--- title: "Lookup a Vulnerability entity by id" method: GET path: "/vulnerability/{id}" tags: ["Vulnerability"] --- # Lookup a Vulnerability entity by id `GET /vulnerability/{id}` Get full CVE enrichment including severity, exploitation status, and threat actor and malware linkages. ## Path parameters - `id` string, required ## Query parameters - `fields` string - `metadata` unknown - `taggedText` boolean - `comment` string ## Response `200` Result of operation - VulnerabilityLookupResponse — Vulnerability (CVE) enrichment response. The response includes only the fields specified in the `fields` query parameter. All properties under `data` are optional because they appear only when requested. - `data` object, required — Vulnerability entity data with requested enrichment fields. - `entity` Entity - `id` string, required — Entity id - `provided_id` string, required — Entity id provided in request - `type` string, required — Entity type - `name` string, required — Entity name - `risk` RiskData — Risk assessment data with score, triggered rules, and supporting evidence. Included when the fields parameter contains 'risk'. Not available for Malware entities. - `score` integer — Numeric risk score from 0 (no risk) to 99 (critical risk). - `criticality` integer — Numeric criticality level (0=None, 1=Informational, 2=Unusual, 3=Suspicious, 4=Malicious). - `criticalityLabel` 'None' | 'Informational' | 'Unusual' | 'Suspicious' | 'Moderate' | 'Malicious' | 'High' | 'Very Malicious' | 'Very High' — Risk criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High. - `riskString` string — Triggered vs total risk rules (e.g., '16/81'). - `rules` integer — Number of currently triggered risk rules. - `riskSummary` string — Human-readable risk summary (e.g., '16 of 81 Risk Rules currently observed.'). - `evidenceDetails` EvidenceDetail[] — Evidence for each triggered risk rule. - `rule` string — Risk rule name that was triggered. - `criticality` integer — Numeric criticality level of the rule (1=Informational, 2=Unusual, 3=Suspicious, 4=Malicious). - `criticalityLabel` 'Informational' | 'Unusual' | 'Suspicious' | 'Moderate' | 'Malicious' | 'High' | 'Very Malicious' | 'Very High' — Human-readable criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High. - `evidenceString` string — Human-readable evidence summary with source references and sighting details. - `mitigationString` string — Recommended mitigation or remediation guidance for this risk rule. - `timestamp` string, date-time — ISO 8601 timestamp of when the evidence was observed. - `aiInsights` AiInsights — AI-generated threat analysis. Included when the fields parameter contains 'aiInsights'. Text is null when fewer than 3 risk rules are triggered. - `text` string, nullable — AI-generated threat analysis paragraph. Null when fewer than 3 risk rules are triggered. - `numberOfReferences` integer — Number of intelligence references used to generate the insight. - `comment` string, nullable — Explanatory comment (e.g., why insights are not available). - `links` LinksData — Validated intelligence relationships to threat actors, malware, MITRE ATT&CK techniques, and other entities. Included when the fields parameter contains 'links'. Unlike relatedEntities, these are editorially validated relationships. - `hits` object[] — Intelligence hits containing sectioned relationship data. - `start_date` string — Start date of the intelligence hit time window. - `stop_date` string — End date of the intelligence hit time window. - `total_count` integer — Total number of entity relationships in this hit. - `sample_reference_ids` string[] — Sample reference IDs supporting this hit. - `counts` object[] — Breakdown counts by entity type. - `count` integer — Number of entities. - `type` object — Entity type metadata. - `id` string - `name` string - `type` string - `event_count` integer — Number of events in this hit. - `sections` object[] — Relationship sections grouped by category. - `section_id` object — Section identifier. - `id` string — Section ID. - `name` string — Section category name (e.g., 'Actors, Tools & TTPs', 'Victims & Exploit Targets', 'Indicators & Detection Rules'). - `type` string — Section type (e.g., 'Category'). - `total_count` integer — Total entities in this section. - `lists` object[] — Entity lists within this section, grouped by entity type. - `entities` LinksEntity[] - … - `total_count` integer — Total entities in this list. - `type` object — Entity type metadata for this list. - … - `method_aggregates` object[] — Aggregated