Skip to main content
Get risk information for the given IOCs. You must provide at least one parameter to execute the action. Note: This action handles 1 to 1,000 indicators per request.
External DocumentationTo learn more, visit the Recorded Future documentation.

​
Parameters

ParameterDescription
Company By DomainA comma-separated list of companies, identified by their domains, to evaluate their current risk levels.
DomainsA comma-separated list of domains to evaluate their current risk levels.
HashesA comma-separated list of hashes to evaluate their current risk levels.
IP AddressesA comma-separated list of IP addresses to evaluate their current risk levels.
MetadataSelect to append metadata that describes the response data elements.
URLsA comma-separated list of URLs to evaluate their current risk levels.
VulnerabilitiesA comma-separated list of CVEs to evaluate their current risk levels.

​
Example Output

{
	"data": {
		"results": [
			{
				"domain": "google.com",
				"risk": {
					"score": 0,
					"level": 0,
					"context": [
						{
							"additionalProp1": {
								"score": 0,
								"summary": [
									{}
								],
								"rule": {
									"count": 0,
									"maxCount": 5
								},
								"mostCriticalRule": "string"
							},
							"additionalProp2": {
								"score": 0,
								"summary": [
									{}
								],
								"rule": {
									"count": 0,
									"maxCount": 5
								},
								"mostCriticalRule": "string"
							},
							"additionalProp3": {
								"score": 0,
								"summary": [
									{}
								],
								"rule": {
									"count": 0,
									"maxCount": 5
								},
								"mostCriticalRule": "string"
							}
						}
					],
					"rule": {
						"count": 0,
						"mostCritical": "string",
						"maxCount": 30,
						"evidence": {
							"additionalProp1": {
								"count": 0,
								"timestamp": "2025-01-01T13:30:00.000Z",
								"description": "string",
								"rule": "Linked to Malware",
								"sightings": 100,
								"mitigation": "string",
								"level": 0
							},
							"additionalProp2": {
								"count": 0,
								"timestamp": "2025-01-01T13:30:00.000Z",
								"description": "string",
								"rule": "Linked to Malware",
								"sightings": 100,
								"mitigation": "string",
								"level": 0
							},
							"additionalProp3": {
								"count": 0,
								"timestamp": "2025-01-01T13:30:00.000Z",
								"description": "string",
								"rule": "Linked to Malware",
								"sightings": 100,
								"mitigation": "string",
								"level": 0
							}
						},
						"summary": [
							{
								"level": 0,
								"count": 0
							}
						]
					}
				},
				"entity": {
					"id": "idn:google.com",
					"name": "google.com",
					"type": "InternetDomainName",
					"description": "string"
				}
			}
		]
	},
	"counts": {
		"returned": 1,
		"total": 1000
	},
	"metadata": {
		"entries": [
			{}
		]
	}
}

​
Workflow Library Example

Get Risk Information with Recorded Future and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop