Skip to content
One platform. From customer conversation to completed work.Take a closer look
All connections
Security & Identity ยท CONNECTION

Recorded Future + NodeHub

Enrich IPs, domains, hashes, URLs and vulnerabilities, and work with Recorded Future playbook alerts, lists, cases, analyst notes, malware intelligence and threat operations.

Explore 141 workflow actions for Recorded Future, including account permissions and operation limits.

110 read actions31 write actions
WORKFLOW ACTIONS

What you can configure.

Choose an action in the workflow builder, connect an account, and map its inputs. These actions are available in the catalog; your account access and a successful test determine whether they work for your setup.

Associated Entities

Read

Associated Entities.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Associated Entity Types

Read

Associated Entity Types.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Available assignees

Read

Available assignees.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Available Threat Maps

Read

Available Threat Maps.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Build a Case around a Reference Alert, or a Signal Alert

Write

Build a Case around a Reference Alert, or a Signal Alert.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Bulk Code Repository Data Leakage alert lookup

Read

Bulk Code Repository Data Leakage alert lookup.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Bulk Domain Abuse alert lookup

Read

Bulk Domain Abuse alert lookup.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Bulk Geopolitics Facility alerts lookup

Read

Bulk Geopolitics Facility alerts lookup.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Bulk Malware Report alert lookup

Read

Bulk Malware Report alert lookup.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Bulk Third Party Risk alert lookup

Read

Bulk Third Party Risk alert lookup.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Bulk Vulnerability alert lookup

Read

Bulk Vulnerability alert lookup.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Create a Auto Sigma job

Write

Create a Auto Sigma job.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Create an Auto YARA job

Write

Create an Auto YARA job.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Create an exclusion list item

Write

Create an exclusion list item.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Create Source

Write

Create Source.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Delete a feed file (fusion files) delete [fusion/v3/files]

Write

Delete a feed file.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Delete a feed file (fusion files) delete [v2/fusion/files]

Write

Delete a feed file.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Delete a Job (auto-sigma jobs)

Write

Delete a Job.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Delete a Job (auto-yara jobs)

Write

Delete a Job.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Delete a specific Analyst Note

Write

Delete a specific Analyst Note.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Delete an exclusion list item

Write

Delete an exclusion list item.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Deletes one Case

Write

Deletes one Case.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Deletes specified Cases

Write

Deletes specified Cases.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Detailed Code Repository Data Leakage alert data

Read

Detailed Code Repository Data Leakage alert data.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Detailed Domain Abuse alert data

Read

Detailed Domain Abuse alert data.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Detailed Vulnerability alert data

Read

Detailed Vulnerability alert data.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Draft an Analyst Note

Write

Draft an Analyst Note.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Edit an Auto YARA job

Write

Edit an Auto YARA job.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Enumerations

Read

Enumerations.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Fetch risk information for a set of indicators

Read

Fetch risk information for a set of indicators.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Fetch sandbox reports for a given sha256 hash and query

Read

Fetch sandbox reports for a given sha256 hash and query.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Fetch the content of a directory

Read

Fetch the content of a directory.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Geopolitics Facility alert data

Read

Geopolitics Facility alert data.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Get a single active risk rule with enriched evidence

Read

Get a single active risk rule with enriched evidence.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Get all jobs created by user (auto-sigma get_jobs)

Read

Get all jobs created by user.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Get all jobs created by user (auto-yara jobs)

Read

Get all jobs created by user.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Get Job Detection Rules

Read

Get Job Detection Rules.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Get Job Indicators

Read

Get Job Indicators.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Get list listid entities

Read

Returns all entities in the specified list as a JSON array with no pagination.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Get list listid entitieswithtags

Read

Returns all entities in the specified list along with their assigned tags.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Get list listid info

Read

Returns metadata for a specific list including name, type, timestamps, and ownership details.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Get list listid status

Read

Returns the processing status and entity count for a specific list.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Get Pending Jobs

Read

Get Pending Jobs.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Get Profile Detection Rules (profiles rules) post [autonomous-threat-operations/v1/detection/profiles/rules]

Read

Get Profile Detection Rules.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Get Profile Detection Rules (profiles rules) post [autonomous-threat-operations/v1/prevention/profiles/rules]

