Recorded Future Operation

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

Enrich

The Enrich action provides enrichment from Recorded Future on the selected object.  

GET https://api.recordedfuture.com:443/v2/ip/{indicator}?fields=risk,entity,intelCard,location,metrics,relatedEntities,timestamps

Sample Response:

{
    "data": {
        "location": {
            "organization": "DIGITALOCEAN-ASN",
            "cidr": {
                "id": "ip:192.241.192.0/19",
                "name": "192.241.192.0/19",
                "type": "IpAddress"
            },
            "location": {
                "continent": "North America",
                "country": "United States",
                "city": "San Francisco"
            },
            "asn": "AS14061"
        },
        "timestamps": {
            "lastSeen": "2022-02-20T20:19:49.836Z",
            "firstSeen": "2020-07-09T09:24:18.846Z"
        },
        "risk": {
            "criticalityLabel": "Suspicious",
            "riskString": "9/77",
            "rules": 9,
            "criticality": 2,
            "riskSummary": "9 of 77 Risk Rules currently observed.",
            "score": 39,
            "evidenceDetails": [
                {
                    "mitigationString": "",
                    "evidenceString": "4 sightings on 1 source: AbuseIP Database. Most recent link (Jul 9, 2020): https://www.abuseipdb.com/check/192.241.212.32",
                    "rule": "Historical Multicategory Blocklist",
                    "criticality": 1,
                    "timestamp": "2020-07-09T09:24:09.046Z",
                    "criticalityLabel": "Unusual"
                }
            ]
        },
        "intelCard": "https://app.recordedfuture.com/live/sc/entity/ip%3A192.241.212.32",
        "entity": {
            "id": "ip:192.241.212.32",
            "name": "192.241.212.32",
            "type": "IpAddress"
        },
        "metrics": [
            {
                "type": "unusualIPSightings",
                "value": 6
            }
        ],
        "relatedEntities": []
    }
}

ThreatQuotient provides the following default mapping for this feed:

Feed Data Path	ThreatQ Entity	ThreatQ Object Type or Attribute Key	Published Date	Examples	Notes
.data.relatedEntities[]	Related Indicator	IP Address/FQDN/ HASH/URL	N/A	N/A	If .data.relatedEntities[].type in RelatedIpAddress, RelatedInternetDomainName, RelatedHash, RelatedURL
.data.relatedEntities[]	Indicator Attribute	.data.related Entities[].name	N/A	N/A	If .data.relatedEntities[].type in RelatedMalwareCategory, RelatedAttackVector, RelatedMalware, RelatedProduct
.data.risk.score	Indicator Attribute	Risk Score	N/A	39	N/A
.data.risk.criticalityLabel	Indicator Attribute	Criticality	N/A	Suspicious	N/A
.data.risk.riskSummary	Indicator Attribute	Risk Summary	N/A	9 of 77 Risk Rules currently observed.	N/A
.data.risk.evidenceDetails[].rule	Indicator Attribute	Rule	N/A	Historical Multicategory Blocklist	N/A
.data.metrics.type/ .data.metrics.value	Indicator Attribute	Unusual IP Sightings	N/A	6	.data.metric.type is processed as title
.data.timestamps.firstSeen	Indicator Attribute	First Seen	N/A	2020-07- 09T09:24:18.846Z	N/A
.data.timestamps.lastSeen	Indicator Attribute	Last Seen	N/A	2022-02- 20T20:19:49.836Z	N/A

Find Entity Links

The Find Entity Links action fetches relationships for a given entity.

POST https://api.recordedfuture.com/links/search

Sample Request:

{"entities":["ip:192.241.212.32"], 
"limits": {"search_scope": "medium", "per_entity_type": 100}, 
"filters": {
    
    "entity_types": ["type:Malware", "type:Person", "type:MitreAttackIdentifier", "type:AttackVector", "type:Organization", "type:IpAddress", "type:InternetDomainName", "type:Hash", "type:CyberVulnerability", "type:Username"], 
    "sources": ["technical", "insikt"], 
    "sections": ["iU_ZsE", "iU_ZsG", "iU_ZsI"]
    }
}

Sample Response:

