Recorded Future

LAST UPDATED: JUNE 6, 2025

Overview

Recorded Future generates predictive models by scanning internet sources, then extracts, measures, and visualizes networks and patterns in the past, present and future. Recorded Future’s Identity Intelligence provides organizations with a reliable source for identity authentication, enabling the detection of identity compromises, proactive prevention of identity fraud, and defense against account takeover attacks caused by infostealer malware.

D3 SOAR is providing REST operations to function with Recorded Future.

Recorded Future is available for use in:

D3 SOAR	V12.7.89.0+
Category	Threat Intelligence
Deployment Options	Option II, Option IV

Known Limitations

Licensing

Access to the API is licensed to enterprises with a daily quota of API credits. This daily quota model is used for both pre-packaged and custom integrations. API calls consume a variable number of API credits:

Each risk list download operation = 5 credits
Each lookup or search operation which returns results = 1 credit
Each lookup or search operation which returns only a count = 0 credits

See the Recorded Future Data Sheet for more information on the daily quotas of the APIs.

Connection

To connect to Recorded Future from D3 SOAR, please follow this part to collect the required information below:

Parameter	Description	Example
Server URL (domain level)	The server URL for the API connection on the domain level is the same as the Recorded Future UI portal URL.	https://api.recordedfuture.com
API Key	The API key obtained from Recorded Future used for authenticating the API connection.	*****
Version	The API version used for the connection.	v2

Configuring Recorded Future to Work with D3 SOAR

Recorded Future’s API key must be requested from the Recorded Future support team and cannot be user-generated.

Click on the Integration Support Ticket form link on Requesting API Tokens | Recorded Future.
Fill out and submit the support ticket form.

READER NOTE

D3 SOAR requires the Connect API to be requested to integrate with Recorded Future. Select Connect API for the Recorded Future API Services field.

Configuring D3 SOAR to Work with Recorded Future

Log in to D3 SOAR.
Find the Recorded Future integration.
1. Navigate to Configuration on the top header menu.
2. Click on the Integration icon on the left sidebar.
3. Type Recorded Future in the search box to find the integration, then click it to select it.
4. Click New Connection, on the right side of the Connections section. A new connection window will appear.
Configure the following fields to create a connection to Recorded Future.
1. Connection Name: The desired name for the connection.
2. Site: Specifies the site to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all sites defined as internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.
3. Recipient site for events from connections Shared to Internal Sites: This field is displayed when Share to Internal Sites is selected for the Site field, allowing selection of the internal site for deploying the integration connection.
4. Agent Name (Optional): Specifies the proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.
5. Description (Optional): Add a description for the connection.
6. Tenant (Optional): When configuring the connection from a master tenant site, users have the option to choose the specific tenant sites to share the connection with. Once this setting is enabled, users can filter and select the desired tenant sites from the dropdowns to share the connection.
7. Configure User Permissions: Defines which users have access to the connection.
8. Active: Check the checkbox to ensure the connection is available for use.
9. System Reputation Check: Selecting one or more reputation check tick boxes will run the corresponding check reputation commands under this integration connection to enrich the corresponding artifacts with reputation details.
  For example, an integration connection named "ConnectionA" is configured with the "Sandbox" site. All URL artifacts from the "Sandbox" site will undergo a reputation check using the Check URL Reputation command from that integration. The return data output from this command will then be used to update the risk level of artifacts, which may affect the risk level of incoming events.
10. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
  1. Input the domain level Server URL. The default value is https://api.recordedfuture.com.
  2. Input the saved API Key. Refer to Configuring Recorded Future to Work with D3 SOAR to retrieve the API Key.
  3. Input the API Version used for the connection. The default version is v2. At the time this document was written, version 2 is compatible with all Recorded Future’s integration commands in D3 SOAR.
11. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Refer to the password vault connection guide if needed.
12. Connection Health Check: Periodically checks the connection status by scheduling the Test Connection command at the specified interval (in minutes). Available only for active connections, this feature also allows configuring email notifications for failed attempts.
Test the connection.
1. Click on the Test Connection button to verify credentials and connectivity. A success alert displays Passed with a green checkmark. If the connection fails, review the parameters and retry.
2. Click OK to close the alert window.
3. Click Add to create and add the configured connection.

Commands

Recorded Future includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command function, users can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the Recorded Future API, refer to:

The difference between Check Reputation commands and Lookup commands:

Check reputation commands (e.g. Check Domain Reputation) are D3-defined and have fixed returned result fields (i.e. risk and entity). Lookup commands (e.g. Lookup Domains) do not need to follow the D3-defined format and can return more result fields (i.e. sightings, timestamps, risk, entity).

Note for Time-related parameters

The input format of time-related parameters may vary based on user account settings, which may cause the sample data in commands to differ from what is displayed. To adjust the time format, follow these steps:

Navigate to Configuration > Application Settings. Select Date/Time Format.
Choose your desired date and time format.

The selected time format will now be visible when configuring Date/Time command input parameters.

Check Domain Reputation

Retrieves information on the reputation of the specified domains.

Input

Input Parameter	Required/Optional	Description	Example
Domains	Required	The list of domains for which to return the corresponding reputation information.	JSON `[ "xmr.pool.minergate.com" ]`

Output

To view the sample output data for all commands, refer to this article.

