Recorded Future (enrichment): native ConnectAPI v2 (X-RFToken). ip/domain/url/
file/cve risk reputation, full entity intelligence, and alert ingestion (alerts
search) with an OCSF mapper and a 'Recorded Future Alert' default type, plus
alert lookup and alert-rule search.
Recorded Future ASI (enrichment): Attack Surface Intelligence (SecurityTrails
API, APIKEY header, project-scoped). Project issue ingestion (project_issues)
with an OCSF mapper and a 'Recorded Future ASI Issue' default type, filtered by
a configurable minimum severity, plus recent-issues and recent-issues-by-host
queries.
The XSOAR-gateway packs (alerts/lists) were re-implemented against Recorded
Future's native ConnectAPI rather than the XSOAR-coupled gateway protocol.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Guillaume BOURGEOIS