Recorded Future V2

Reference

Recorded Future Connector enables access to the Recorded Future Intelligence. The connector has dedicated actions for pulling Recorded Future indicators (IP, Domain, URL, Hash) and associated context (Risk Score, Risk Rules, Intelligence Card Link and High Confidence Evidence Based Links), Vulnerabilities, Recorded Future Alerts and enables access to Recorded Future SOAR API and Fusion Files

This connector is available in the following products and regions:

Service	Class	Regions
Logic Apps	Standard	All Logic Apps regions
Power Automate	Premium	All Power Automate regions
Power Apps	Premium	All Power Apps regions

Contact
Name	Recorded Future Support
URL	https://support.recordedfuture.com
Email	support@recordedfuture.com

Connector Metadata
Publisher	Recorded Future
Website	https://www.recordedfuture.com
Privacy Policy	https://www.recordedfuture.com/privacy-policy/
Categories	AI;Data

Recorded Future V2

The Recorded Future integration allows real-time security intelligence to be integrated into popular Microsoft services like Sentinel, Defender ATP, and others. This empowers our clients to maximize their existing security investments, ensuring they have real-time intelligence to secure their cloud environments and reduce risk to the organization. The Recorded Future connector for Microsoft Azure enables access to dedicated actions for pulling Recorded Future indicators (IP, Domain, URL, Hash, Vulnerabilities), associated context (Risk Score, Risk Rules, High Confidence Links, and an Intelligence Card Link), Recorded Future Alerts, Playbooks Alerts and Detection Rules.

Publisher: Recorded Future

Whats new?

Added Recorded Future Playbook Alerts actions
New V2 Recorded Future Alerts actions
Added Recorded Future Detection Rules actions
Added IntelligenceCloud parameter
Added HTML response to lookup actions

Prerequisites

To enable the Recorded Future for Microsoft Azure integration, users must be provisioned a Recorded Future API token. Please reach to your account manager to obtain the necessary API token.

How to get credentials

Prior to use of the Recorded Future integration for Microsoft Azure, users must provision an API token from their account manager or from within the Recorded Future portal necessary for the integration.

Login to the Recorded Future Portal (https://app.recordedfuture.com). Click on the menu in the upper right and choose �User Settings�.
On the User Settings menu, choose the �API Access� section and click the �Generate New API Token� link.
Provide a name for your token, select a �Description� of �Microsoft Azure�, and then click the �Create� button. Save the API token that is generated, since you will configure it within the Microsoft Azure connector for the integration.

Supported Operations

This connector is used to pull Recorded Future indicators, alerts, playbook alerts, and detection rules :

IP Enrichment - Enrich an IP with Recorded Future data.
Domain Enrichment - Enrich a domain with Recorded Future data.
URL Enrichment - Enrich a URL with Recorded Future data.
Hash Enrichment - Enrich a hash with Recorded Future data.
Vulnerability Enrichment - Enrich a vulnerability with Recorded Future data.
Search Alert Notification - List Alert Notifications by a set of search parameters.
Get Alert Notification by ID - Get the alert details of a triggered alert
Search Alert Rules - List alert rules by name
Search Alert Notification (Deprecated) - Deprecated
Get Alert Notification by ID (Deprecated) - Deprecated
Search Playbook Alerts - List playbook alerts based on a set of search parameters
Get Playbook Alert by ID - Get the alert details of a playbook alert
Search Detection Rules - Get detection rules matching a search filter
Recorded Future RiskLists and SCF Download - Download Recorded Future Risk Lists and Security Control Feeds
SOAR API - Multi-Entitiy Enrichment - Enrich multiple entities at once (Specific Access is Required)

Known issues and limitations

N/A

Creating a connection

The connector supports the following authentication types:


Default	Parameters for creating connection.	All regions	Not shareable

Default

Applicable: All regions

Parameters for creating connection.

This is not shareable connection. If the power app is shared with another user, another user will be prompted to create new connection explicitly.