D3-defined Risk Scores and Risk Levels

Recorded Future will return risk scores ranging from 0 to 99, which will correspond to the risk levels below:

Risk Scores	Risk Levels
65 <= Risk Scores <=99	Risk Level = 1
25 <= Risk Scores <=64	Risk Level = 2
5 <= Risk Scores <=24	Risk Level = 3
0 <= Risk Scores <=4	Risk Level = 5

To use the D3-defined Risk Levels, refer to the table below for the corresponding pairs:

Risk Levels	Risk Level Names
1	High
2	Medium
3	Low
4	N/A
5	ZeroRisk

Error Handling

An error tab will appear if the command run fails. The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Check Domain Reputation failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Not found.

Error Sample Data

Check Domain Reputation failed.

Status Code: 404.

Message: Not found.

Check File Reputation

Retrieves information on the reputation of the specified File Hashes.

READER NOTE

File Hashes is a required parameter to run this command.

Run the Hash Value of the Input String, Extract Artifacts from Excel File, Extract Artifacts from Text File, or Get Artifact from JSON Array utility commands to generate file hash values.

Input

Input Parameter	Required/Optional	Description	Example
File Hashes	Required	The file hash values (MD5, SHA-1, or SHA-256) for which to return the corresponding file reputation information.	JSON `[ "*****" ]`

Output

To view the sample output data for all commands, refer to this article.

D3-defined Risk Scores and Risk Levels

Recorded Future will return risk scores ranging from 0 to 99, which will correspond to the risk levels below:

Risk Scores	Risk Levels
65 <= Risk Scores <=99	Risk Level = 1
25 <= Risk Scores <=64	Risk Level = 2
5 <= Risk Scores <=24	Risk Level = 3
0 <= Risk Scores <=4	Risk Level = 5

To use the D3-defined Risk Levels, refer to the table below for the corresponding pairs:

Risk Levels	Risk Level Names
1	High
2	Medium
3	Low
4	N/A
5	ZeroRisk

Error Handling

An error tab will appear if the command run fails. The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Check File Reputation failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Not found.

Error Sample Data

Check File Reputation failed.

Status Code: 404.

Message: Not found.

Check IP Reputation

Retrieves information on the reputation of the specified IP addresses.

Input

Input Parameter	Required/Optional	Description	Example
IP Addresses	Required	The list of IP addresses for which to return the corresponding reputation information. Both IPV4 and IPV6 addresses are valid.	JSON `[ "*...*" ]`
Output Fields	Optional	The list of field names to include in the response data. The available values are "analystNotes", "counts", "enterpriseLists", "entity", "intelCard", "links", "location", "metrics", "relatedEntities", "risk", "riskMapping", "riskyCIDRIPs", "sightings", "threatLists", "timestamps." By default, the values are "location", "risk", and "entity".	JSON `[ "counts", "entity" ]`

Output

To view the sample output data for all commands, refer to this article.

D3-defined Risk Scores and Risk Levels

Recorded Future will return risk scores ranging from 0 to 99, which will correspond to the risk levels below:

Risk Scores	Risk Levels
65 <= Risk Scores <=99	Risk Level = 1
25 <= Risk Scores <=64	Risk Level = 2
5 <= Risk Scores <=24	Risk Level = 3
0 <= Risk Scores <=4	Risk Level = 5

To use the D3-defined Risk Levels, refer to the table below for the corresponding pairs:

Risk Levels	Risk Level Names
1	High
2	Medium
3	Low
4	N/A
5	ZeroRisk

Error Handling

An error tab will appear if the command run fails. The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Check IP Reputation failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Not Found.

Error Sample Data

Check IP Reputation failed.

Status Code: 404.

Message: Not Found.

Check URL Reputation

Retrieves information on the reputation of the specified URLs.

Input

Input Parameter	Required/Optional	Description	Example
URLs	Required	The list of URLs for which to return the corresponding reputation information.	JSON `["https://***.***"]`

Output

To view the sample output data for all commands, refer to this article.

D3-defined Risk Scores and Risk Levels

Recorded Future will return risk scores ranging from 0 to 99, which will correspond to the risk levels below:

Risk Scores	Risk Levels
65 <= Risk Scores <=99	Risk Level = 1
25 <= Risk Scores <=64	Risk Level = 2
5 <= Risk Scores <=24	Risk Level = 3
0 <= Risk Scores <=4	Risk Level = 5

To use the D3-defined Risk Levels, refer to the table below for the corresponding pairs:

Risk Levels	Risk Level Names
1	High
2	Medium
3	Low
4	N/A
5	ZeroRisk

Error Handling

An error tab will appear if the command run fails. The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Check URL Reputation failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Not Found.

Error Sample Data

Check URL Reputation failed.

Status Code: 404.

Message: Not Found

Check Vulnerabilities

Retrieves information on the risk levels of the specified vulnerabilities in the CVE ID syntax.

Input

Input Parameter	Required/Optional	Description	Example
Names	Required	The list of vulnerability names for which to return the corresponding risk levels.	JSON `[ "CVE-2010-4452" ]`

Output

To view the sample output data for all commands, refer to this article.

