feat(recorded-future): Recorded Future + ASI integrations
Recorded Future (enrichment): native ConnectAPI v2 (X-RFToken). ip/domain/url/ file/cve risk reputation, full entity intelligence, and alert ingestion (alerts search) with an OCSF mapper and a 'Recorded Future Alert' default type, plus alert lookup and alert-rule search. Recorded Future ASI (enrichment): Attack Surface Intelligence (SecurityTrails API, APIKEY header, project-scoped). Project issue ingestion (project_issues) with an OCSF mapper and a 'Recorded Future ASI Issue' default type, filtered by a configurable minimum severity, plus recent-issues and recent-issues-by-host queries. The XSOAR-gateway packs (alerts/lists) were re-implemented against Recorded Future's native ConnectAPI rather than the XSOAR-coupled gateway protocol. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
@@ -0,0 +1,148 @@
|
||||
id: recorded_future
|
||||
name: Recorded Future
|
||||
version: 1.0.0
|
||||
description: "Recorded Future ConnectAPI (v2) — risk reputation for IPs, domains, URLs, file hashes and vulnerabilities, full entity intelligence (risk rules, related entities, threat lists), and alert ingestion (search/lookup/rules)."
|
||||
changelog: "1.0.0 — Initial release: ip/domain/url/file/cve reputation, entity intelligence, alert ingestion (search) with an OCSF mapper, alert lookup and alert-rule search."
|
||||
category: enrichment
|
||||
|
||||
# Per-instance configuration. The ConnectAPI is authenticated with an
|
||||
# Organization API token sent in the X-RFToken header.
|
||||
config_schema:
|
||||
properties:
|
||||
server_url:
|
||||
type: string
|
||||
description: "Recorded Future API base URL"
|
||||
default: https://api.recordedfuture.com
|
||||
api_token:
|
||||
type: string
|
||||
description: "Recorded Future API token"
|
||||
x-soar-sensitive: true
|
||||
required:
|
||||
- api_token
|
||||
|
||||
auth:
|
||||
- id: token
|
||||
type: api_key
|
||||
in: header
|
||||
name: X-RFToken
|
||||
value_template: "{{secret}}"
|
||||
secret_field: api_token
|
||||
|
||||
commands:
|
||||
# ── Reputation ──────────────────────────────────────────────────────────────
|
||||
- id: ip
|
||||
name: recordedfuture-ip
|
||||
description: "Risk reputation for an IP address (risk score, level and triggered risk rules)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
ip: { type: string, description: "IP address" }
|
||||
required: [ip]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: domain
|
||||
name: recordedfuture-domain
|
||||
description: "Risk reputation for a domain (risk score, level and triggered risk rules)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
domain: { type: string, description: "Domain name" }
|
||||
required: [domain]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: url
|
||||
name: recordedfuture-url
|
||||
description: "Risk reputation for a URL (risk score, level and triggered risk rules)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
url: { type: string, description: "URL" }
|
||||
required: [url]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: file
|
||||
name: recordedfuture-file
|
||||
description: "Risk reputation for a file hash (MD5, SHA1, SHA256, SHA512)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
file: { type: string, description: "File hash" }
|
||||
required: [file]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: cve
|
||||
name: recordedfuture-cve
|
||||
description: "Risk reputation for a vulnerability (CVE)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
cve: { type: string, description: "CVE identifier (e.g. CVE-2021-44228)" }
|
||||
required: [cve]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: intelligence
|
||||
name: recordedfuture-intelligence
|
||||
description: "Full intelligence for a single entity: risk, triggered rules, related entities, metrics and threat lists."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
entity_type: { type: string, description: "Entity type: ip, domain, url, file or cve" }
|
||||
entity: { type: string, description: "Entity value (IP, domain, URL, hash or CVE)" }
|
||||
required: [entity_type, entity]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
# ── Alert ingestion ─────────────────────────────────────────────────────────
|
||||
- id: alerts
|
||||
name: recordedfuture-alerts
|
||||
description: "Search alerts. Used for ingestion: results path = data.results. Filter by triggered time, status and alert rule."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
triggered: { type: string, description: "Triggered-time filter. A bare timestamp/relative value is treated as the lower bound ('[<value>,]'); a range '[from,to]' is passed through. Incremental fetch watermark." }
|
||||
status: { type: string, description: "Review status (unassigned, assigned, pending, actionable, no-action, tuning)" }
|
||||
alert_rule: { type: string, description: "Alert rule ID to filter by" }
|
||||
freetext: { type: string, description: "Free-text search" }
|
||||
direction: { type: string, description: "Sort direction (asc, desc). Default desc." }
|
||||
limit: { type: number, description: "Maximum number of alerts (default 50)" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
ingest:
|
||||
results_path: data.results
|
||||
dedup_key: id
|
||||
incremental_field: triggered
|
||||
|
||||
- id: alert_lookup
|
||||
name: recordedfuture-alert-lookup
|
||||
description: "Look up a single alert by ID."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
alert_id: { type: string, description: "Alert ID" }
|
||||
required: [alert_id]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: alert_rules
|
||||
name: recordedfuture-alert-rules
|
||||
description: "Search alert rule IDs by name."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
rule_name: { type: string, description: "Rule name to search (partial allowed)" }
|
||||
limit: { type: number, description: "Maximum number of rules (default 10)" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
# ── Connectivity test ─────────────────────────────────────────────────────
|
||||
- id: test_connection
|
||||
name: recordedfuture-test-connection
|
||||
description: "Verify connectivity and credentials (used by the Test button)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties: {}
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
ingestion:
|
||||
command: alerts
|
||||
mapper: alerts
|
||||
default_incident_type: "Recorded Future Alert"
|
||||
Reference in New Issue
Block a user