{
    "data": [
        {
            "entity": {
                "type": "type:IpAddress",
                "id": "ip:192.241.212.32",
                "name": "192.241.212.32"
            },
            "links": [
                {
                    "type": "type:Hash",
                    "id": "hash:470de980ea57e5cbaaf82ffd66229a9c59fbc1ab43b41fa4ba092adcbc305dba",
                    "name": "470de980ea57e5cbaaf82ffd66229a9c59fbc1ab43b41fa4ba092adcbc305dba",
                    "source": "technical",
                    "section": "iU_ZsG",
                    "attributes": [
                        {
                            "id": "criticality",
                            "value": "Malicious"
                        },
                        {
                            "id": "risk_score",
                            "value": 70
                        },
                        {
                            "id": "risk_level",
                            "value": 3
                        }
                    ]
                },
                {
                    "type": "type:Malware",
                    "id": "YuDlCN",
                    "name": "WARZONE RAT",
                    "source": "technical",
                    "section": "iU_ZsE",
                    "attributes": []
                },
                {
                    "type": "type:MitreAttackIdentifier",
                    "id": "mitre:T1584",
                    "name": "T1584",
                    "source": "technical",
                    "section": "iU_ZsE",
                    "attributes": [
                        {
                            "id": "display_name",
                            "value": "T1584 (Compromise Infrastructure)"
                        }
                    ]
                },
                {
                    "type": "type:MitreAttackIdentifier",
                    "id": "mitre:TA0011",
                    "name": "TA0011",
                    "source": "technical",
                    "section": "iU_ZsE",
                    "attributes": [
                        {
                            "id": "display_name",
                            "value": "TA0011 (Command and Control)"
                        }
                    ]
                }
            ]
        }
    ]
}

ThreatQuotient provides the following default mapping for this feed:

Feed Data Path	ThreatQ Entity	ThreatQ Object Type or Attribute Key	Published Date	Examples	Notes
.data.links[].name	Related Indicator	.data.link[].type	N/A	470de980ea57e5cb aaf82ffd66229a9c5 9fbc1ab43b41fa4ba 092adcbc305dba	If .data.links[].type in see Entity IOC type map table. If Indicators & Detection Rules is checked and if corresponding .data.links[].type from Entity IOC type map is checked
.data.links[].attributes[].value	Related Indicator Attribute	Criticality	N/A	Malicious	If .data.links[].attributes[].id is criticality
.data.links[].attributes[].value	Related Indicator Attribute	Risk Score	N/A	70	If .data.links[].attributes[].id is risk_score
.data.links[].attributes[].value	Related Indicator Attribute	Risk Level	N/A	3	If .data.links[].attributes[].id is risk_level
.data.links[].attributes[].value	Related Attack Pattern	N/A	N/A	T1584 (Compromise Infrastructure)	If .data.links[].type is type:MitreAttackIdentifier and .data.link[].attributes[].id is display_name
.data.links[].attributes[].value	Indicator Attribute	Tactic	N/A	Command and Control	If .data.links[].type is type:MitreAttackIdentifier and .data.link[].attributes[].id is display_name and .data.link[].name starts with TA
.data.links[].name	Related Malware	N/A	N/A	WARZONE RAT	If .data.links[].type is type:Malware and Malware is checked
.data.links[].name	Related Adversary	N/A	N/A	N/A	If .data.links[].type is type:Person or type:Organization and Actors is checked
.data.links[].name	Indicator Attribute	Attack Vector	N/A	N/A	If .data.links[].type is type:AttackVector and Attack Vector is checked

Find Entity Links Run Parameters

The follow run parameters are available when you select the Find Entity Links action:

Parameter	Description
Metadata Sections	Select which metadata sections to fetch from the Recorded Future Links API. Options include: Actors, Tools & TTPs Indicators & Detection Rules Victims & Exploit Targets
IOC Types	Select which IOC types to fetch from the Recorded Future Links API. Options include: IP Addresses FQDNs Hashes CVEs Usernames
Entity Types	Select which entity types to fetch from the Recorded Future Links API. Options include: Malware Actors MITRE Techniques / Tactics Attack Vectors
Sources	Select which sources to use for fetching entity info from the Recorded Future Links API. Options include: Technical Insikt Group

Entity IOC Type Mapping

The following table describes the Recorded Future to ThreatQ IOC Type mapping.

Recorded Future Value	ThreatQ IOC Type
type:IpAddress	IP Address
type:InternetDomainName	FQDN
type:Hash	MD5
type:Hash	SHA-2
type:Hash	SHA-256
type:Hash	SHA-384
type:Hash	SHA-512
type:CyberVulnerability	CVE
type:Username	Username

Entity Object Type Mapping

The following table describes the Recorded Future Entity to ThreatQ Object Type mapping.

Recorded Future Value	ThreatQ IOC Type
type:Malware	Malware
type:Person	Adversary
type:Organization	Adversary
type:MitreAttackIdentifier	Attack Pattern-2

Intel Card Link

The Intel Card Link action provides a link to the Recorded Future Intel Card.

GET https://api.recordedfuture.com:443/v2/ip/{indicator}?fields=intelCard

Sample Response:

{
    "data": {
        "intelCard": "https://app.recordedfuture.com/live/sc/entity/ip%3A192.241.212.32"
    }
}

PDF Guides

Document	ThreatQ Version
Recorded Future Operation Guide v1.4.0	4.3.0 or Greater
Recorded Future Operation Guide v1.3.0	4.3.0 or Greater