Sign in

v1

latestOpenAPI 3.1.12026-07-242899061.7 MB
Malware Intelligence

Query Malware Intelligence data with lists of entities

Find sandbox artifacts by matching against lists of known IOCs instead of query expressions.

post/v1/query_iocs

Request body

sha256_liststring[]

Lists of indicators of compromise (IOCs) grouped by type.

ip_liststring[]

Lists of indicators of compromise (IOCs) grouped by type.

domain_liststring[]

Lists of indicators of compromise (IOCs) grouped by type.

url_liststring[]

Lists of indicators of compromise (IOCs) grouped by type.

field'sha256' | 'ip_address' | 'domain' | 'url' | 'command_line' | 'ttp' | 'dst_port' | 'signature' | 'ioc' | 'tag' | 'score' | 'asn' | 'submitter_industry' | 'imported_dll' | 'dumped_file_sha256' | 'dumped_file_path' | 'registry_key_read' | 'registry_key_created' | 'pe_issuer' required

Field of Malware Intelligence data to return data for

operator'and' | 'or'

Query operator for building malware intelligence search expressions.

start_datestring date required

Earliest date to include in the query (cannot be before 2023-11-01)

end_datestring date

Latest date to include in the query, defaults to today in UTC

my_enterpriseboolean

Only include samples submitted by your enterprise in the query (defaults to false)

pageinteger

Page number to return. Pages are zero-indexed. (Defaults to 0)

sandbox_scoreboolean

Include sandbox score in the response

linksboolean

Include universal report and intelligence card URLs in the response

sanitizeboolean

Whether to sanitize returned results. When omitted the service will default to false.

Example request

{
  "field": "sha256",
  "start_date": "2024-11-01",
  "end_date": "2024-11-30",
  "sandbox_score": true,
  "links": true
}

Response

List of 'field' values matching the query with given lists

total_pagesinteger

Total number of pages that can be returned by this query

Example response

{
  "data": [
    {
      "name": "9211caf87f978d7761bfb267bb0a61e43d66f8dfdcfd1793654408d0bb15b54e",
      "count": 10,
      "risk_score": 50,
      "sandbox_score": 5,
      "file_extensions": [
        ".exe",
        ".dll"
      ],
      "tags": [
        "ransomware",
        "trojan"
      ],
      "links": {
        "universal_report": "https://app.recordedfuture.com/portal/intelligence-card/hash:9211caf87f978d7761bfb267bb0a61e43d66f8dfdcfd1793654408d0bb15b54e/sandbox-report",
        "intelligence_card": "https://app.recordedfuture.com/portal/intelligence-card/hash:9211caf87f978d7761bfb267bb0a61e43d66f8dfdcfd1793654408d0bb15b54e"
      }
    }
  ],
  "counts": {
    "returned": 1,
    "total": 1000
  },
  "total_pages": 100
}