D3-defined Risk Scores and Risk Levels

Recorded Future will return risk scores ranging from 0 to 99, which will correspond to the risk levels below:

Risk Scores	Risk Levels
65 <= Risk Scores <=99	Risk Level = 1
25 <= Risk Scores <=64	Risk Level = 2
5 <= Risk Scores <=24	Risk Level = 3
0 <= Risk Scores <=4	Risk Level = 5

To use the D3-defined Risk Levels, refer to the table below for the corresponding pairs:

Risk Levels	Risk Level Names
1	High
2	Medium
3	Low
4	N/A
5	ZeroRisk

Error Handling

An error tab will appear if the command run fails. The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Check Vulnerabilities failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: vulnerability cannot be found.

Error Sample Data

Check Vulnerabilities failed.

Status Code: 404.

Message: vulnerability cannot be found.

Delete Analyst Notes

Deletes analyst notes using the given note IDs.

READER NOTE

Note IDs is a required parameter to run this command.

Run the Search Analyst Notes command to obtain the Note IDs. Note IDs can be found in the raw data at the path $.data.results[*].id.

Input

Input Parameter	Required/Optional	Description	Example
Note IDs	Required	The list of analyst note IDs for which to delete the corresponding analyst notes. Note IDs can be obtained using the Search Analyst Notes command.	JSON `["*****"]`

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Delete Analyst Notes failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: No such note found or no access.

Error Sample Data

Delete Analyst Notes failed.

Status Code: 400.

Message: No such note found or no access.

Download Domain Risk List

Downloads the specified domain risk list.

Input

Input Parameter	Required/Optional	Description	Example
List Name	Required	The name of the domain risk list to download.	Recent COVID-19-Related Domain Lure: Suspicious

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Download Domain Risk List failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: 'MaxRetryError' object has no attribute 'get.

Error Sample Data

Download Domain Risk List failed.

Status Code: 403.

Message: 'MaxRetryError' object has no attribute 'get.

Download Entity Risk Lists

Downloads the entity risk lists for the specified entity type. This command can replace these five commands: Download Domain Risk List, Download Hash Risk List, Download IP Risk List, Download URL Risk List, and Download Vulnerability Risk List.

READER NOTE

Risk Rule Names is a required parameter to run this command.

Run the List Entity Risk Rules command to obtain the Risk Rule Names. Risk Rule Names can be found in the raw data at the path $.data.results[*].name.

If the input entity type contains too many risk lists, the error message "Bad Request for url:___” will be returned due to the large download size. Contact the D3 support team to change the web configuration as needed.

Input

Input Parameter

Required/Optional

Description

Example

Entity Type

Required

The entity type for which to download the corresponding risk lists. Available options are:

Domain
File Hash
IP
URL
Vulnerability

Domain

Risk Rule Names

Required

The risk rule names from the specified entity type to include in the downloaded risk lists. Risk Rule Names can be obtained using the List Entity Risk Rules command. If the input risk rule name does not exist, then all risk lists under the specified entity type will be downloaded. In this case, the download size may be too large to save and the error message "Bad Request for url:___” will be returned. Contact the D3 support team to change the web configuration as needed.

JSON

["recentCovidSpam"]

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Download Entity Risk Lists failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Bad Request for url: XXX.

Error Sample Data

Download Entity Risk Lists failed.

Status Code: 400.

Message: Bad Request for url: XXX.

Download Hash Risk List

Downloads the specified hash risk list.

Input

Input Parameter	Required/Optional	Description	Example
List Name	Required	The name of the file risk list to download.	Trending in Recorded Future Analyst Community

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Download Hash Risk List failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: 'MaxRetryError' object has no attribute 'get.

Error Sample Data

Download Hash Risk List failed.

Status Code: 403.

Message: 'MaxRetryError' object has no attribute 'get.

Download IP Risk List

Downloads the specified IP risk list.

Input

Input Parameter	Required/Optional	Description	Example
List Name	Required	The name of the IP risk list to download.	Recent Threat Researcher

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Download IP Risk List failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: 'MaxRetryError' object has no attribute 'get.

Error Sample Data

Download IP Risk List failed.

Status Code: 403.

Message: 'MaxRetryError' object has no attribute 'get.

Download URL Risk List

Downloads the specified URL risk list.

Input

Input Parameter	Required/Optional	Description	Example
List Name	Required	The name of the URL risk list to download.	Recently Reported Spam or Unwanted Content

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Download URL Risk List failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: 'MaxRetryError' object has no attribute 'get.

Error Sample Data

Download URL Risk List failed.

Status Code: 403.

Message: 'MaxRetryError' object has no attribute 'get.

Download Vulnerability Risk List

Downloads the specified vulnerability risk list.

Input

Input Parameter	Required/Optional	Description	Example
List Name	Required	The name of the vulnerability risk list to download.	Exploited in the Wild by Recently Active Malware

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Download Vulnerability Risk List failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: 'MaxRetryError' object has no attribute 'get.

Error Sample Data

Download Vulnerability Risk List failed.

Status Code: 403.

Message: 'MaxRetryError' object has no attribute 'get.

Fetch Event

Returns events (alerts or playbook alerts) from Recorded Future based on the specified search criteria.