Name	Type	Description	Required
API Key	securestring	The API Key for this api	True

Throttling Limits

Name	Calls	Renewal Period
API calls per connection	100	60 seconds

Actions

Domain Enrichment	Enrich a domain with Recorded Future data
Get Alert Notification by ID	Get the alert details of a triggered alert
Get Alert Notification by ID (Deprecated)	Deprecated, use /v2/alerts/{id} instead. Get the alert details of a triggered alert
Get Playbook Alert by ID	Get the alert details of a playbook alert
Hash Enrichment	Enrich a hash with Recorded Future data
IP Enrichment	Enrich an IP with Recorded Future data
Recorded Future RiskLists and SCF Download	Download Recorded Future Risk Lists and Security Control Feeds
Search Alert Notification	List Alert Notifications by a set of search parameters
Search Alert Notifications (Deprecated)	Deprecated, use /v2/alerts instead. List Alert Notifications by a set of search parameters
Search Alert Rules	List alert rules by name
Search Detection Rules	Get detection rules matching a search filter
Search Playbook Alerts	List playbook alerts based on a set of search parameters
SOAR API - Multi-Entitiy Enrichment	Enrich multiple entities at once (Specific Access is Required)
URL Enrichment	Enrich a URL with Recorded Future data
Vulnerability Enrichment	Enrich a vulnerability with Recorded Future data

Domain Enrichment

Operation ID:: D_E

Enrich a domain with Recorded Future data

Parameters

Name	Key	Required	Type	Description
Domain input	domain	True	string	The domain to lookup. Must be a single domain

Returns

Name	Path	Type	Description
intelCard	data.intelCard	string	Recorded Future Intelligence Card Link
criticalityLabel	data.risk.criticalityLabel	string	Recorded Future Indicator Criticality Level
score	data.risk.score	integer	Recorded Future Indicator Risk Score
evidenceDetails	data.risk.evidenceDetails	array of object	Evidence details
evidenceString	data.risk.evidenceDetails.evidenceString	string	Recorded Future Risk Rules Evidence Details
rule	data.risk.evidenceDetails.rule	string	Recorded Future Indicator Risk Rules
riskSummary	data.risk.riskSummary	string	Recorded Future Risk Rules Summary
links	data.links	Links	High Confidence Evidence Based Links
html_response	data.html_response	string

Get Alert Notification by ID

Operation ID:: Alert_search_id_v2

Get the alert details of a triggered alert

Parameters

Name	Key	Required	Type	Description
Alert Notification ID	id	True	string	Alert Notification ID
Fields to include	fields		string	Fields to include. Returns all if not specified.

Returns

Name	Path	Type	Description
data	data	AlertSearchV2

Get Alert Notification by ID (Deprecated)

Operation ID:: Alert_Not_Lookup

Deprecated, use /v2/alerts/{id} instead. Get the alert details of a triggered alert

Parameters

Name	Key	Required	Type	Description
Alert Notification ID	id	True	string	Alert Notification ID

Returns

Body: AlertLookup

Get Playbook Alert by ID

Operation ID:: Playbook_Alert_Lookup

Get the alert details of a playbook alert

Parameters

Name	Key	Required	Type	Description
Playbook Alert ID	id	True	string	Playbook Alert ID

Returns

Body: PlaybookAlertLookup

Hash Enrichment

Operation ID:: H_E

Enrich a hash with Recorded Future data

Parameters

Name	Key	Required	Type	Description
HASH input	hash	True	string	The HASH to lookup. Must be a single HASH

Returns

Name	Path	Type	Description
intelCard	data.intelCard	string	Recorded Future Intelligence Card Link
criticalityLabel	data.risk.criticalityLabel	string	Recorded Future Indicator Criticality Level
score	data.risk.score	integer	Recorded Future Indicator Risk Score
evidenceDetails	data.risk.evidenceDetails	array of object	Evidence details
evidenceString	data.risk.evidenceDetails.evidenceString	string	Recorded Future Risk Rules Evidence Details
rule	data.risk.evidenceDetails.rule	string	Recorded Future Indicator Risk Rules
riskSummary	data.risk.riskSummary	string	Recorded Future Risk Rules Summary
links	data.links	Links	High Confidence Evidence Based Links
html_response	data.html_response	string

IP Enrichment

Operation ID:: IP_E

Enrich an IP with Recorded Future data

Parameters

Name	Key	Required	Type	Description
IP input	ip	True	string	The IP address to lookup. Must be a single IP address

Returns

Name	Path	Type	Description
intelCard	data.intelCard	string	Recorded Future Intelligence Card Link
criticalityLabel	data.risk.criticalityLabel	string	Recorded Future Indicator Criticality Level
score	data.risk.score	integer	Recorded Future Indicator Risk Score
evidenceDetails	data.risk.evidenceDetails	array of object	Evidence details
evidenceString	data.risk.evidenceDetails.evidenceString	string	Recorded Future Risk Rules Evidence Details
rule	data.risk.evidenceDetails.rule	string	Recorded Future Indicator Risk Rules
riskSummary	data.risk.riskSummary	string	Recorded Future Risk Rules Summary
links	data.links	Links	High Confidence Evidence Based Links
html_response	data.html_response	string

