Linking to Intel Cards

Recorded Future makes it straightforward to quickly navigate or link to intel cards for IP Addresses, Domain, Hashes, Vulnerabilities, Malware, and Threat Actors (groups). These cards serve as a starting point for investigation or incident response, e.g., what can external threat intel from Recorded Future tell me about this observable?

The summary pages have a consistent URL structure, which makes it easy to deep link into Recorded Future from other systems.

The URL structure for these deep links to app.recordedfuture.com is:

  • /live/sc/entity/ip:<IP Address> Example

Please note: URLs to IP Intel cards need to have leading zeros removed from IPv4 Addresses

  • /live/sc/entity/idn:<Internet Domain Name> Example
  • /live/sc/entity/hash:<Hash value> Example
  • /live/sc/entity/?name=<Vulnerability name or CVE number> Example 1Example 2
  • /live/sc/entity/?name=<Malware family> Example
  • /live/sc/entity/?name=<Threat Actor group> Example


Customers who do not wish to expose the Intel Card details in the URL may instead POST a request to the following link with entity parameters in the body of the POST:

https://app.recordedfuture.com/live/sc/entity 

For example, here is a simple HTML file illustrating this method; note the different "Name" field for CVEs compared to the other indicator types.

<html>
<body>
Hash,IP,IDN
<form method="post" action="https://app.recordedfuture.com/live/sc/entity">
<label>Entity id:<label><input type="text" name="id"/>
<button type="submit">Submit</button>
</form>
<br>
<br>
CVE
<form method="post" action="https://app.recordedfuture.com/live/sc/entity">
<label>Entity name:<label><input type="text" name="name"/>
<button type="submit">Submit</button>
</form>
</body>
</html>

Please note: Authenticated Recorded Future users will see the full Intel Card; non-Recorded Future users will see an abbreviated set of information on the Intel Card.

Was this article helpful?
0 out of 0 found this helpful

The content of this article is confidential and intended solely for the use of individuals with authorized access to the Recorded Future service. Do not download or distribute this article.
Have more questions? Submit a request

Comments

0 comments

Please sign in to leave a comment. Please note that your name will be displayed.