READER NOTE

If no optional input parameter is specified, 10 alert-related events between the Start Time and End Time will be returned, sorted by triggered time (triggered time can be found in the returned raw data under the key "triggered”) in ascending order.

Input

Input Parameter	Required/Optional	Description	Example
Start Time	Required	The start of the time range (in UTC) during which to fetch alerts or playbook alerts. For the Alert event type, the Start Time indicates the alerts that were triggered after this time. For the Playbook Alert event type, the Start Time indicates the playbook alerts that were updated after this time.	2022-10-01 00:00
End Time	Required	The end of the time range (in UTC) during which to fetch alerts or playbook alerts. For the Alert event type, the End Time indicates the alerts that were triggered before this time. For the Playbook Alert event type, the End Time indicates the playbook alerts that were updated before this time.	2022-10-20 00:00
Number of Event(s) Fetched	Optional	The number of the most recent events to return. By default, the value is set to 10. Acceptable values are between 0 to 1000. Setting this parameter to 0 will ingest all events matching the filter parameters. If setting this parameter to 0, configure the Search Condition parameter carefully to manage the data volume.	100
Search Condition	Optional	The JSON query used to filter the returned results. ALERT EVENT TYPE Valid conditions assignee (email string) status (string: unassigned, assigned, actionable, no-action, tuning) alertRule (string: alertRule ID) freetext (string) from (integer: records from offset) direction (string: asc, desc) Invalid conditions triggered limit Refer to Alert Notification With Search Details \| Recorded Future for more details on available input conditions PLAYBOOK ALERT EVENT TYPE Valid conditions assignee (text array: Assignee ID) statuses (text array: New, InProgress, Dismissed, Resolved) priority (text array: High, Moderate, Informational) entities (text array) from (integer: records from offset) direction (string: asc, desc) category (text array: domain_abuse, cyber_vulnerability, code_repo_leakage) Invalid conditions updated_range limit Refer to Playbook Alerts API \| Recorded Future for details on available filter parameters	For Alert event type: JSON `{ "assignee": "***@*.*", "status": "pending" }` For Playbook Alert event type: JSON `{ "statuses": [ "New" ], "priority": [ "High" ], "category": [ "cyber_vulnerability" ], "assignee": [ "uhash:***" ] }`
Event Type	Optional	The event type to fetch. Available options are: Alert Playbook Alert By default, the value is Alert.	Playbook Alert

Output

To view the sample output data for all commands, refer to this article.

READER NOTE

The Unique Event Key field mapping is used to prevent duplicate event ingestions. D3 SOAR will check if the value of a selected JSON path matches any Unique Event Key of previously ingested events. If a match is found, the event will be dismissed. If no match is found, an event will be created. However, if no Unique Event Key is mapped, then the hash value from the event pending ingestion will be used to check for any matches with existing events. If no match is found, the event will be created.

Unlike most other D3 SOAR integrations, the Default Event Source mapping of the Recorded Future integration's Fetch Event command does not require a Unique Event Key to fetch alerts.

Fetch Event Field Mapping

Fetch Event commands require event field mapping. Field mapping plays a key role for data normalization within the event pipeline. Field mapping converts the original data fields from the different providers to standardized D3 fields as defined by the D3 Model. Refer to Event and Incident Intake Field Mapping for details.

To add a custom field, click on the + Add Field button. Users can also remove built-in field mappings by clicking x. Note that two underscore characters will automatically prefix the defined Field Name as the System Name for a custom field mapping. Additionally, if an input Field Name contains any spaces, they will automatically be replaced with underscores for the corresponding System Name.

The Recorded Future integration in D3 SOAR has some pre-configured field mappings for the Alert and Playbook Alert, which correspond to the Default Event Source and Event Source for Playbook Alert mappings:

Default Event Source
The Default Event Source is the default set of field mappings that are applied when this fetch event command is executed. For out-of-the-box integrations, users will find a set of field mappings provided by the system. Default event source provides field mappings for common fields from the fetched data. The default event source has a "Main Event JSON Path" (i.e. $.data.results) that is used to extract a batch of events from the response raw data. View the "Main Event JSON Path" by clicking on the Edit Event Source button.
- Main Event JSON Path: $.data.results
  The Main Event JSON Path determines the root path where the system starts parsing raw response data into D3 event data. The JSON path begins with $, representing the root element. The path is formed by appending a sequence of child elements to $, each separated by a dot (.). Square brackets with nested quotation marks ([‘...’]) should be used to separate child elements in JSON arrays.
  For example, the root node of a JSON Path is data.results. The child node denoting the Assignee field would be review.assignee. Putting it together, the JSON Path expression to extract the Assignee is $.data.results.review.assignee.
Event Source for Playbook Alert
Configures the field mapping which are specific to the Playbook Alert-related events. If a source field in the field mapping is not found, the corresponding field mapping will be ignored. As the data of the Playbook Alert-related events have a character that the value of the eventType field is playbook_alert, the Playbook Alert-related events can be defined by the Search String: {eventType}=playbook_alert. Click Edit Event Source to view the Search String.

