---
title: "Lookup a Malware entity by id"
method: GET
path: "/malware/{id}"
tags: ["Malware"]
---

# Lookup a Malware entity by id

`GET /malware/{id}`

Get full malware enrichment including classification, MITRE ATT&CK mappings, and threat actor associations.

## Path parameters

- `id` string, required

## Query parameters

- `fields` string
- `metadata` unknown
- `taggedText` boolean
- `comment` string

## Response `200`

Result of operation

- MalwareLookupResponse — Malware enrichment response. Note: Malware entities do NOT have risk scores — use the categories field for classification. The response includes only the fields specified in the `fields` query parameter.
  - `data` object, required — Malware entity data with requested enrichment fields. Unlike other entity types, malware entities do not have risk scores.
    - `entity` Entity
      - `id` string, required — Entity id
      - `provided_id` string, required — Entity id provided in request
      - `type` string, required — Entity type
      - `name` string, required — Entity name
    - `categories` object[] — Malware classification labels. Each category is an entity with id, name, and type. This is the primary classification mechanism for malware — there is no risk score.
      - `id` string — Category entity ID.
      - `name` string — Category name (e.g., 'Remote Access Trojan', 'Ransomware', 'Backdoor').
      - `type` string — Entity type.
    - `aiInsights` AiInsights — AI-generated threat analysis. Included when the fields parameter contains 'aiInsights'. Text is null when fewer than 3 risk rules are triggered.
      - `text` string, nullable — AI-generated threat analysis paragraph. Null when fewer than 3 risk rules are triggered.
      - `numberOfReferences` integer — Number of intelligence references used to generate the insight.
      - `comment` string, nullable — Explanatory comment (e.g., why insights are not available).
    - `links` LinksData — Validated intelligence relationships to threat actors, malware, MITRE ATT&CK techniques, and other entities. Included when the fields parameter contains 'links'. Unlike relatedEntities, these are editorially validated relationships.
      - `hits` object[] — Intelligence hits containing sectioned relationship data.
        - `start_date` string — Start date of the intelligence hit time window.
        - `stop_date` string — End date of the intelligence hit time window.
        - `total_count` integer — Total number of entity relationships in this hit.
        - `sample_reference_ids` string[] — Sample reference IDs supporting this hit.
        - `counts` object[] — Breakdown counts by entity type.
          - `count` integer — Number of entities.
          - `type` object — Entity type metadata.
            - `id` string
            - `name` string
            - `type` string
        - `event_count` integer — Number of events in this hit.
        - `sections` object[] — Relationship sections grouped by category.
          - `section_id` object — Section identifier.
            - `id` string — Section ID.
            - `name` string — Section category name (e.g., 'Actors, Tools & TTPs', 'Victims & Exploit Targets', 'Indicators & Detection Rules').
            - `type` string — Section type (e.g., 'Category').
          - `total_count` integer — Total entities in this section.
          - `lists` object[] — Entity lists within this section, grouped by entity type.
            - `entities` LinksEntity[]
              - …
            - `total_count` integer — Total entities in this list.
            - `type` object — Entity type metadata for this list.
              - …
      - `method_aggregates` object[] — Aggregated counts of linked entities by analysis method.
        - `count` integer — Number of links found by this method.
        - `type` string — Analysis method type.
      - `counts` object[] — Summary counts of linked entities by type.
        - `count` integer — Number of linked entities of this type.
        - `type` object — Entity type metadata.
          - `id` string
          - `name` string
          - `type` string
          - `description` string
    - `intelCard` string, uri — URL to the Recorded Future Intelligence Card for this malware.
    - `timestamps` Timestamps — First and last seen timestamps for the entity in Recorded Future data.
      - `firstSeen` string, date-time — ISO 8601 timestamp of first observation.
      - `lastSeen` string, date-time — ISO 8601 timestamp of most recent observation.
    - `sightings` Sighting[] — Intelligence sightings from various source types. Each item's `type` field indicates the category (recentDarkWeb, recentPaste, recentInfoSec, recentSocialMedia, mostRecent, first). Included when the fields parameter contains 'sightings'.
      - `source` string — Source name (e.g., 'GitHub', 'PasteBin', 'Turk Hack Team Forum').
      - `url` string, uri — URL to the original source.
      - `published` string, date-time — ISO 8601 timestamp of when the sighting was published.
      - `fragment` string — Text fragment from the source mentioning the entity.
      - `title` string — Title of the source document.
      - `type` 'recentDarkWeb' | 'recentPaste' | 'recentInfoSec' | 'recentSocialMedia' | 'mostRecent' | 'first' — Sighting category.
    - `analystNotes` object[] — Insikt Group analyst notes. Can be very large.
    - `relatedEntities` object[] — Co-occurrence relationships (not editorially validated).
    - `counts` object[] — Daily reference count time-series. Can contain 2,000+ entries.
  - `metadata` object — Request metadata. Included when the metadata query parameter is set to true.

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)