v1

latestOpenAPI 3.1.12026-07-242899061.7 MB
Hash

Search for Hash entities based on a filter

Find file hashes by risk score, risk rules, algorithm type, or dates with paginated enrichment results.

get/hash/search

Query parameters

fieldsstring

The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string.

See https://docs.recordedfuture.com/reference/enrichment-field-attributes for a list of values.

{"stackTrail":"components:parameters:MetadataParameter:schema","oasType":"schema","type":"unknown"}

Annotates the response with additional metadata explaining the response data elements.

limitinteger

Maximum number of records returned,

frominteger

Offsets the pagination of the request. Note that there is a limit of returning only the top 10000 results from a search, meaning if limit plus from exceeds 10000, this will result in an Bad Request message.

riskScorestring

Filters entities based on risk score, e.g. on the form [20, 80] (20 <= risk score <= 80), [20,) (20 <= risk score), or [,90) (risk score < 90). '[' and ']' are inclusive while '(' and ')' are exclusive.

algorithm'CRC-32' | 'CTPH' | 'MD5' | 'SHA-1' | 'SHA-256' | 'SHA-512'

Filters hash entities based on hash algorithm

firstSeenstring

Filters entities based on the download of the first reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.

lastSeenstring

Filters entities based on the download of the latest reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.

liststring

Filters entities based on presence in a single list. Requires the list ID, which can be found using the List API

riskRule'positiveMalwareVerdict' | 'malwareTestingDetonation' | 'recentActiveMalware' | 'observedMalwareTesting' | 'malwareSsl' | 'analystNote' | 'dhsAis' | 'relatedNote' | 'linkedToMalware' | 'suspiciousBehaviorDetected' | 'linkedToVector' | 'linkedToVuln' | 'linkedToCyberAttack' | 'threatResearcher' | 'historicalThreatListMembership' | 'rfTrending' | 'observedTelemetry' | 'noKnownRisk'

Filters for Hashes based on a single risk rule.

orderBy'created' | 'modified' | 'sixtydayshits' | 'sevendayhits' | 'criticality' | 'riskscore' | 'totalhits' | 'firstseen' | 'lastseen' | 'rules'

Sorts the search according to the chosen parameter. Results are sorted before pagination.

direction'asc' | 'desc'

The direction of the sorting by the orderBy parameter, ascending or descending.

commentstring

Response

Result of operation