The pre-configured field mappings are detailed below:

Field Name	Source Field
Default Event Source (Main Event JSON Path: $.data.results)
Event code	.id
Start Time	.triggered
Alert Name	.title
Alert type	.type
Event Type	.type
URL	.entities.[].documents[].url
Assignee	.review.assignee
Rule name	.rule.name
Rule ID	.rule.id
Status	.review.status
Source	.entities[].documents[].source.name
Source Title	.entities[].documents[].title
Reference Fragment	.entities[].documents[].reference[*].fragment
Source Product	.entities.[].documents[].references[*].entities[?(@.type=='Product')].name
Product	.entities.[].documents[].references[*].entities[?(@.type=='Product')].name
Company	.entities.[].documents[].references[*].entities[?(@.type=='Company')].name
Organization Entity	.entities.[].documents[].references[*].entities[?(@.type=='OrgEntity')].name
Person	.entities.[].documents[].references[*].entities[?(@.type=='Person')].name
URL Entity	.entities.[].documents[].references[*].entities[?(@.type=='URL')].name
Industry Term Entity	.entities.[].documents[].references[*].entities[?(@.type=='IndustryTerm')].name
City Entity	.entities.[].documents[].references[*].entities[?(@.type=='City')].name
IP Entity	.entities.[].documents[].references[*].entities[?(@.type=='IpAddress')].name
Internet Domain Entity	.entities.[].documents[].references[*].entities[?(@.type=='InternetDomainName')].name
Event Source for Playbook Alert (Search String:{eventType}=playbook_alert) The search string format is {jsonpath}=value. If the value of the eventType key is playbook_alert in the event object under raw data, then the Event Source for Playbook Alert-related events will use the field mapping below.
Document ID	.playbook_alert_id
Start Time	.created
Alert type	.category
Alert Name	.title
Status	.status
Priority	.priority
Assignee Name	.assignee_name
Assignee ID	.assignee_id
Owner Name	.owner_name
Owner ID	.owner_id
Organization Name	.organisation_name
Organization ID	.organisation_id
Enterprise Name	.owner_organisation_details.enterprise_name
Enterprise ID	.owner_organisation_details.enterprise_id

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Fetch Event failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: The value for parameter (Search Condition) is invalid.

Error Sample Data

Fetch Event failed.

Status Code: 400.

Message: The value for parameter (Search Condition) is invalid.

Get Analyst Notes

Returns a list of analyst notes for the specified Note IDs.

READER NOTE

Note IDs is a required parameter to run this command.

Run the Search Analyst Notes command to obtain the Note IDs. Note IDs can be found in the raw data at the path $.data.results[*].id.

Input

Input Parameter	Required/Optional	Description	Example
Note IDs	Required	The list of analyst note IDs for which to return the corresponding analyst notes. Note IDs can be obtained using the Search Analyst Notes command.	JSON `[ "***", "***" ]`

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Analyst Notes failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Note with ID ‘*****' Not Found.

Error Sample Data

Get Analyst Notes failed.

Status Code: 404.

Message: Message: Note with ID ‘*****' Not Found.

List Alerts V3

Returns a list of triggered alerts based on the specified criteria. This command is based on the V3 API endpoint.

READER NOTE

If no input parameters are defined, a maximum of 20 alerts will be listed.
If the input conditions do not exist, then the command will run successfully but with no results. Check the input parameter values.

Alert Rule is an optional parameter to run this command.

Run the Search Alert Rules command to obtain the Alert Rule. Alert Rules can be found in the raw data at the path $.data.results[*].id.

Input

Input Parameter	Required/Optional	Description	Example
Status In Portal	Optional	Filters returned alerts by status. Available options are: New Resolved Pending Dismissed Flag for Tuning	Pending
Alert Rule	Optional	Filters returned alerts by the alert rule ID. Alert rule IDs can be obtained using the Search Alert Rules command.	*****
Assignee	Optional	Filters returned alerts by the assignee's email address. Input "NONE" to retrieve alerts without an assignee.	***@*.***
Triggered Start Time	Optional	The start of the time range during which to list alerts. Alerts triggered after this time will be returned.	2022-10-01 00:00
Triggered End Time	Required	The end of the time range during which to list alerts. Alerts triggered before this time will be returned.	2022-10-20 00:00
Free Text	Optional	Performs a free text search.	Possible Fake Apps Detection
Limit	Optional	The maximum number of records to return. The maximum allowed value is 1000. By default, the value is 20.	3

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Alerts V3 failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: 'MaxRetryError' object has no attribute 'get.

Error Sample Data

List Alerts V3 failed.

Status Code: 403.

Message: 'MaxRetryError' object has no attribute 'get.

List Entities

Returns a list of entities based on the specified criteria. This information can be useful when creating an analyst note.

Input

Input Parameter	Required/Optional	Description	Example
Category	Required	The category of the entities to list. Available options are: IP Address Domain URL Malware Vulnerability By default, the value is IP Address.	Vulnerability
Include Metadata	Optional	Whether to include metadata in the response data. By default, the value is True.	True
Limit	Optional	The number of records to return. By default, the value is 10.	1

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Entities failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Insufficient privileges to complete the operation.

Error Sample Data

List Entities failed.

Status Code: 403.

Message: Insufficient privileges to complete the operation.

List Entity Risk Rules

Returns the risk rules of the specified entity type.

