rf-links-url-batch
Query technically validated links for URLs using Recorded Future API.
Syntax
rf-links-url-batch profile=STRING field=STRING [output=STRING] [duration=STRING]
Options
- profile=STRING
- Required. Recorded Future connect profile code. Only one profile can be specified.
- field=STRING
- Required. Input field name containing URL
- output=STRING
- Optional. Output field prefix. Default: rf_
- duration=STRING
- Optional. Lookback period for links from technical sources. Use d(day) or mon(month, 30 days) unit, up to 1825 days. Default: last 30 days
Output fields
Existing fields of the input row are kept. The input row is duplicated for each related entity, and the fields below are added. The rf_ prefix can be changed with the output option.
| Field | Type | Name | Description |
|---|---|---|---|
| rf_target_type | String | Target Type | Related entity type. e.g. IpAddress, Malware, MitreAttackIdentifier |
| rf_target_name | String | Target Name | Related entity name. e.g. 198.51.100.1, PureRAT |
| rf_target_id | String | Target ID | Recorded Future entity ID. e.g. ip:198.51.100.1 |
| rf_target_display_name | String | Target Display Name | Display name of MITRE ATT&CK entity. e.g. T1071 (Application Layer Protocol | ATT&CK Enterprise) |
| rf_source | String | Source | Link source (technical, insikt) |
| rf_category | String | Category | Link category. e.g. Actors, Tools & TTPs, Victims & Exploit Targets |
| rf_risk_score | Integer | Risk Score | Risk score (0-99) |
| rf_risk_level | Integer | Risk Level | Risk level (0-4) |
| rf_verdict | String | Verdict | Verdict label for the risk level. e.g. Unusual, Suspicious, Malicious |
| rf_is_threat_actor | Boolean | Is Threat Actor | Whether the organization or person is a threat actor |
| _error | String | Error | Failure reason (invalid input, entity not found, no related entities, API error) |