Search Collective Insights events

Search previously submitted events processed in Collective Insights analysis and enriched with associated threat entities (threat actors, malware, TTPs).

This operation allows querying enriched events received from all Collective Insights sources:

Collective Insights API (POST /detections endpoint)
Recorded Future integrations and connectors, including Autonomous Threat Operations results
Autonomous Threat Operations API
Enterprise Sandbox submissions (if enabled in enterprise settings)

For Recorded Future entity IDs included in responses Entity Match API can be used to retrieve additional entity details.

post/search

Request

Base URL
https://api.recordedfuture.com/collective-insights
URL
https://api.recordedfuture.com/collective-insights/search
Auth
API key in header X-RFToken

Request body

limitinteger

Maximum number of events to return

offsetstring

Pagination offset for retrieving the next batch of events

Example request

{
  "filters": {
    "associated_threats": {
      "malware": {
        "id": [
          "lStsKc"
        ]
      },
      "mitre_code": {
        "id": [
          "mitre:T1059.013"
        ]
      },
      "threat_actor": {
        "id": [
          "lStsKd"
        ]
      }
    },
    "autonomous_threat_operations": {
      "job": {
        "id": [
          "3fa85f64-5717-4562-b3fc-2c963f66afa6"
        ]
      },
      "profile": {
        "id": [
          "d290f1ee-6c54-4b01-90e6-d701748f0851"
        ]
      }
    },
    "detection_rule": {
      "id": [
        "15zvq",
        "w89Y0"
      ]
    },
    "detection_time": {
      "from": "2025-12-15T00:00:00Z",
      "to": "2025-12-16T00:00:00Z"
    },
    "indicator": {
      "risk": {
        "score": {
          "at_detection": {
            "gte": 50
          }
        }
      }
    },
    "integration_type": {
      "id": [
        "ho3spe",
        "hptm1-"
      ]
    },
    "organizations": [
      "uhash:4uwFvB7QsB"
    ]
  },
  "offset": "eyJjcmVhdGVkIjoxNzY5ODY1NjM1Mzg4LCJpZCI6IjY5N2UwMTE0MzhkZmNlNjU0ZjI1YWMxOSJ9.TGYVF_jkzd__pJ02XuM1mckuE3zpEBivQGzlPACgcgE"
}

Response

Enriched events matching the search query

next_offsetstring

Pagination offset for retrieving the next batch of events

Example response

{
  "data": [
    {
      "action": "blocked",
      "action_category": "prevent",
      "associated_threats": {
        "malware": [
          {
            "id": "lStsKc",
            "name": "WhisperGate",
            "type": "Malware"
          }
        ],
        "mitre_codes": [
          {
            "displayName": "T1548 (Abuse Elevation Control Mechanism)",
            "id": "mitre:T1548",
            "name": "T1548",
            "type": "MitreAttackIdentifier"
          }
        ],
        "threat_actors": [
          {
            "id": "lStsKd",
            "name": "DEV-0586",
            "type": "Organization"
          }
        ]
      },
      "autonomous_threat_operations": {
        "job": {
          "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6"
        },
        "profile": {
          "id": "d290f1ee-6c54-4b01-90e6-d701748f0851"
        }
      },
      "context": {
        "recorded_future_api": {
          "destinationIp": "4.5.6.7",
          "deviceName": "my_device",
          "sourceIp": "1.2.3.4"
        },
        "type": "recorded_future_api"
      },
      "detection_rules": [
        {
          "id": "-zSe1-"
        }
      ],
      "detection_time": "2025-12-15T13:05:23Z",
      "detection_type": "threat_hunt",
      "id": "16046941d44a85e4748a9e9a",
      "incident": {
        "id": "28548e09-63e8-4f8b-abd4-be86207b1583"
      },
      "indicator": {
        "field": "dest_dns",
        "type": "domain",
        "value": "www.moroccancam.com"
      },
      "integration_type": {
        "id": "ho3spe",
        "name": "Recorded Future for Splunk v2.0 or later"
      },
      "organizations": [
        "uhash:4uwFvB7QsB"
      ],
      "submission_method": "integration"
    }
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.