Recorded Future

Version: 1.12
Updated: April 30, 2026

Utilize Recorded Future threat intelligence feeds during incident investigation.

Actions

• IP Reputation (Enrichment) - Get the reputation for the specified IP address.
• URL Reputation (Enrichment) - Get the reputation for the specified URL.
• Domain Reputation (Enrichment) - Get the reputation for the specified domain.
• File Reputation (Enrichment) - Get the reputation for the specified file hash.
• Vulnerability Search (Enrichment) - Search threat intelligence for the specified search query.
• Malware Search (Enrichment) - Search threat intelligence for the specified search query.
• Get Alert Details (Enrichment) - Get the details for the specified alert.
• Recorded Future Alerts Daemon (Daemon) - Gather RF alerts.
• Vulnerability Search Daemon (Daemon) - Daemon to fetch vulnerabilities.
• File Reputation V2 (Enrichment) - Get the reputation for the specified file hash v2.
• Search Domain (Enrichment) - Search Domains.
• Search URL (Enrichment) - Search URLs.
• Search IP (Enrichment) - Search IP Addresses.
• Search Hash (Enrichment) - Search Hashes.
• Create List (Containment) - Create List.
• Search List (Enrichment) - Find lists based on a query.
• Add Entity (Containment) - Add an entity to the list.
• Remove Entity (Containment) - Remove an entity from the list.
• List Entities (Enrichment) - Get entities on the list.
• Credentials Search (Enrichment) - Search Credential data.
• Credentials Lookup By Email (Enrichment) - Lookup Credential data by Email.
• Credentials Lookup By Login (Enrichment) - Lookup Credential data by Login.

Configure Recorded Future in Automation Service and Cloud SOAR

Before you can use this automation integration, you must configure its authentication settings so that the product you're integrating with can communicate with Sumo Logic. For general guidance, see Configure Authentication for Automation Integrations.

How to open the integration's configuration dialog

1. Access App Central and install the integration. (You can configure at installation, or after installation with the following steps.)
2. Go to the Integrations page.
   Classic UI. In the main Sumo Logic menu, select Automation and then select Integrations in the left nav bar.
   New UI. In the main Sumo Logic menu, select Automation > Integrations. You can also click the Go To... menu at the top of the screen and select Integrations.
3. Select the installed integration.
4. Hover over the resource name and click the Edit button that appears.
   

In the configuration dialog, enter information from the product you're integrating with. When done, click TEST to test the configuration, and click SAVE to save the configuration:

• Label. Enter the name you want to use for the resource.

• API URL. Enter your Recorded Future API URL, for example, https://api.recordedfuture.com/

• API Key. Enter your Recorded Future API key.

• Connection Timeout (s). Set the maximum amount of time the integration will wait for a server's response before terminating the connection. Enter the connection timeout time in seconds (for example, 180).

• Verify Server Certificate. Select to validate the server’s SSL certificate.

• Automation Engine. Select Cloud execution for this certified integration. Select a bridge option only for a custom integration. See Cloud or Bridge execution.

• Proxy Options. Select whether to use a proxy. (Applies only if the automation engine uses a bridge instead of cloud execution.)

  • Use no proxy. Communication runs on the bridge and does not use a proxy.
  • Use default proxy. Use the default proxy for the bridge set up as described in Using a proxy.
  • Use different proxy. Use your own proxy service. Provide the proxy URL and port number.

For information about Recorded Future, see Recorded Future documentation.

Change Log

Version	Date	Description
v1.12	April 30, 2026	Upgraded the python3_generic Docker image (Python 3.8) to python3_12_generic (Python 3.12) to address Python 3.8 end-of-life and improve security and performance.
v1.11	March 4, 2024	Updated code for compatibility with Python 3.12.
v1.10	February 26, 2024	Enabled the Incident Artifacts feature flag for the Get Alert Details action.
v1.9	February 23, 2024	Refactored the Vulnerability Search Daemon.
v1.8	February 16, 2024	Refactored the Recorded Future Alerts Daemon.
v1.7	June 22, 2023	Renamed the integration from Recorded Future OIF to Recorded Future.
v1.6	June 22, 2023	Removed unnecessary empty lines.
v1.5	February 8, 2023	Updated actions to change the 'Fields' field to a required field and improve error handling: File Reputation, Domain Reputation, URL Reputation, and IP Reputation.
	January 10, 2023	Refactored the integration.
	March 23, 2022	Added new actions: Search Domain, Search URL, Search IP, and Search Hash.
	October 27, 2021	Added a new action: File Reputation V2.
	February 19, 2021	Updated actions: Get Alert Details, Recorded Future Alerts Daemon, and Vulnerability Search Daemon.
	September 16, 2019	Initial release of the Recorded Future integration.