Sign in

v1

latestOpenAPI 3.1.12026-07-242899061.7 MB
Vulnerability

Search for Vulnerability entities based on a filter

Find vulnerabilities by CVSS score, risk score, exploitation status, or affected product for patch prioritization.

get/vulnerability/search

Query parameters

freetextstring

Freetext

fieldsstring

The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string.

See https://docs.recordedfuture.com/reference/enrichment-field-attributes for a list of values.

{"stackTrail":"components:parameters:MetadataParameter:schema","oasType":"schema","type":"unknown"}

Annotates the response with additional metadata explaining the response data elements.

limitinteger

Maximum number of records returned,

frominteger

Offsets the pagination of the request. Note that there is a limit of returning only the top 10000 results from a search, meaning if limit plus from exceeds 10000, this will result in an Bad Request message.

riskScorestring

Filters entities based on risk score, e.g. on the form [20, 80] (20 <= risk score <= 80), [20,) (20 <= risk score), or [,90) (risk score < 90). '[' and ']' are inclusive while '(' and ')' are exclusive.

cvssScorestring

Filters for vulnerabilities based on CVSS score (from most trusted source), e.g. on the form [8.0, 9.0] (8.0 <= CVSS score <= 9.0)

cvssV3Scorestring

Filters for vulnerabilities based on CVSS v3 score, e.g. on the form [8.0, 9.0] (8.0 <= CVSS v3 score <= 9.0)

productstring

RF ID of affected product

firstSeenstring

Filters entities based on the download of the first reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.

lastSeenstring

Filters entities based on the download of the latest reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.

liststring

Filters entities based on presence in a single list. Requires the list ID, which can be found using the List API

riskRule'recentMalwareActivity' | 'vendorCritical' | 'nistCritical' | 'malwareActivity' | 'recentPocVerifiedRemote' | 'historicMalwareActivity' | 'recentAnalystNote' | 'recentRansomwareExploit' | 'vendorHigh' | 'nistHigh' | 'recentPocVerified' | 'vendorMedium' | 'nistMedium' | 'recentLikelyExploitDevelopment' | 'recentScannerUptake' | 'linkedToRecentExploitKit' | 'linkedToRecentRAT' | 'linkedToRecentRansomware' | 'linkedToRecentIntrusionMethod' | 'noCvssScore' | 'pocVerifiedRemote' | 'recentPocUnverified' | 'recentRelatedNote' | 'pocVerified' | 'vendorLow' | 'nistLow' | 'likelyExploitDevelopment' | 'linkedToRecentCyberExploit' | 'linkedToCyberExploit' | 'scannerUptake' | 'linkedToExploitKit' | 'linkedToRAT' | 'linkedToRansomware' | 'linkedToIntrusionMethod' | 'analystNote' | 'relatedNote' | 'awaitingCvssScore' | 'pocUnverified' | 'ransomwareExploit' | 'cyberSignalCritical' | 'cyberSignalHigh' | 'cyberSignalMedium'

Filters for Vulnerabilities based on a single risk rule.

orderBy'created' | 'modified' | 'sixtydayshits' | 'sevendayhits' | 'criticality' | 'riskscore' | 'totalhits' | 'firstseen' | 'lastseen' | 'rules'

Sorts the search according to the chosen parameter. Results are sorted before pagination.

direction'asc' | 'desc'

The direction of the sorting by the orderBy parameter, ascending or descending.

commentstring
cpestring

Filters for vulnerabilities based on affected products using the CPE identifier system. This field, if used, will be validated as follows:

cpe:2.3:a:wordpress:wordpress:4.5: - Valid. Will find all products with CPEs that start with this string, like WordPress 4.5, but also 4.5 beta3 and 4.5 rc1.

cpe:2.3:a:wordpress:wordpress:4 - Valid. Note the lack of trailing colon. Will find products with versions starting with 4. Like 4.2, 4.2.3, 4.5.

cpe:2.3:a:wordpress:wordpress: - Valid. Will find all known identifiers for WordPress, regardless of version.

cpe:2.3:a:wordpress: - Invalid. Too broad, the "product" part must be defined.

Response

Result of operation