Read

Get Profile Detection Rules.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Get Profile Indicators (profiles indicators) post [autonomous-threat-operations/v1/detection/profiles/indicators]

Read

Get Profile Indicators.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Get Profile Indicators (profiles indicators) post [autonomous-threat-operations/v1/prevention/profiles/indicators]

Read

Get Profile Indicators.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Get result of a job (auto-sigma jobs)

Read

Get result of a job.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Get result of a job (auto-yara jobs)

Read

Get result of a job.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Get Source

Read

Get Source.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Get Sources

Read

Get Sources.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Link sections

Read

Link sections.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

List audit log records for an organization's exclusion list

Read

List audit log records for an organization's exclusion list.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

List Company risk rules.

Read

List Company risk rules.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

List Domain risk rules

Read

List Domain risk rules.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

List exclusion list items for an organization

Read

List exclusion list items for an organization.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

List Hash risk rules

Read

List Hash risk rules.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

List IP Address risk rules

Read

List IP Address risk rules.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

List references to a Company entity

Read

List references to a Company entity.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

List URL risk rules

Read

List URL risk rules.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

List Vulnerability risk rules

Read

List Vulnerability risk rules.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Lookup

Read

Lookup.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Lookup a Case using its ID

Read

Lookup a Case using its ID.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Lookup a Company entity by id

Read

Lookup a Company entity by id.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Lookup a Domain entity by id

Read

Lookup a Domain entity by id.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Lookup a Domain entity by id by querying an Intelligence Card extension

Read

Lookup a Domain entity by id by querying an Intelligence Card extension.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Lookup a Entity list by id

Read

Lookup a Entity list by id.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Lookup a Hash entity by id

Read

Lookup a Hash entity by id.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Lookup a Hash entity by id by querying an Intelligence Card extension

Read

Lookup a Hash entity by id by querying an Intelligence Card extension.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Lookup a IP Address entity by id

Read

Lookup a IP Address entity by id.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Lookup a IP Address entity by id by querying an Intelligence Card extension

Read

Lookup a IP Address entity by id by querying an Intelligence Card extension.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Lookup a Malware entity by id

Read

Lookup a Malware entity by id.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Lookup a Malware entity by id by querying an Intelligence Card extension

Read

Lookup a Malware entity by id by querying an Intelligence Card extension.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Lookup a specific Analyst Note

Read

Lookup a specific Analyst Note.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Lookup a URL entity by id

Read

Lookup a URL entity by id.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Lookup a URL entity by id by querying an Intelligence Card extension

Read

Lookup a URL entity by id by querying an Intelligence Card extension.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Lookup a Vulnerability entity by id

Read

Lookup a Vulnerability entity by id.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Lookup a Vulnerability entity by id by querying an Intelligence Card extension

Read

Lookup a Vulnerability entity by id by querying an Intelligence Card extension.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Lookup all available risk contexts

Read

Lookup all available risk contexts.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Lookup Company by domain

Read

Lookup Company by domain.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Lookup of Cases using Case IDs

Read

Lookup of Cases using Case IDs.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Malware Categories

Read

Malware Categories.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Malware Report alert notification data.

Read

Malware Report alert notification data.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Malware Threat Map

Read

Malware Threat Map.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Malware Threat Map for Organization

Read

Malware Threat Map for Organization.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Match

Read

Match.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Playbook Alerts: Dark Web Brand Bulk

Read

Playbook Alerts: Dark Web Brand Bulk.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Playbook Alerts: Dark Web Brand Detail

Read

Playbook Alerts: Dark Web Brand Detail.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Playbook Alerts: Malicious Sites Bulk

Read

Playbook Alerts: Malicious Sites Bulk.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Playbook Alerts: Malicious Sites Create

Write

Playbook Alerts: Malicious Sites Create.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Playbook Alerts: Malicious Sites Detail

Read

Playbook Alerts: Malicious Sites Detail.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Playbook Alerts: Social Media Impersonation Bulk

Read

Playbook Alerts: Social Media Impersonation Bulk.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Playbook Alerts: Social Media Impersonation Detail

Read

Playbook Alerts: Social Media Impersonation Detail.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Post list create

Write

Creates a new empty list and returns its metadata including the list ID.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Post list listid entity add

Write

Adds a single entity to the specified list, optionally with context metadata.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Post list listid entity remove

Write

Removes a single entity from the specified list.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Post list listid entity tags

Write

Replaces all tags on an entity in a Third-Parties Watch List.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Post list search

Read

Searches for lists matching optional name, type, and limit filters.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Preview an Analyst Note

Read

Preview an Analyst Note.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Preview Playbook Alert

Read

Preview Playbook Alert.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Publish an Analyst Note

Write

Publish an Analyst Note.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Publish Reports

Write

Publish Reports.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Query Malware Intelligence data with lists of entities

Read

Query Malware Intelligence data with lists of entities.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Query Malware Intelligence data with natural language

Read

Query Malware Intelligence data with natural language.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Query Malware Intelligence data with query language

Read

Query Malware Intelligence data with query language.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Query Profiles (profiles query) post [autonomous-threat-operations/v1/detection/profiles/query]

Read

Query Profiles.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Query Profiles (profiles query) post [autonomous-threat-operations/v1/hunting/profiles/query]

Read

Query Profiles.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Query Profiles (profiles query) post [autonomous-threat-operations/v1/prevention/profiles/query]

Read

Query Profiles.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Retrieve all eligible assignees for a Case

Read

Retrieve all eligible assignees for a Case.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Retry a Job (jobs retry) post [malware-intelligence/v1/auto-sigma/jobs/retry]

Write

Retry a Job.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Retry a Job (jobs retry) post [malware-intelligence/v1/auto-yara/jobs/retry]

Write

Retry a Job.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Search Collective Insights events

Read

Search Collective Insights events.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Search Detection Rules

Read

Search Detection Rules.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Search for Analyst Notes

Read

Search for Analyst Notes.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Search for Company entities based on a filter

Read

Search for Company entities based on a filter.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Search for Domain entities based on a filter

Read

Search for Domain entities based on a filter.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Search for Entity lists based on a filter

Read

Search for Entity lists based on a filter.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Search for Hash entities based on a filter

Read

Search for Hash entities based on a filter.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Search for IP Address entities based on a filter

Read

Search for IP Address entities based on a filter.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Search for links

Read

Search for links.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Search for Malware entities based on a filter

Read

Search for Malware entities based on a filter.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Search for Playbook Alerts

Read

Search for Playbook Alerts.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Search for risk history

Read

Search for risk history.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Search for URL entities based on a filter

Read

Search for URL entities based on a filter.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Search for Vulnerability entities based on a filter

Read

Search for Vulnerability entities based on a filter.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Searches for any Case matching the criteria

Read

Searches for any Case matching the criteria.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Target entity types

Read

Target entity types.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Technical analysis event types

Read

Technical analysis event types.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Third Party Risk alert data

Read

Third Party Risk alert data.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Threat Actor Categories

Read

Threat Actor Categories.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Threat Actor Search

Read

Threat Actor Search.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Threat Actor Threat Map

Read

Threat Actor Threat Map.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Threat Actor Threat Map for Organization

Read

Threat Actor Threat Map for Organization.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Triage multiple IOC entities

Read

Triage multiple IOC entities.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

Update a Sigma Rule

Write

Update a Sigma Rule.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Update Assignee, Status, Priority, Title or Description of a Case

Write

Update Assignee, Status, Priority, Title or Description of a Case.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Update Job Status

Write

Update Job Status.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Update Playbook Alert

Write

Update Playbook Alert.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Update Source

Write

Update Source.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Update the comment on an exclusion list item

Write

Update the comment on an exclusion list item.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

Upload a feed file

Write

Upload a feed file.

Permissions and limits

Account permissions

  • A Recorded Future API token with access to this API

A repeated request may repeat the external action. Review the previous result before retrying a write.

SETUP

Start with a controlled test.

01Connect the intended account

Use the account and permissions required for your process. Review the connection check before configuring a workflow action.

02Review inputs and access

Select a listed operation and map its required inputs. Use test records and add a human approval before writes that need review.

03Confirm the result

Inspect step outputs and confirm the result in Recorded Future. A saved workflow is not a completed provider action.

Follow the workflow quickstart
EXPLORE YOUR STACK

More in Security & Identity.

AbuseIPDBAlienVault OTXAllowlyAmbriel
Recorded Future integration | NodeHub