rf-related-hash
Query related information for a single file hash using Recorded Future API.
Syntax
rf-related-hash [profile=STRING] value=STRING
Options
- profile=STRING
- Optional. Recorded Future connect profile code. Queries all profiles if omitted.
- value=STRING
- Required. File hash to query (MD5, SHA1, SHA256)
Output fields
| Field | Type | Name | Description |
|---|---|---|---|
| profile | String | Profile | Recorded Future connect profile code |
| entity | String | Entity | File hash |
| relationship_type | String | Relationship Type | Related entity group. e.g. RelatedInternetDomainName, RelatedHash, RelatedMalware |
| target_type | String | Target Type | Related entity type. e.g. InternetDomainName, Hash, Malware |
| target_name | String | Target Name | Related entity name. e.g. example.com, PureRAT |
| target_id | String | Target ID | Recorded Future entity ID. e.g. idn:example.com |
| count | Integer | Count | Number of co-occurrences in references |