counts of linked entities by analysis method. - `count` integer — Number of links found by this method. - `type` string — Analysis method type. - `counts` object[] — Summary counts of linked entities by type. - `count` integer — Number of linked entities of this type. - `type` object — Entity type metadata. - `id` string - `name` string - `type` string - `description` string - `intelCard` string, uri — URL to the Recorded Future Intelligence Card for this vulnerability. - `cvss` object — CVSS (Common Vulnerability Scoring System) data. Included when the fields parameter contains 'cvss'. - `accessVector` string — CVSS access vector (e.g., NETWORK, LOCAL). - `accessComplexity` string — CVSS access complexity (e.g., LOW, MEDIUM, HIGH). - `authentication` string — CVSS authentication requirement. - `confidentiality` string — Confidentiality impact (e.g., PARTIAL, COMPLETE). - `integrity` string — Integrity impact. - `availability` string — Availability impact. - `score` number — CVSS numeric score (0.0-10.0). - `version` string — CVSS version (e.g., '2.0'). - `published` string, date-time — CVE publication date. - `lastModified` string, date-time — CVE last modified date. - `commonNames` string[] — Known aliases for this vulnerability (e.g., ['Log4Shell']). - `lifecycleStage` 'Exploited' | 'Weaponized' | 'Proof of Concept' | 'Disclosed' — Current exploitation lifecycle stage. - `linkedMalware` object — Malware families known to exploit this vulnerability. - `entities` object[] — Malware entity references. - `id` string — Malware entity ID. - `name` string — Malware family name. - `type` string — Entity type (Malware). - `total_count` integer — Total number of linked malware families. - `nvdDescription` string — NVD (National Vulnerability Database) description text. - `timestamps` Timestamps — First and last seen timestamps for the entity in Recorded Future data. - `firstSeen` string, date-time — ISO 8601 timestamp of first observation. - `lastSeen` string, date-time — ISO 8601 timestamp of most recent observation. - `analystNotes` object[] — Insikt Group analyst notes providing expert analysis and context. - `id` string — Unique identifier for this analyst note. - `attributes` object — Content and metadata of the analyst note. - `title` string — Title of the analyst note. - `text` string — Full text content of the analyst note. - `validated_on` string, date-time — Date when the note was last validated. - `published` string, date-time — Date when the note was published. - `topic` object — The topic category of this note. - `id` string - `name` string - `type` string - `description` string - `context_entities` Entity[] — Entities referenced as context in the note. - `id` string, required — Entity id - `provided_id` string, required — Entity id provided in request - `type` string, required — Entity type - `name` string, required — Entity name - `note_entities` Entity[] — Primary subject entities of the note. - `id` string, required — Entity id - `provided_id` string, required — Entity id provided in request - `type` string, required — Entity type - `name` string, required — Entity name - `validation_urls` Entity[] — URLs used to validate the note. - `id` string, required — Entity id - `provided_id` string, required — Entity id provided in request - `type` string, required — Entity type - `name` string, required — Entity name - `source` object — Source of the analyst note. - `id` string - `name` string - `type` string - `relatedEntities` object[] — Co-occurrence relationships grouped by entity type (not editorially validated). - `type` string — Relationship type category (e.g., RelatedIpAddress, RelatedHash, RelatedMalware, RelatedThreatActor). - `entities` object[] — Related entities ordered by co-occurrence count. - `count` integer — Number of co-occurrences. - `entity` Entity - `id` string, required — Entity id - `provided_id` string, required — Entity id provided in request - `type` string, required — Entity type - `name` string, required — Entity name - `counts` object[] — Daily reference count time-series. - `date` string, date — The date for this reference count. - `count` integer — Number of references on this date. - `metrics` object[] — Flat metric counters for aggregate statistics. - `type` string — Metric type identifier (e.g., linkedToCyberExploit, linkedToRAT). - `value` integer — The metric count value. - `metadata` object — Request metadata. Included when the metadata query parameter is set to true. --- [API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)