rf-links-ip
Query technically validated links for a single IP address using Recorded Future API.
Syntax
rf-links-ip [profile=STRING] value=STRING [duration=STRING]
Options
- profile=STRING
- Optional. Recorded Future connect profile code. Queries all profiles if omitted.
- value=STRING
- Required. IP address to query
- duration=STRING
- Optional. Lookback period for links from technical sources. Use d(day) or mon(month, 30 days) unit, up to 1825 days. Default: last 30 days
Output fields
| Field | Type | Name | Description |
|---|---|---|---|
| profile | String | Profile | Recorded Future connect profile code |
| entity | String | Entity | IP address |
| target_type | String | Target Type | Related entity type. e.g. IpAddress, Malware, MitreAttackIdentifier |
| target_name | String | Target Name | Related entity name. e.g. 198.51.100.1, PureRAT |
| target_id | String | Target ID | Recorded Future entity ID. e.g. ip:198.51.100.1 |
| target_display_name | String | Target Display Name | Display name of MITRE ATT&CK entity. e.g. T1071 (Application Layer Protocol | ATT&CK Enterprise) |
| source | String | Source | Link source (technical, insikt) |
| category | String | Category | Link category. e.g. Actors, Tools & TTPs, Victims & Exploit Targets |
| risk_score | Integer | Risk Score | Risk score (0-99) |
| risk_level | Integer | Risk Level | Risk level (0-4) |
| verdict | String | Verdict | Verdict label for the risk level. e.g. Unusual, Suspicious, Malicious |
| is_threat_actor | Boolean | Is Threat Actor | Whether the organization or person is a threat actor |