Recorded Future RiskLists and SCF Download

Operation ID:: R_List_D

Download Recorded Future Risk Lists and Security Control Feeds

Parameters

Name	Key	Required	Type	Description
Path to file	path	True	string	Path to file

Returns

Name	Path	Type
		array of object
Name	Name	string
Risk	Risk	integer
RiskString	RiskString	string
EvidenceDetails	EvidenceDetails.EvidenceDetails	array of object
Rule	EvidenceDetails.EvidenceDetails.Rule	string
EvidenceString	EvidenceDetails.EvidenceDetails.EvidenceString	string
CriticalityLabel	EvidenceDetails.EvidenceDetails.CriticalityLabel	string
Timestamp	EvidenceDetails.EvidenceDetails.Timestamp	integer
MitigationString	EvidenceDetails.EvidenceDetails.MitigationString	string
Criticality	EvidenceDetails.EvidenceDetails.Criticality	integer

Search Alert Notification

Operation ID:: Alert_search_v2

List Alert Notifications by a set of search parameters

Parameters

Name	Key	Type	Description
Triggered	triggered	string	The timeframe for which to include triggered alerts.
Alert Rule ID	alertRule	string	Only return alerts triggered for the specified alert rule id.
Maximum number of records	limit	integer	Limits the number of returned alerts.
Records from offset	from	integer	Records from offset
Fields to include	fields	string	Fields to include. Returns all if not specified.

Returns

Name	Path	Type
data	data	array of AlertSearchV2
returned	counts.returned	integer
total	counts.total	integer

Search Alert Notifications (Deprecated)

Operation ID:: Alert_Not_Search

Deprecated, use /v2/alerts instead. List Alert Notifications by a set of search parameters

Parameters

Name	Key	Required	Type	Description
Triggered	triggered		string	All Elasticsearch compatible date formats are valid.
Alert Rule ID	alertRule	True	string	Alert Rule ID
Maximum number of records	limit		integer	Maximum number of records
Records from offset	from		integer	Records from offset

Returns

Body: AlertSearch

Search Alert Rules

Operation ID:: Alert_Rules_Search

List alert rules by name

Parameters

Name	Key	Required	Type	Description
Freetext search	freetext		string	Freetext search for Alert Rule Name
Maximum number of records	limit		integer	Maximum number of records

Returns

Name	Path	Type	Description
results	data.results	array of object	Results
Alert Rule Title	data.results.title	string	Title
Alert Rule ID	data.results.id	string	Id
Returned Number of Alert Rules	counts.returned	integer	Returned
Total Number of Alert Rules	counts.total	integer	Total

Search Detection Rules

Operation ID:: Detection_Rule_Search

Get detection rules matching a search filter

Parameters

Name	Key	Type	Description
types	types	array of string	List of detection rule types to include in the response
entities	entities	array of string	List of entities that the detection rules must be related to
before	before	date-time	Limit created date. E.g: 2023-06-01T00:00:00Z
after	after	date-time	Limit created date. E.g: 2023-01-01T00:00:00Z
Limit	limit	integer	Limit the number of returned detection rules

Returns

Name	Path	Type	Description
Detection Rule Count	count	integer	Count
Detection Rules	result	array of object	Detection Rules
id	result.id	string
type	result.type	string
title	result.title	string
description	result.description	string
rules	result.rules	array of object
name	result.rules.name	string
description	result.rules.description	string
file_name	result.rules.file_name	string
entities	result.rules.entities	array of object
id	result.rules.entities.id	string
type	result.rules.entities.type	string
name	result.rules.entities.name	string
display_name	result.rules.entities.display_name	string
content	result.rules.content	string
created	result.created	string
updated	result.updated	string

Search Playbook Alerts

Operation ID:: Playbook_Alert_Search

List playbook alerts based on a set of search parameters

Parameters

Name	Key	Type	Description
entities	entities	array of string	A list of entities
statuses	statuses	array of string	A list of alert statuses
priorities	priorities	array of string	A list of alert priorities
categories	categories	array of string	A list of alert categories
Relative created from	created_from_relative	string	Limit the response to playbook alerts created at most this many hours in the past. Defaults to '-168' (one week back).
Relative created until	created_until_relative	string	Limit the response to playbook alerts created at the latest this many hours in the past. Defaults to '0' (now).
Relative updated from	updated_from_relative	string	Limit the response to playbook alerts updated at most this many hours in the past. Defaults to '-168' (one week back).
Relative updated until	updated_until_relative	string	Limit the response to playbook alerts updated at the latest this many hours in the past. Defaults to '0' (now).

