Sign in

v1

latestOpenAPI 3.1.12026-07-242899061.7 MB
Metadata

Threat Actor Search

Search Recorded Future's threat actor database by name, alias, or classification.

post/actor/search

Request body

namestring

This string value can be used for a case insensitive, free text search of threat actor names, common names, or aliases. For example, using name":"panda" will yield a search result with over 300 threat actors that have the word "panda" somewhere in its name, common names, or aliases. Advanced searches are supported using a prefix in the search string. For example, using "name":"exact:panda"yields only threat actor(s) whose name is just "Panda". <table> <tr> <th>Prefix</th> <th>Match type</th> <th>Description</th> </tr> <tr> <td>no prefix</td> <td>freetext match (default)</td> <td>Returns threat actors where the search string matches somewhere in a name, a common name or an alias (case-insensitive).</td> </tr> <tr> <td>exact:</td> <td>exact match</td> <td>Returns threat actors where the search string exactly matches a name, a common name or an alias.</td> </tr> <tr> <td>prefix:</td> <td>prefix match</td> <td>Returns threat actors where the search string matches the beginning of a name, a common name or an alias.</td> </tr> <tr> <td>infix:</td> <td>infix match</td> <td>Returns threat actors where the search string is contained anywhere in a name, a common name or an alias.</td> </tr> <tr> <td>relevance:</td> <td>1 word: relevance match<br/> 2+ words: relevance phrase match</td> <td>Returns threat actors that have text attributes relevant to the given search word or search phrase (in the same order). The results are sorted by decreasing relevance.</td> </tr> </table>

limitinteger required

This integer value sets the upper limit on the number of threat actors returned.

offsetstring

This string value should be received in a prior search, and is used to deliver the next set of threat actors in the search response.

Example request

{
  "name": "Fancy Bear",
  "limit": 1000,
  "offset": "eyJvZmZzZXQiOlswLCJzaDAwNSJdfQ=="
}

Response

OK

next_offsetstring

Opaque pagination token. Pass as offset in the next request to retrieve the next page.

Example response

{
  "data": [
    {
      "id": "ltKj5s",
      "type": "Organization",
      "attributes": {
        "name": "Lorec53",
        "common_names": [
          "UAC-0056"
        ],
        "alias": [
          "Lorec53 APT Group"
        ],
        "categories": [
          {
            "id": "PD_NyL",
            "name": "Nation State Sponsored"
          }
        ]
      }
    }
  ],
  "counts": {
    "returned": 10000,
    "total": 1017258
  },
  "next_offset": "eyJvZmZzZXQiOlswLCJzaDAwNSJdfQ=="
}