feat(recorded-future): Recorded Future + ASI integrations

Recorded Future (enrichment): native ConnectAPI v2 (X-RFToken). ip/domain/url/ file/cve risk reputation, full entity intelligence, and alert ingestion (alerts search) with an OCSF mapper and a 'Recorded Future Alert' default type, plus alert lookup and alert-rule search. Recorded Future ASI (enrichment): Attack Surface Intelligence (SecurityTrails API, APIKEY header, project-scoped). Project issue ingestion (project_issues) with an OCSF mapper and a 'Recorded Future ASI Issue' default type, filtered by a configurable minimum severity, plus recent-issues and recent-issues-by-host queries. The XSOAR-gateway packs (alerts/lists) were re-implemented against Recorded Future's native ConnectAPI rather than the XSOAR-coupled gateway protocol. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 15:19:40 +02:00
parent ef215daa88
commit fcf516ca82
20 changed files with 862 additions and 0 deletions
@@ -0,0 +1,18 @@
+name: "Recorded Future ASI Issues → OCSF"
+description: "Maps a Recorded Future ASI risk issue (project issues, results_path = data) to OCSF Detection Finding fields. Each issue is a triggered risk rule with example affected hosts."
+field_mappings:
+  title: "name"
+  description: "description"
+  # _severity is injected by the fetch script (high=5, moderate=3, informational=1).
+  severity: "_severity"
+# results_path = data; source_path is JSONata over ONE issue object.
+ocsf:
+  # ── Finding ───────────────────────────────────────────────────────
+  - { source_path: "name",                          ocsf_field: "finding_info.uid" }
+  - { source_path: "name",                          ocsf_field: "finding_info.title" }
+  - { source_path: "description",                   ocsf_field: "finding_info.desc" }
+  - { source_path: "classification",                ocsf_field: "activity_name" }
+  - { source_path: "rule_metadata.references[0]",   ocsf_field: "finding_info.src_url" }
+  # ── Example affected host ─────────────────────────────────────────
+  - { source_path: "example_entities.domains[0].example", ocsf_field: "src_endpoint.hostname" }
+  - { source_path: "example_entities.ips[0].example",     ocsf_field: "src_endpoint.ip" }