Input

Input Parameter

Required/Optional

Description

Example

Entity Type

Required

The entity type of the risk list to return. Available options are:

Domain
File Hash
IP
URL
Vulnerability

File Hash

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Entity Risk Rules failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: 'MaxRetryError' object has no attribute 'get.

Error Sample Data

List Entity Risk Rules failed.

Status Code: 403.

Message: 'MaxRetryError' object has no attribute 'get.

Lookup Credentials

Checks the credential data based on the specified criteria.

Input

Input Parameter	Required/Optional	Description	Example
Login Identities	Required	The account login identities to check. If the Domain is not specified, then the input for Login Identities must be email addresses.	JSON `[ "***", "*@*.***" ]`
Domain	Optional	The account domain within which the specified Login Identities are logged. If the Domain is not specified, then the input for Login Identities must be email addresses.	***.***

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Lookup Credentials failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid value in ‘subjects_login[0].domain’.

Error Sample Data

Lookup Credentials failed.

Status Code: 400.

Message: Invalid value in ‘subjects_login[0].domain’.

Lookup Domains

Checks the reputation of domains.

READER NOTE

Refer to this section for the difference between Check Reputation commands and Lookup commands.

Input

Input Parameter	Required/Optional	Description	Example
Domain Names	Required	The domain names for which to check the corresponding reputation information.	JSON `[ "***.***" ]`

Output

To view the sample output data for all commands, refer to this article.

3-defined Risk Scores and Risk Levels

Recorded Future will return risk scores ranging from 0 to 99, which will correspond to the risk levels below:

Risk Scores	Risk Levels
65 <= Risk Scores <=99	Risk Level = 1
25 <= Risk Scores <=64	Risk Level = 2
5 <= Risk Scores <=24	Risk Level = 3
0 <= Risk Scores <=4	Risk Level = 5

To use the D3-defined Risk Levels, refer to the table below for the corresponding pairs:

Risk Levels	Risk Level Names
1	High
2	Medium
3	Low
4	N/A
5	ZeroRisk

Error Handling

An error tab will appear if the command run fails. The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Lookup Domains failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Not Found.

Error Sample Data

Lookup Domains failed.

Status Code: 404.

Message: Not Found.

Lookup Hashes

Checks the reputation of file hashes.

READER NOTE

Refer to this section for the difference between Check Reputation commands and Lookup commands.

Input

Input Parameter	Required/Optional	Description	Example
File Hashes	Required	The file hash values (MD5, SHA-1, or SHA-256) for which to check the corresponding reputation information.	JSON `[ "*****" ]`

Output

To view the sample output data for all commands, refer to this article.

D3-defined Risk Scores and Risk Levels

Recorded Future will return risk scores ranging from 0 to 99, which will correspond to the risk levels below:

Risk Scores	Risk Levels
65 <= Risk Scores <=99	Risk Level = 1
25 <= Risk Scores <=64	Risk Level = 2
5 <= Risk Scores <=24	Risk Level = 3
0 <= Risk Scores <=4	Risk Level = 5

To use the D3-defined Risk Levels, refer to the table below for the corresponding pairs:

Risk Levels	Risk Level Names
1	High
2	Medium
3	Low
4	N/A
5	ZeroRisk

Error Handling

An error tab will appear if the command run fails. The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Lookup Hashes failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Not Found.

Error Sample Data

Lookup Hashes failed.

Status Code: 404.

Message: Not Found.

Lookup IP Addresses

Checks the reputation of IP addresses.

READER NOTE

Refer to this section for the difference between Check Reputation commands and Lookup commands.

Input

Input Parameter	Required/Optional	Description	Example
IP Addresses	Required	The IP addresses (IPv4 or IPv6) for which to check the corresponding reputation information. CIDR IP addresses are not supported.	JSON `[ "*...*" ]`

Output

To view the sample output data for all commands, refer to this article.

D3-defined Risk Scores and Risk Levels

Recorded Future will return risk scores ranging from 0 to 99, which will correspond to the risk levels below:

To use the D3-defined Risk Levels, refer to the table below for the corresponding pairs:

Risk Levels	Risk Level Names
1	High
2	Medium
3	Low
4	N/A
5	ZeroRisk

Error Handling

An error tab will appear if the command run fails. The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Lookup IP Addresses failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Not Found.

Error Sample Data

Lookup IP Addresses failed.

Status Code: 404.

Message: Not Found.

Lookup Passwords

Checks the exposure status of passwords.

READER NOTE

Password Hashes and Hash Algorithm are required parameters to run this command.

Run the Lookup Credentials command to obtain the Password Hashes. Password Hashes can be found in the raw data at the path $.identities[*].credentials[*].exposed_secret.hashes[*].hash.
Run the Lookup Credentials command to obtain the Hash Algorithm. Hash Algorithms can be found in the raw data at the path $.identities[*].credentials[*].exposed_secret.hashes[*].algorithm.
Password Hashes and Hash Algorithm must match to return the desired result. Otherwise, the API will not return the correct exposure status. Unmatched pairs of password hashes and hash algorithms will return the "NeverExposed” status.
Matching password hashes and hash algorithms are listed in the same JSON object in the response data. The hash algorithm has the "algorithm" key, and the password hashes have the "hash" key.