Returns

Playbook Alerts matching the search criteria

Items: PlaybookAlertSearch

SOAR API - Multi-Entitiy Enrichment

Operation ID:: Soar_Bulk_Lookup

Enrich multiple entities at once (Specific Access is Required)

Parameters

Name	Key	Type	Description
ip	ip	array of string	Ip
url	url	array of string	Url
domain	domain	array of string	Domain
hash	hash	array of string	Hash
vulnerability	vulnerability	array of string	Vulnerability

Returns

Name	Path	Type
returned	counts.returned	integer
total	counts.total	integer
results	data.results	array of object
id	data.results.entity.id	string
name	data.results.entity.name	string
type	data.results.entity.type	string
context	data.results.risk.context	object
level	data.results.risk.level	number
rule	data.results.risk.rule	object
score	data.results.risk.score	number

URL Enrichment

Operation ID:: U_E

Enrich a URL with Recorded Future data

Parameters

Name	Key	Required	Type	Description
URL input	url	True	string	The URL to lookup. Must be a single URL

Returns

Name	Path	Type	Description
criticalityLabel	data.risk.criticalityLabel	string	Recorded Future Indicator Criticality Level
score	data.risk.score	integer	Recorded Future Indicator Risk Score
evidenceDetails	data.risk.evidenceDetails	array of object	Evidence details
evidenceString	data.risk.evidenceDetails.evidenceString	string	Recorded Future Risk Rules Evidence Details
rule	data.risk.evidenceDetails.rule	string	Recorded Future Indicator Risk Rules
riskSummary	data.risk.riskSummary	string	Recorded Future Risk Rules Summary
links	data.links	Links	High Confidence Evidence Based Links
html_response	data.html_response	string

Vulnerability Enrichment

Operation ID:: Vuln_E

Enrich a vulnerability with Recorded Future data

Parameters

Name	Key	Required	Type	Description
Vulnerability ID (CVE, name) input	id	True	string	The Vulnerability ID (CVE, name) to lookup. Must be a single Vulnerability ID (CVE, name)

Returns

Name	Path	Type	Description
intelCard	data.intelCard	string	Recorded Future Intelligence Card Link
criticalityLabel	data.risk.criticalityLabel	string	Recorded Future Vulnerability Criticality Level
score	data.risk.score	integer	Recorded Future Vulnerability Risk Score
evidenceDetails	data.risk.evidenceDetails	array of object	Evidence details
evidenceString	data.risk.evidenceDetails.evidenceString	string	Recorded Future Risk Rules Evidence Details
rule	data.risk.evidenceDetails.rule	string	Recorded Future Vulnerability Risk Rules
riskSummary	data.risk.riskSummary	string	Recorded Future Risk Rules Summary
links	data.links	Links	High Confidence Evidence Based Links
html_response	data.html_response	string

Definitions

Links

High Confidence Evidence Based Links

Name	Path	Type	Description
startDate	technical.start_date	string	Link start date
stopDate	technical.stop_date	string	Link stop date
entities	technical.entities	array of LinkEntities	Related entities
startDate	research.start_date	string	Link start date
stopDate	research.stop_date	string	Link stop date
entities	research.entities	array of LinkEntities	Related entities

LinkEntities

Name	Path	Type	Description
type	type	string	Enitity type
name	name	string	Entity name
score	score	integer	Risk score
category	category	string	Entity category

AlertSearchV2

Name	Path	Type
review	review	AlertReviewV2
owner_organisation_details	owner_organisation_details	AlertOwnerV2
url	url	AlertURLV2
rule	rule	AlertRuleV2
id	id	AlertID
hits	hits	AlertHitsV2
log	log	AlertLogV2
title	title	AlertTitle
type	type	AlertType
ai_insights	ai_insights	AlertAiV2

AlertAiV2

Name	Path	Type	Description
comment	comment	string
text	text	string

AlertHitsV2

Name	Path	Type
entities	entities	array of object
id	entities.id	string
name	entities.name	string
type	entities.type	string
id	document.source.id	string
name	document.source.name	string
type	document.source.type	string
title	document.title	string
url	document.url	string
authors	document.authors	array of object
id	document.authors.id	string
name	document.authors.name	string
type	document.authors.type	string
fragment	fragment	string
id	id	string
language	language	string
id	primary_entity.id	string
name	primary_entity.name	string
type	primary_entity.type	string
analyst_note	analyst_note	string

AlertSearch

Name	Path	Type
results	data.results	array of object
review	data.results.review	AlertReview
url	data.results.url	AlertURL
rule	data.results.rule	AlertRule
triggered	data.results.triggered	AlertTriggered
id	data.results.id	AlertID
title	data.results.title	AlertTitle
type	data.results.type	AlertType
returned	counts.returned	integer
total	counts.total	integer

