat hunting profiles by UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. to inspect their cron schedule and lookback window before tuning your job-polling cadence.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/threat-hunting/profiles/query' \
      -H 'X-RFToken: <your_api_token>' \
      -H 'Content-Type: application/json' \
      -d '{"ids": ["<profile-uuid-1>", "<profile-uuid-2>"]}'

    • Adds POST /threat-hunting/profiles/query endpoint to discover threat hunting profiles available to your organization, returning schedule (cron expression), lookback (in seconds), and nextRun timestamp for each profile.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports filtering by ids (array of UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide., max 100) or enterprise (e.g., uhash:XXXXXXXXXX) — at least one parameter required; empty body or empty ids returns 400.
    • Each profile's id links to jobs surfaced via the Threat Hunting: Get Pending Jobs endpoint, enabling poll-cadence alignment with the profile's async job generation rhythm.

    3 details in Everything

56. docs update Oct 5, 2026 · issue 095

    Recorded Future adds a Threat Hunting Job Status API endpoint for integration-driven hunt orchestration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Mark a threat hunt job as started before fetching its indicators, so the platform knows the integration has claimed the job.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/threat-hunting/job/<jobId>/status' \
      -H 'X-RFToken: <api_token>' \
      -H 'Content-Type: application/json' \
      -d '{"status": "started", "externalId": "soar-case-1042"}'

    After processing indicators and rules, close out the job with a completion status and outcome message.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/threat-hunting/job/<jobId>/status' \
      -H 'X-RFToken: <api_token>' \
      -H 'Content-Type: application/json' \
      -d '{"status": "completed", "message": "All indicators processed and alerts created.", "externalId": "soar-case-1042"}'

    • Adds the Threat Hunting: Update Job Status API endpoint, which lets integrations set a hunt job's execution status to started, completed, or failed using a job ID obtained from Threat Hunting: Get Pending Jobs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports an optional message field on the status update to capture outcome details, and an externalId field to link the job to an external system.
    • Returns {"previousStatus": "...", "currentStatus": "..."} on success, with the full status enum (ready, started, completed, abandoned, failed), and a 404 when the job ID is not found.

    3 details in Everything

57. docs update Oct 5, 2026 · issue 095

    Recorded Future: Supports an async threat-hunting workflow: poll pending jobs, update status to started, fetch rules and/or indicators, then mark completed or failed.

    └──▷ TRY IT
    Fetch only Sigma and YARA rules from a completed hunt job to deploy directly into your SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. or endpoint platform.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/threat-hunting/job-rules' \
      -H 'X-RFToken: <your_api_token>' \
      -H 'Content-Type: application/json' \
      -d '{"job_id": "<job_id>", "filter": {"types": ["sigma", "yara"]}}'

58. docs update Oct 4, 2026 · issue 094

    New endpoint lets practitioners look up breach dataset and stealer-log metadata by dump name from Identity Intelligence.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds the Identity: Dump Metadata endpoint, which accepts one or more dump.name values returned by the Identity: Detections endpoint and returns provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. details — breach description, data-source type (SQL dump, malware logs), ingest date, affected domain, breach timeframe, and, for stealer malware log sources, exfiltration date, OS details, and malware information.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

59. docs update Oct 4, 2026 · issue 094

    New Identity: Incident Report endpoint surfaces every credential harvested from a single stealer malware infection⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Supports include_details=true|false to return machine context — malware family, OS, username, timezone, exfiltration date, and source IP — alongside partially masked domains, logins, and passwords; omitting the field returns HTTP 400.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Paginates results via next_offset when a single infection event yields more credentials than one page can hold.

    2 details in Everything

60. docs update Oct 4, 2026 · issue 094

    New Identity: IP Lookup endpoint retrieves stolen credentials tied to a specific IP address or IP range from compromised machines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Investigate all compromised devices within a corporate subnet by querying a CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network.-equivalent IP range for stolen credentials.
    copy

    $ curl -X GET 'https://api.recordedfuture.com/identity/ip?range[gte]=192.168.1.0&range[lte]=192.168.1.255' -H 'Authorization: Bearer <token>' -H 'Accept: application/json'

    Look up stolen credentials for a single compromised machine IP discovered via the dump.infrastructure.ip field from an Identity: Detections response.
    copy

    $ curl -X GET 'https://api.recordedfuture.com/identity/ip?ip=203.0.113.47' -H 'Authorization: Bearer <token>' -H 'Accept: application/json'

    • Adds GET /identity/ip endpoint to retrieve stolen credentials associated with a specific IP address or IP range, using an exact ip parameter or a range parameter with gte, lte, gt, lt comparison operators to search across network segments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Returns credential records grouped by subject (email or username), including targeted login service URL and domain, password hash values and complexity indicators, stolen browser cookies, responsible malware family, victim OS, computer name, geolocation, and exfiltration date.

    2 details in Everything

61. docs update Oct 4, 2026 · issue 094

    Recorded Future adds Identity: Hostname endpoint to pivot from a compromised machine name to all stolen credentials harvested from it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Computer names for use with this endpoint can be sourced from the dump.compromise.computer_name field returned by the Identity: Detections endpoint.

    1 detail in Everything

62. docs update Oct 4, 2026 · issue 094

    Recorded Future adds Lists: Get Text Entries API endpoint to retrieve free-form text strings stored in text-type lists.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

63. docs update Oct 4, 2026 · issue 094

    Recorded Future adds a Lists: Remove Entity API endpoint to drop entities from monitoring lists.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds Lists: Remove Entity endpoint to remove a single entity from a Recorded Future list, specified by Recorded Future entity ID (e.g., ip:8.8.8.8, idn:example.com) or by name/type pair.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Returns a result field in the response confirming successful entity removal from the list.

    2 details in Everything

64. docs update Oct 4, 2026 · issue 094

    Recorded Future adds a Lists: Add Entity API endpoint with arbitrary context metadata support for list membership workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Add a suspicious IP to a threat-tracking list and attach incident ticket metadata so the list entry is traceable to your ticketing system.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/lists-add-entity' \
      -H 'X-RFToken: <your-api-token>' \
      -H 'Content-Type: application/json' \
      -d '{
        "listId": "report:XXXXX",
        "id": "ip:198.51.100.42",
        "context": {
          "source": "threat-feed",
          "ticket_id": "INC-12345",
          "annotation": "Observed C2 beacon - added by SOC automation"
        }
      }'

    Add a domain using type+name auto-resolution (no need to look up the RF entity ID first) for supported types like InternetDomainName.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/lists-add-entity' \
      -H 'X-RFToken: <your-api-token>' \
      -H 'Content-Type: application/json' \
      -d '{
        "listId": "report:XXXXX",
        "type": "InternetDomainName",
        "name": "malicious-example.com",
        "context": {
          "source": "phishing-campaign",
          "annotation": "Phishing domain flagged in Q2 campaign"
        }
      }'

    • Supports attaching arbitrary key-value metadata to a list entity via a context object in the request body, with no fixed schema, enabling workflow tracking fields such as 'source': 'threat-feed' or 'ticket_id': 'INC-12345'; nested objects are supported.
    • Exposes context replacement semantics: re-adding an existing entity with different context fully replaces (not merges) stored context and returns 'result': 'added'; re-adding with identical or no context returns 'result': 'unchanged'.
    • Introduces the reserved annotation key within context as the only key rendered in the Recorded Future platform UI — all other keys are stored and returned by Lists: Get Entities via API but not displayed in the interface.

    3 details in Everything

65. docs update Oct 4, 2026 · issue 094

    New Lists: Entities endpoint retrieves all entities in a Recorded Future list with identity and processing status.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Exposes a status field per entity indicating whether it is pending (recently added, not yet fully indexed) or ready (fully processed and available for platform features), enabling programmatic audit of list ingestion state.