Input

Input Parameter	Required/Optional	Description	Example
Password Hashes	Required	The password hash values for which to check the corresponding exposure statuses. Password hashes can be obtained using the Lookup Credentials command. All input password hashes must be created with the same hash algorithm.	JSON `[ "***", "***" ]`
Hash Algorithm	Required	The hash algorithm used to create the input password hashes. Hash algorithms can be obtained using the Lookup Credentials command.	SHA1

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Lookup Passwords failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Unsupported algorithm: HASHCAT_HEX.

Error Sample Data

Lookup Passwords failed.

Status Code: 400.

Message: Unsupported algorithm: HASHCAT_HEX.

Lookup URLs

Checks the reputation of URLs.

READER NOTE

Refer to this section for the difference between Check Reputation commands and Lookup commands.

Input

Input Parameter	Required/Optional	Description	Example
URLs	Required	The list of URLs for which to check the corresponding reputation information.	JSON `[ "https://***.***" ]`

Output

To view the sample output data for all commands, refer to this article.

D3-defined Risk Scores and Risk Levels

Recorded Future will return risk scores ranging from 0 to 99, which will correspond to the risk levels below:

Risk Scores	Risk Levels
65 <= Risk Scores <=99	Risk Level = 1
25 <= Risk Scores <=64	Risk Level = 2
5 <= Risk Scores <=24	Risk Level = 3
0 <= Risk Scores <=4	Risk Level = 5

To use the D3-defined Risk Levels, refer to the table below for the corresponding pairs:

Risk Levels	Risk Level Names
1	High
2	Medium
3	Low
4	N/A
5	ZeroRisk

Error Handling

An error tab will appear if the command run fails. The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Lookup URLs failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Not Found.

Error Sample Data

Lookup URLs failed.

Status Code: 404.

Message: Not Found.

Lookup Vulnerabilities

Checks the reputation of Common Vulnerabilities and Exposures (CVEs).

READER NOTE

Refer to this section for the difference between Check Reputation commands and Lookup commands.

Input

Input Parameter	Required/Optional	Description	Example
CVE Names	Required	The list of CVE IDs for which to check the corresponding reputation information.	JSON `[ "CVE-2019-8900" ]`

Output

To view the sample output data for all commands, refer to this article.

D3-defined Risk Scores and Risk Levels

Recorded Future will return risk scores ranging from 0 to 99, which will correspond to the risk levels below:

Risk Scores	Risk Levels
65 <= Risk Scores <=99	Risk Level = 1
25 <= Risk Scores <=64	Risk Level = 2
5 <= Risk Scores <=24	Risk Level = 3
0 <= Risk Scores <=4	Risk Level = 5

To use the D3-defined Risk Levels, refer to the table below for the corresponding pairs:

Risk Levels	Risk Level Names
1	High
2	Medium
3	Low
4	N/A
5	ZeroRisk

Error Handling

An error tab will appear if the command run fails. The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Lookup Vulnerabilities failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Not Found.

Error Sample Data

Lookup Vulnerabilities failed.

Status Code: 404.

Message: Not Found.

Preview Analyst Note

Previews an analyst note.

Input

Input Parameter	Required/Optional	Description	Example
Title	Required	The title of the analyst note.	test20210924
Text	Required	The body of the analyst note.	test20210924+news+123

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Preview Analyst Note failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: 'MaxRetryError' object has no attribute 'get.

Error Sample Data

Preview Analyst Note failed.

Status Code: 403.

Message: 'MaxRetryError' object has no attribute 'get.

Publish Analyst Note

Publishes an analyst note in Recorded Future.

READER NOTE

Note Entity IDs and Context Entity IDs are required parameters to run this command.

Run the List Entities command to obtain the Note Entity IDs. Note Entity IDs can be found in the raw data at the path $.data.results[*].entity.id.
Run the Search Analyst Notes command to obtain the Context Entity IDs. Context Entity IDs can be found in the raw data at the path $.data.results[*].attributes.context_entities[*].id.

Note ID is an optional parameter to run this command.

Run the Search Analyst Notes command to obtain the Note ID. Note IDs can be found in the raw data at the path $.data.results[*].id.

Input

Input Parameter	Required/Optional	Description	Example
Title	Required	The title of the analyst note.	Test Title 0924
Text	Required	The body of the analyst note.	On September 20, 2021, GitHub user "*****" published a proof-of-concept (PoC) for CVE-2021-30632, an out-of-bounds write vulnerability found in the V8 JavaScript Engine of Chromium-based browsers (Chrome, Edge, Opera).
Note Entity IDs	Required	The primary entity ID with which to associate the analyst note. Note Entity IDs can be obtained using the List Entities command.	JSON `["ip:*...*"]`
Context Entity IDs	Required	The context entity IDs with which to associate the note. Context Entity IDs can be obtained using the Search Analyst Notes command.	JSON `["*****"]`
Note ID	Optional	The analyst note ID for which to overwrite the corresponding analyst note. If a valid note ID is provided, then the content of the original note will be overwritten with the new input content. Note IDs can be obtained using the Search Analyst Notes command.	*****

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Publish Analyst Note failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Referred entities: ip:xxx does not exist.

Error Sample Data

Publish Analyst Note failed.

Status Code: 400.

Message: Referred entities: ip:xxx does not exist.

Search Alert Rules

Searches and returns alert rules.

READER NOTE

Free Text Search is used to search alert titles. Other fields cannot be searched. If the input search value does not exist, the command will run successfully but with no results. Alert titles can be obtained by running the Search Alert Rules command with no input parameters defined. Alert titles will be listed in the command's returned raw data at the path $.data.results.[*].title.

Input

Input Parameter	Required/Optional	Description	Example
Free Text Search	Optional	The search field used to filter results. The field can be whole or partial alert rule titles.	Leaked Credential

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Search Alert Rules failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: 'MaxRetryError' object has no attribute 'get.

Error Sample Data

Search Alert Rules failed.

Status Code: 403.

Message: 'MaxRetryError' object has no attribute 'get.

Search Analyst Notes

Searches and returns analyst notes based on the specified criteria.

READER NOTE

Topic ID is an optional parameter to run this command.

Run this command without filling in the Topic ID parameter to obtain the Topic ID. Topic IDs can be found in the raw data at the path $.data.results[*].attributes.topic[*].id.

Input

Input Parameter	Required/Optional	Description	Example
Title	Optional	The title of the analyst note to search.	092412
Topic ID	Optional	The topic ID of the analyst note to search. Topic ID can be obtained by running the command without filling in this input parameter.	*****
Published Date	Optional	Analyst notes published after this date will be searched. By default, the value is the day before the current date.	2022-10-20 00:00
Limit	Optional	The maximum number of records to return. By default, the value is 10.	10

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Search Analyst Notes failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: 'MaxRetryError' object has no attribute 'get.

Error Sample Data

Search Analyst Notes failed.

Status Code: 403.

Message: 'MaxRetryError' object has no attribute 'get.

Search Credentials

Retrieves exposed credentials for the specified set of domains.

Input

Input Parameter	Required/Optional	Description	Example
Domains	Required	The domains used to search for exposed credentials.	JSON `[ "***.***" ]`
Domain Type	Optional	The domain type used to search for exposed credentials. Available options are: Authorization Email By default, all exposed credentials will be retrieved regardless of the domain type.	Authorization
Latest Downloaded Time	Optional	Exposed credentials downloaded after this time (in UTC) will be retrieved.	2022-09-21 00:00

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Search Credentials failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: User 'uhash:xxxx' access to domain 'google.com' is rejected.

Error Sample Data

Search Credentials failed.

Status Code: 403.

Message: User 'uhash:xxxx' access to domain 'google.com' is rejected.

Search Dumps

Searches and returns dump metadata.

READER NOTE

Dump Names is an optional parameter to run this command.

Run the Search Dumps command with no input parameters defined to obtain Dump Names.
If the Dump Names parameter is not defined, all dump metadata will be returned.
If the input dump name does not exist, the command will run successfully but with no results.

Input

Input Parameter	Required/Optional	Description	Example
Dump Names	Optional	The dump names for which to search and return dump metadata. Enter the full name of a dump or a keyword from the dump name or description. By default, all dump metadata will be returned.	JSON `[ "tianya.cn Cracked 2011", "Elvinelol" ]`

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Search Dumps failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: 'MaxRetryError' object has no attribute 'get.

Error Sample Data

Search Dumps failed.

Status Code: 403.

Message: 'MaxRetryError' object has no attribute 'get.

Update Alerts

Updates the assignees, statuses and/or notes of the specified alerts.

READER NOTE

Alert IDs is a required parameter to run this command.

Run the List Alerts V3 command to obtain the Alert IDs. Alert IDs can be found in the raw data at the path $.data[*].id.

Input

Input Parameter	Required/Optional	Description	Example
Alert IDs	Required	The alert IDs for which to update. Alert IDs can be obtained using the List Alerts V3 command.	JSON `["*****"]`
Status	Optional	The updated status. Available options are: None Unassigned Assigned Pending Dismiss No Action Actionable Tuning Update either the Status or Status in Portal parameter, not both. If both are specified, Status will override Status in Portal.	Pending
Assignee	Optional	The new assignee. Assignees can be specified by their ID, username, userhash, or email.	demoAssignee
Note	Optional	The updated note. The maximum length is 1,000 characters.	Demo note for the alert.
Status In Portal	Optional	The updated UI (portal) status. Available options are: New Resolved Pending Dismissed Flag for Tuning Update either the Status or Status in Portal parameter, not both. If both are specified, Status will override Status in Portal.	Resolved

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Update Alerts failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Not Found.

Error Sample Data

Update Alerts failed.

Status Code: 404.

Message: Not Found.

Test Connection

Perform a health check on an Integration connection. Schedule a periodic health check by selecting Connection Health Check when editing an Integration connection.

Input

N/A

Output

Output Type

Description

Return Data Type

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

More details about an error can be viewed in the Error tab.

String

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Test Connection failed. Failed to check the connector.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Recorded Future portal. Refer to the HTTP Status Code Registry for details.	Status Code: 401.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Unauthorized.

Error Sample Data

Test Connection failed. Failed to check the connector.

Status Code: 401.

Message: Unauthorized.