rf-related-malware-batch
Query related information for malware using Recorded Future API.
Syntax
rf-related-malware-batch profile=STRING field=STRING [output=STRING]
Options
- profile=STRING
- Required. Recorded Future connect profile code. Only one profile can be specified.
- field=STRING
- Required. Input field name containing malware name
- output=STRING
- Optional. Output field prefix. Default: rf_
Output fields
Existing fields of the input row are kept. The input row is duplicated for each related entity, and the fields below are added. The rf_ prefix can be changed with the output option.
| Field | Type | Name | Description |
|---|---|---|---|
| rf_relationship_type | String | Relationship Type | Related entity group. e.g. RelatedInternetDomainName, RelatedHash, RelatedMalware |
| rf_target_type | String | Target Type | Related entity type. e.g. InternetDomainName, Hash, Malware |
| rf_target_name | String | Target Name | Related entity name. e.g. example.com, PureRAT |
| rf_target_id | String | Target ID | Recorded Future entity ID. e.g. idn:example.com |
| rf_count | Integer | Count | Number of co-occurrences in references |
| _error | String | Error | Failure reason (invalid input, no related entities, API error) |