    1 detail in Everything

66. docs update Oct 4, 2026 · issue 094

    Recorded Future adds Lists: Get Info endpoint to retrieve metadata for a specific list by ID⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

67. docs update Oct 4, 2026 · issue 094

    Recorded Future adds POST /lists/search endpoint to discover list IDs by name, type, and limit⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Discover list IDs for all IP-type lists before calling Lists: Get Entities or Lists: Add Entity.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/lists/search' \
      -H 'X-RFToken: <your_api_token>' \
      -H 'Content-Type: application/json' \
      -d '{"type": "ip", "limit": 100}'

    Find a specific list by name substring to retrieve its id for downstream list operations.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/lists/search' \
      -H 'X-RFToken: <your_api_token>' \
      -H 'Content-Type: application/json' \
      -d '{"name": "watchlist", "limit": 25}'

68. docs update Oct 4, 2026 · issue 094

    Recorded Future adds a POST endpoint to create named, typed lists via API, returning an ID for downstream list operations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds Lists: Create API endpoint that creates a new empty Recorded Future list, requiring name and type fields; valid type values are entity, ip, domain, vulnerability, hash, company, attacker, executive, source, and text.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Returns list metadata — including an id field in report:XXXXX format — that is required for follow-on calls to Lists: Add Entity and Lists: Get Status.

    2 details in Everything

69. announced Sep 28, 2026 · issue 089

    Recorded Future MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. is now GA, giving AI agents OAuth-authenticated access to 80+ intelligence tools including write-back to Watch Lists and Analyst Notes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Activate Recorded Future MCP from within the platform so your AI agents gain authenticated access to the full intelligence tool catalog.
    📍In the Recorded Future Platform, go to Integration Center › find the Recorded Future MCP tile › click to activate › configure an integration user with Client ID/Secret (OAuth 2.0) for persistent agent access.
    • Adds Recorded Future MCP, a Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. gateway exposing 80+ intelligence tools — including threat actor profiles, Risk Scores, ransomware metadata, malware sandbox data, and dark web intelligence — to AI agents via OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. (Client ID/Secret).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables write-back from agents to Recorded Future Platform: agents can update Watch Lists and author Platform Analyst Notes directly, not just read intelligence.
    • Accessible as a tile in the Integration Center for activation alongside existing integrations; supports both OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 Client ID/Secret (for integration users) and portal user-based authentication (SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.).
    • Supports direct graph traversal of the Intelligence GraphIntelligence GraphA graph database structure linking entities such as hosts, IPs, domains, and threat actors by relationship, letting cyber tools traverse connections to surface context that flat tables cannot express., letting agents find related entities and context in fewer calls to reduce token cost and latency at agentic scale.
    • Compatible with Claude, ChatGPT Enterprise, Copilot, Cursor, Gemini CLI, and any other OAuth-capable MCP client — no custom agent required.

    5 details in Everything

70. docs update Sep 25, 2026 · issue 085

    New API endpoint retrieves full intelligence for Dark Web Brand Playbook Alerts, including forum, market, Telegram, and ransomware mention details.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Triage a Dark Web Brand Playbook Alert programmatically — pull the full evidence panel including ransomware and Telegram mentions without leaving the API.
    copy

    $ curl -X POST https://api.recordedfuture.com/dark-web-brand-playbook-alert/<alert-id> \
      -H 'X-RFToken: <your-api-token>' \
      -H 'Content-Type: application/json'

71. docs update Sep 25, 2026 · issue 085

    New bulk lookup endpoint for Dark Web Brand Playbook Alerts returns up to 250 alerts in one request⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds POST /dark-web-brand endpoint to fetch detailed panel data for up to 250 Dark Web Brand Playbook Alerts in a single request, replacing one-alert-at-a-time detail calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports an optional panels field in the request body to limit the response to specific panels (status, evidence summary, triage, analysis report, cached content, change log).

    2 details in Everything

72. docs update Sep 22, 2026 · issue 082

    New bulk lookup endpoint hydrates up to 250 Dark Web Brand Playbook Alerts in a single POST request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds POST /dark-web-brand endpoint to fetch detailed panel data for up to 250 Dark Web Brand Playbook Alerts in one request, replacing per-alert detail calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • The panels field on POST /dark-web-brand limits the response to only the panels needed (status, evidence summary, triage, analysis report, cached content, change log).

    2 details in Everything

73. docs update Sep 22, 2026 · issue 082

    New POST endpoint retrieves full Dark Web Brand Playbook Alert intelligence in a single API call⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Triage a Dark Web Brand Playbook Alert programmatically — pull full context including evidence, source details, and change log without opening the UI.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/dark-web/brand-playbook/alert/<alert_id>' \
      -H 'X-RFToken: <your_api_token>' \
      -H 'Content-Type: application/json'

74. docs update Sep 14, 2026 · issue 074
    └──▷ TRY IT
    Retrieve the full triage picture for a specific Dark Web Brand Playbook Alert to assess escalation without leaving the API.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/dark-web/brand-playbook/alert/<alert_id>' \
      -H 'X-RFToken: <your_api_token>' \
      -H 'Content-Type: application/json'

75. docs update Sep 13, 2026 · issue 073
    └──▷ TRY IT
    Triage a Dark Web Brand Playbook Alert programmatically — pull its full evidence package, including ransomware and Telegram mentions, to decide on escalation without opening the UI.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/dark-web/brand-playbook/alert/<alert_id>' \
      -H 'X-RFToken: <api_token>' \
      -H 'Content-Type: application/json'

76. docs update Sep 13, 2026 · issue 073

    New POST /dark-web-brand-playbook-alert/{id} endpoint retrieves full intelligence for a single Dark Web Brand Playbook Alert.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Triage a Dark Web Brand Playbook Alert by pulling its full evidence panel — matched assets, source-specific mentions, and change log — directly from the API to decide on escalation without opening the UI.
    copy

    $ curl -X POST 'https://api.recordedfuture.com/dark-web-brand-playbook-alert/{id}' \
      -H 'X-RFToken: <your_api_token>' \
      -H 'Content-Type: application/json'

77. announced Sep 9, 2026 · issue 070

    Recorded Future launches Digital Risk Protection, unifying brand and identity monitoring across five external threat surfaces in one workflow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    • Adds Digital Risk Protection, a unified workspace covering five external threat surfaces: Malicious Site Monitoring, Impersonation Monitoring, Code Repository Monitoring, Dark Web Brand Monitoring, and Identity Exposure Monitoring.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces an AI Triage Agent for Malicious Site Monitoring and Dark Web Brand Monitoring that automatically evaluates high-interest detections and delivers an explicit verdict with reasoning, surfacing only critical, high-priority Alerts.
    • Adds Malicious Site Monitoring, which flags newly registered lookalike domains and phishing infrastructure within hours of registration using logo detection and image OCROCROptical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. to catch impersonation beyond keyword matching.
    • Adds Impersonation Monitoring to detect fake executive profiles and company impersonation accounts across social and professional networking platforms.
    • Adds Code Repository Monitoring to continuously scan public repositories for exposed credentials, PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations., and source code.

    +5 more show less

    • Adds Dark Web Brand Monitoring to surface brand mentions, planned attacks, and compromised data across underground forums, marketplaces, and ransomware extortion sites.
    • Adds Identity Exposure Monitoring to surface compromised employee credentials from active infostealer logs within hours of exfiltration, with VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. monitoring available for executive accounts.
    • Adds Customer Credential Monitoring as a paid add-on that extends credential exposure visibility to an organization's customer base.
    • Provides configurable risk thresholds per use case so teams control which detections escalate to Alerts without losing underlying detection coverage.
    • Includes one-click takedown coordination available across all five use cases from day one.

