Recorded Future

✅ Prerequisites

Before configuring the integration, ensure the following requirements are met:

Active Recorded Future Subscription with
- User Role with API Access to generate API tokens under API Access
Admin access to AirMDR application
Testing Tools (Optional) - curl, Postman to verify API token validity before integration.

Supported Versions

Recorded Future API: v2
AirMDR: Compatible with all standard cloud deployments
Integration Method: API Key (HTTPS REST)

Authentication

The integration uses a static API key generated via the Recorded Future Intelligence Services portal.

An active Recorded Future subscription with API access is required.

Generate a New API Key

To generate an API key in the Recorded Future Platform for integrating with AirMDR, follow these steps:

Navigate to Recorded Future Platform.
Enter your credentials (Email Address or Username and Password) to access the Recorded Future dashboard.

Access Settings

Click on your profile icon in the top-right corner of the page.
From the dropdown menu, select “Settings”.
🔎 You must have “User” or “Admin” privileges to access API token settings.

Navigate to API Access

In the Settings panel, go to the left-hand menu.
Click on “API Access” under the Account section.

Generate a New API Key

Under the API Tokens section, click the “Generate New Token” button.
In the prompt that appears:
- Enter a meaningful label for the token (e.g., AirMDR Integration)
- Click “Generate”

✅ Best Practice: Use a unique label for each integration to track usage easily.

Copy and Store the API Key

Click Copy to save it to your clipboard.
This is the only time the API Key will be displayed.
Copy and securely save the secret API key in your preferred password manager, or secure storage solution like password vault.
Once you successfully copy and securely saved the Key, click Done.
Email the API Key to AirMDR
or
Self configure Recorded Future in the AirMDR Integrations Dashboard.

Error Handling

Error Message	Cause	Resolution
`401 Unauthorized`	Invalid or expired API Key	Regenerate the token in Recorded Future
`403 Forbidden`	Insufficient subscription tier	Contact Recorded Future Support
`500 Internal Server Error`	API outage or rate-limiting	Retry with backoff, or check service status

Check AirMDR’s system logs for API timeout or failure events.

Support & Maintenance

Recorded Future Support: https://support.recordedfuture.com/
AirMDR Support Contact: support@airmdr.com

Post-Setup Security Best Practices (Optional)

Token Rotation:
API keys should be rotated every 90 days as a security best practice.
Update Integration:
To update the API Key, go to AirMDR → Integrations → Recorded Future → Edit, then paste the new token and re-authenticate.

Skills Provided by this Integration

Skill ID	Purpose
Recorded Future Get Playbook Alerts	Retrieves playbook alerts from Recorded Future based on specified filters. This skill allows security analysts to fetch and analyze playbook alerts with various filtering options.
Recorded Future List Alerts	Lists alerts from Recorded Future based on specified filters. This skill allows security analysts to retrieve alerts for specific entities, statuses, priorities, and time ranges.
Recorded Future Get Enrichment	Retrieves enrichment data from Recorded Future for specified indicators including URLs, domains, IPs, companies, vulnerabilities, and hashes. This skill provides security analysts with enhanced threat intelligence about potential security risks.

To view the details of Input Parameters and Output for the respective skills

Go to AirMDR → Recorded Future Integration page.
Select the Skills tab and click on the required listed skills.

Recorded Future API Testing

Open cURL and run the following command to check if your API Key is working: Sample cURLCommand

curl --location --globoff 'https://api.recordedfuture.com/alert/v3?triggered=[2025-07-08T12%3A03%3A58.000Z%2C2025-07-09T14%3A03%3A58.000Z]&limit=1' \
--header 'X-RFToken: {CLIENT_X_RFTOKEN}' \
--header 'accept: application/json' \
--header 'Cookie: JSESSIONID=node0xqc123euxh9u1wqusd8facc0x625.node0'

Replace CLIENT_X_RFTOKEN with your actual secret API key.

