Recorded Future Identity API

https://docs.recordedfuture.com/reference/identity-incident-report
Admin
Recorded Future Identity API provides access to identity leak and breach data, including incident...
Tokens:1,891
Snippets:9
Trust Score:9.7
Update:5 months ago
Show doc for...
Tokens:
Raw
### Get Incident Report

Source: https://docs.recordedfuture.com/reference/identity-incident-report

Retrieves a detailed exposure incident report for a single malware log. This report includes compromised credentials, device details, and malware attribution.

```APIDOC
## POST /identity/incident/report

### Description
Get a detailed exposure incident report for a single malware log, including compromised credentials, device details, and malware attribution.

### Method
POST

### Endpoint
/identity/incident/report

### Request Body
- **organization_id** (UhashId) - Required - The organization ID.
- **source** (string) - Required - The dump source identifier (e.g., dump-redline-2024-07-21-001).
- **include_details** (boolean) - Optional - Whether to include detailed information.

### Responses
#### Success Response (200)
- **schema** - The schema for the incident report response.

#### Error Responses
- **400** - Bad Request
- **401** - Unauthorized
- **403** - Forbidden
- **500** - Internal Server Error
```

--------------------------------

### Get Incident Report

Source: https://docs.recordedfuture.com/reference/identity-incident-report

Generates a comprehensive incident report for a single stealer malware infection, showing every credential the malware harvested from the compromised machine. The `source` parameter is the file path string found in `dump.source` from Identity: Detections or `dumps[].source` from Identity: Lookup. The `include_details` field must be explicitly set to `true` or `false`.

```APIDOC
## Get Incident Report

### Description
Generates a comprehensive incident report for a single stealer malware infection, showing every credential the malware harvested from the compromised machine.

### Method
GET

### Endpoint
`/identity/incident-report`

### Parameters
#### Query Parameters
- **source** (string) - Required - The file path string found in `dump.source` or `dumps[].source`.
- **include_details** (boolean) - Required - Set to `true` to include machine context, `false` otherwise.

### Response
#### Success Response (200)
- **credentials** (array) - List of compromised credentials (masked domains, logins, passwords).
- **next_offset** (string) - Pagination token for subsequent requests if more credentials exist.
- **machine_context** (object) - (Only if `include_details=true`) Contains malware family, OS, username, timezone, exfiltration date, and source IP.
  - **malware_family** (string) - The family of the malware.
  - **os** (string) - The operating system of the compromised machine.
  - **username** (string) - The username associated with the compromised account.
  - **timezone** (string) - The timezone of the compromised machine.
  - **exfiltration_date** (string) - The date the credentials were exfiltrated.
  - **source_ip** (string) - The IP address from which the data was exfiltrated.
```

--------------------------------

### Get Incident Report

Source: https://docs.recordedfuture.com/reference/identity-incident-report

Retrieves a list of incident reports based on specified criteria. Supports filtering by source and including extended device and malware details. Pagination is handled via an offset token.

```APIDOC
## GET /incident-report

### Description
Retrieves a list of incident reports.

### Method
GET

### Endpoint
/incident-report

### Parameters
#### Query Parameters
- **source** (string) - Required - The source of the incident report data.
- **include_details** (boolean) - Required - Whether to include extended device and malware details in the response.
- **limit** (integer) - Optional - Maximum number of credential entries to return (0-1000).
- **offset** (string) - Optional - Pagination token for the next page.

### Response
#### Success Response (200)
- **count** (integer) - The number of credentials returned in this response.
- **total_count** (integer) - The total number of credentials available.
- **credentials** (array) - An array of credential objects.
  - **authorization_domain** (string) - The authorization domain of the credential.
  - **email_or_login** (string) - The email or login associated with the credential.
  - **password** (string) - The password for the credential.
  - **password_sha1** (string) - The SHA1 hash of the password.
  - **domain_category** (string) - The category of the domain.
  - **domain_technology** (string) - The technology of the domain.
  - **contains_cookies** (boolean) - Indicates if cookies are present.
  - **contains_active_cookies** (boolean) - Indicates if active cookies are present.
  - **contains_high_risk_technologies** (boolean) - Indicates if high-risk technologies are present.
- **details** (object) - Extended details about the incident, if `include_details` was true.
  - **malware_family** (string) - The family of malware involved.
  - **os** (string) - The operating system of the affected device.
  - **os_username** (string) - The username on the operating system.
  - **malware_file** (string) - The path to the malware file.
  - **timezone** (string) - The timezone of the affected device.
  - **uac** (string) - User Account Control status.
  - **exfiltration_date** (string) - The date and time of data exfiltration.
  - **antivirus** (string) - The antivirus software detected.
  - **ip_address** (string) - The IP address associated with the incident.
  - **postal_code** (string) - The postal code associated with the incident.
- **next_offset** (string) - A token for retrieving the next page of results.

### Request Example
```json
{
  "source": "example.com",
  "include_details": true,
  "limit": 100,
  "offset": "eyJsaW1pdCI6IDEwMCwgIm9mZnNldCI6IDEwMH0="
}
```

### Response Example
```json
{
  "count": 1,
  "total_count": 10,
  "credentials": [
    {
      "authorization_domain": "login.microsoftonline.com",
      "email_or_login": "admin_user",
      "password": "CompanySecret!2024",
      "password_sha1": "2ef7bde608ce5404e97d5f042f95f89f1c232871",
      "domain_category": "Cloud Provider",
      "domain_technology": "Microsoft Office 365",
      "contains_cookies": true,
      "contains_active_cookies": false,
      "contains_high_risk_technologies": true
    }
  ],
  "details": {
    "malware_family": "RedLine Stealer",
    "os": "Windows 10 Pro",
    "os_username": "jsmith",
    "malware_file": "C:\\Users\\jsmith\\AppData\\Local\\Temp\\winmgr.exe",
    "timezone": "America/New_York",
    "uac": "UAC-Admin",
    "exfiltration_date": "2025-07-24T14:30:00Z",
    "antivirus": "Windows Defender",
    "ip_address": "198.51.100.14",
    "postal_code": "10001"
  },
  "next_offset": "eyJsaW1pdCI6IDEwMCwgIm9mZnNldCI6IDIwMH0="
}
```
```
Tokens:
Raw