    10 details in Everything

78. announced Sep 9, 2026 · issue 011

    Recorded Future launches Digital Risk Protection, unifying brand and identity monitoring across five external threat surfaces in one workflow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    • Adds Digital Risk Protection, a unified workspace covering five external threat surfaces: Malicious Site Monitoring, Impersonation Monitoring, Code Repository Monitoring, Dark Web Brand Monitoring, and Identity Exposure Monitoring.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces an AI Triage Agent for Malicious Site Monitoring and Dark Web Brand Monitoring that automatically evaluates high-interest detections and delivers an explicit verdict with reasoning, surfacing only critical, high-priority Alerts.
    • Adds Malicious Site Monitoring, which flags newly registered lookalike domains and phishing infrastructure within hours of registration using logo detection and image OCROCROptical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. to catch impersonation beyond keyword matching.
    • Adds Impersonation Monitoring to detect fake executive profiles and company impersonation accounts across social and professional networking platforms.
    • Adds Code Repository Monitoring to continuously scan public repositories for exposed credentials, PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations., and source code.

    +5 more show less

    • Adds Dark Web Brand Monitoring to surface brand mentions, planned attacks, and compromised data across underground forums, marketplaces, and ransomware extortion sites.
    • Adds Identity Exposure Monitoring to surface compromised employee credentials from active infostealer logs within hours of exfiltration, with VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. monitoring available for executive accounts.
    • Adds Customer Credential Monitoring as a paid add-on that extends credential exposure visibility to an organization's customer base.
    • Provides configurable risk thresholds per use case so teams control which detections escalate to Alerts without losing underlying detection coverage.
    • Includes one-click takedown coordination available across all five use cases from day one.

    10 details in Everything

79. announced Aug 26, 2026 · issue 058

    Recorded Future launches AI Alert Filtering, automatically sorting alert references by relevance with custom intent per rule and optional auto-dismiss.

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Enable AI Alert Filtering on a specific alert rule to start automatically triaging references by relevance without changing the underlying rule.
    📍In the Portal, go to Alerts › select a classic or custom alert rule › enable AI Alert Filtering for that rule.
    Sharpen AI relevance decisions for a rule scoped to a specific organization by setting a custom intent, without rebuilding the rule from scratch.
    📍In the Portal, go to Alerts › select the alert rule › open AI Alert Filtering settings › enter a custom intent (e.g. 'This rule is for ACME Bank, not ACME Center').
    • New AI Alert Filtering feature, enabled per rule from the Alerts page in the Portal, automatically classifies every reference inside a fired Alert into High Relevance and Low Relevance sections before an analyst opens it.
    • Adds per-rule custom intent configuration so analysts can define exactly what the AI should prioritize beyond the default rule intent (e.g. scoping a rule to a specific organization).
    • Adds optional auto-dismiss: when no references meet the relevance threshold, the Alert can be automatically dismissed before reaching the analyst queue.
    • Adds an AI-generated title and summary at the top of every Alert, covering what came through and surfacing whether anything demands immediate attention.
    • Irrelevant references can optionally be excluded from API payloads sent by Recorded Future, reducing noise in downstream integrations.

    +1 more show less

    • Available at no additional cost to all Recorded Future customers; enabled by default for new customers.

    6 details in Everything

80. Playbook Alerts API v1.3.0 Mar 2, 2026 · release notes

    Playbook Alerts API v1.3.0 adds structured alert_rule fields to search and common endpoints

    • Adds mandatory alert_rule.id, alert_rule.label, and optional alert_rule.name fields to the response of /search endpoint.
    • Makes the alert_rule response structure mandatory for the remaining endpoints; alert_rule.name is optional.

    2 details in Everything

81. ASI Project API v1.7.0 (2026-02-09) Feb 9, 2026 · release notes

    ASI Project API v1.7.0 adds new filtering parameters for asset search

82. Playbook Alerts API v1.2.0 Dec 16, 2025 · release notes

    Playbook Alerts API v1.2 adds offset param for pagination and new rule_id/alert_rule fields.

    • Adds offset parameter to the /search endpoint to improve pagination support
    • Adds a rule_id field to the /search endpoint response.
    • Adds alert_rule.id, alert_rule.label, and alert_rule.name fields to details endpoints

    3 details in Everything