Sample JSON Response

{
  "data": [
    {
      "review": {
        "note": null,
        "status_in_portal": "New",
        "assignee": null,
        "status": "no-action"
      },
      "owner_organisation_details": {
        "organisations": [
          {
            "organisation_id": "uhash:REDACTED",
            "organisation_name": "RedactedOrganization"
          }
        ],
        "enterprise_id": "uhash:REDACTED",
        "enterprise_name": "RedactedOrganization"
      },
      "url": {
        "api": "https://api.recordedfuture.com/v3/alerts/REDACTED",
        "portal": "https://app.recordedfuture.com/live/sc/notification/?id=REDACTED"
      },
      "rule": {
        "use_case_deprecation": null,
        "name": "Brand Names in Hashtags",
        "id": "REDACTED",
        "url": {
          "portal": "https://app.recordedfuture.com/live/sc/ViewIdkobra_view_report_item_alert_editor?view_opts=REDACTED"
        }
      },
      "id": "REDACTED",
      "hits": [
        {
          "entities": [
            {
              "id": "REDACTED",
              "name": "#日立ソリューションズ",
              "type": "Hashtag"
            }
          ],
          "document": {
            "source": {
              "id": "source:REDACTED",
              "name": "Bluesky Social Network",
              "type": "Source"
            },
            "title": "REDACTED",
            "url": "https://bsky.app/profile/REDACTED",
            "authors": [
              {
                "id": "REDACTED",
                "name": "REDACTED",
                "type": "Username"
              }
            ]
          },
          "fragment": "REDACTED — RedactedOrganizationの最高賞受賞、日本唯一のプラチナパートナーに認定...",
          "id": "REDACTED",
          "language": "jpn",
          "primary_entity": null,
          "analyst_note": null
        },
        {
          "entities": [
            {
              "id": "REDACTED",
              "name": "#業務自動化",
              "type": "Hashtag"
            }
          ],
          "document": {
            "source": {
              "id": "source:REDACTED",
              "name": "Bluesky Social Network",
              "type": "Source"
            },
            "title": "REDACTED",
            "url": "https://bsky.app/profile/REDACTED",
            "authors": [
              {
                "id": "REDACTED",
                "name": "REDACTED",
                "type": "Username"
              }
            ]
          },
          "fragment": "REDACTED — RedactedOrganization日本法人が授与する賞で特別な栄誉を獲得...",
          "id": "REDACTED",
          "language": "jpn",
          "primary_entity": null,
          "analyst_note": null
        },
        {
          "entities": [
            {
              "id": "REDACTED",
              "name": "#業務自動化",
              "type": "Hashtag"
            },
            {
              "id": "REDACTED",
              "name": "PLC",
              "type": "IndustryTerm"
            },
            {
              "id": "REDACTED",
              "name": "REDACTED",
              "type": "Image"
            },
            {
              "id": "REDACTED",
              "name": "BlueMeme",
              "type": "OrgEntity"
            },
            {
              "id": "REDACTED",
              "name": "株式会社BlueMeme",
              "type": "OrgEntity"
            },
            {
              "id": "REDACTED",
              "name": "RedactedOrganization",
              "type": "Company"
            },
            {
              "id": "REDACTED",
              "name": "#bluememe",
              "type": "Hashtag"
            },
            {
              "id": "REDACTED",
              "name": "#RedactedOrganization",
              "type": "Hashtag"
            },
            {
              "id": "REDACTED",
              "name": "REDACTED",
              "type": "Image"
            },
            {
              "id": "REDACTED",
              "name": "https://tokyo.publising.3rd-in.co.jp/article/REDACTED",
              "type": "URL"
            }
          ],
          "document": {
            "source": {
              "id": "source:REDACTED",
              "name": "Bluesky Social Network",
              "type": "Source"
            },
            "title": "REDACTED",
            "url": "https://bsky.app/profile/REDACTED",
            "authors": [
              {
                "id": "REDACTED",
                "name": "REDACTED",
                "type": "Username"
              }
            ]
          },
          "fragment": "REDACTED — RedactedOrganizationの「Breakout Partner of the Year」 を受賞し業務自動化を推進...",
          "id": "REDACTED",
          "language": "eng",
          "primary_entity": null,
          "analyst_note": null
        }
      ],
      "enriched_entities": [],
      "ai_insights": {
        "comment": "The Recorded Future AI requires more references in order to produce a summary.",
        "text": null
      },
      "log": {
        "note_author": null,
        "note_date": null,
        "status_date": null,
        "triggered": "2025-07-09T12:04:30.080Z",
        "status_change_by": null
      },
      "triggered_by": [],
      "title": "Brand Names in Hashtags - 3 references",
      "type": "EVENT"
    }
  ],
  "counts": {
    "returned": 1,
    "total": 5
  }
}

Configure OpenAI in the AirMDR Integrations Dashboard

Navigate to AirMDR, provide the credentials, and click Login
Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select Integrations.
Use the search option, enter the keyword “Recorded Future”, select the Connections tab, and click Create.
Enter an unique name to the Instance (e.g., your org name-RecordedFuture) to easily identify the user connection by AirMDR.
Enter the generated API Key in the Authentication Details field params, and click Create.

Getting Started

AirMDR Detections

Integrations

API Reference

AirMDR Product Suite

Recorded Future

✅ Prerequisites

Supported Versions

Authentication

Generate a New API Key

Error Handling

Support & Maintenance

Post-Setup Security Best Practices (Optional)

Skills Provided by this Integration

Recorded Future API Testing

Configure OpenAI in the AirMDR Integrations Dashboard

​✅ Prerequisites

​Supported Versions

​Authentication

​Generate a New API Key

​Error Handling

​Support & Maintenance

​Post-Setup Security Best Practices (Optional)

​Skills Provided by this Integration

​Recorded Future API Testing

​Configure OpenAI in the AirMDR Integrations Dashboard

✅ Prerequisites

Supported Versions

Authentication

Generate a New API Key

Error Handling

Support & Maintenance

Post-Setup Security Best Practices (Optional)

Skills Provided by this Integration

Recorded Future API Testing

Configure OpenAI in the AirMDR Integrations Dashboard