AlertLookup

Name	Path	Type
review	data.review	AlertReview
entities	data.entities	AlertEntities
url	data.url	AlertURL
rule	data.rule	AlertRule
triggered	data.triggered	AlertTriggered
id	data.id	AlertID
references	data.counts.references	integer
entities	data.counts.entities	integer
documents	data.counts.documents	integer
title	data.title	AlertTitle
type	data.type	AlertType

AlertLogV2

Name	Path	Type
note_author	note_author	string
note_date	note_date	date-time
status_date	status_date	string
triggered	triggered	string
status_change_by	status_change_by	string

AlertOwnerV2

Name	Path	Type
organisations	organisations	array of object
organisation_id	organisations.organisation_id	string
organisation_name	organisations.organisation_name	string
enterprise_id	enterprise_id	string
enterprise_name	enterprise_name	string

AlertReviewV2

Name	Path	Type
assignee	assignee	string
status	status	string
status_in_portal	status_in_portal	string
note	note	string

AlertReview

Name	Path	Type
assignee	assignee	string
status	status	string
noteDate	noteDate	string
noteAuthor	noteAuthor	string
note	note	string

AlertEntities

Name	Path	Type
trend	trend	object
documents	documents	array of object
references	documents.references	array of object
fragment	documents.references.fragment	string
entities	documents.references.entities	array of object
id	documents.references.entities.id	string
name	documents.references.entities.name	string
type	documents.references.entities.type	string
language	documents.references.language	string
id	documents.source.id	string
name	documents.source.name	string
type	documents.source.type	string
title	documents.title	string
url	documents.url	string
risk	risk	object
id	entity.id	string
name	entity.name	string
type	entity.type	string

AlertURL

: string

AlertRule

Name	Path	Type
name	name	string
id	id	string
url	url	string

AlertURLV2

Name	Path	Type	Description
api	api	string
portal	portal	string

AlertRuleV2

Name	Path	Type
name	name	string
id	id	string
portal	url.portal	string

PlaybookAlertSearch

Playbook Alerts matching the search criteria

Name	Path	Type
playbook_alert_id	playbook_alert_id	string
created	created	string
updated	updated	string
status	status	string
category	category	string
priority	priority	string
title	title	string
owner_id	owner_id	string
owner_name	owner_name	string
organisation_id	organisation_id	string
organistaion_name	organistaion_name	string
organisations	owner_organisation_details.organisations	array of object
organisation_id	owner_organisation_details.organisations.organisation_id	string
organisation_name	owner_organisation_details.organisations.organisation_name	string
enterprise_id	owner_organisation_details.enterprise_id	string
enterprise_name	owner_organisation_details.enterprise_name	string

PlaybookAlertLookup

Name	Path	Type
title	title	string
id	id	string
category	category	string
rule_label	rule_label	string
status	status	string
priority	priority	string
targets	targets	string
created_date	created_date	string
updated_date	updated_date	string
evidence_summary	evidence_summary	string
link	link	string
json_alert	json_alert	string

Jaa

Recorded Future V2

Recorded Future V2

Publisher: Recorded Future

Whats new?

Prerequisites

How to get credentials

Supported Operations

Known issues and limitations

Creating a connection

Default

Throttling Limits

Actions

Domain Enrichment

Parameters

Returns

Get Alert Notification by ID

Parameters

Returns

Get Alert Notification by ID (Deprecated)

Parameters

Returns

Get Playbook Alert by ID

Parameters

Returns

Hash Enrichment

Parameters

Returns

IP Enrichment

Parameters

Returns

Recorded Future RiskLists and SCF Download

Parameters

Returns

Search Alert Notification

Parameters

Returns

Search Alert Notifications (Deprecated)

Parameters

Returns

Search Alert Rules

Parameters

Returns

Search Detection Rules

Parameters

Returns

Search Playbook Alerts

Parameters

Returns

SOAR API - Multi-Entitiy Enrichment

Parameters

Returns

URL Enrichment

Parameters

Returns

Vulnerability Enrichment

Parameters

Returns

Definitions

Links

LinkEntities

AlertSearchV2

AlertAiV2

AlertHitsV2

AlertSearch

AlertLookup

AlertLogV2

AlertOwnerV2

AlertReviewV2

AlertReview

AlertEntities

AlertURL

AlertRule

AlertURLV2

AlertRuleV2

AlertTriggered

AlertID

AlertTitle

AlertType

PlaybookAlertSearch