RErecordedfuture
Intelligence Sources

Publish Reports

Submit threat intelligence reports with observables, TTPs, and threat actor associations to a custom source.

post/v1/sources/{id}/reports

Request

  • Base URL
    https://api.recordedfuture.com/autonomous-threat-operations
  • URL
    https://api.recordedfuture.com/autonomous-threat-operations/v1/sources/{id}/reports
  • Auth
    • API key in header X-RFToken
    • or OAuth 2
      Authorization code: https://id.recordedfuture.com/authorize
      Token URL: https://id.recordedfuture.com/token

Path parameters

idstring uuid required

Identity of the source

Request body

externalIdstring

Report identifier from the external intelligence source

observablesstring[] required

IPs, domains, hashes and URLs related to the report

tlp'clear' | 'green' | 'amber' | 'amber+strict' | 'red'

TLP

ttpstring[]

TTPs

malwarestring[]

Malware

threatActorstring[]

Threat Actors

timestampstring date-time

Date and time of the reported event

Example request

[
  {
    "externalId": "1234-112233-abcd",
    "observables": [
      "ip:127.0.0.1"
    ],
    "tlp": "green",
    "ttp": [
      "mitre:T1082"
    ],
    "malware": [
      "Kl70JR",
      "MZycd3"
    ],
    "threatActor": [
      "I2QcS_"
    ]
  }
]

Response

Reports were published for processing

Changes

No recorded changes to this operation across all 1 revision of this API.