---
title: "Search Collective Insights events"
method: POST
path: "/search"
tags: ["Search"]
---

# Search Collective Insights events

`POST /search`

## Request

- Base URL: `https://api.recordedfuture.com/collective-insights`
- URL: `https://api.recordedfuture.com/collective-insights/search`
- Auth: API key in header `X-RFToken`

Search previously submitted events processed in Collective Insights analysis and enriched with associated threat entities (threat actors, malware, TTPs).

This operation allows querying enriched events received from all Collective Insights sources:
* Collective Insights API (`POST /detections` endpoint)
* Recorded Future integrations and connectors, including [Autonomous Threat Operations](https://support.recordedfuture.com/hc/en-us/articles/45435282198035-Autonomous-Threat-Operations-Overview) results
* [Autonomous Threat Operations](https://support.recordedfuture.com/hc/en-us/articles/45435282198035-Autonomous-Threat-Operations-Overview) API
* Enterprise Sandbox submissions (if enabled in enterprise settings)

For Recorded Future entity IDs included in responses [Entity Match API](https://docs.recordedfuture.com/reference/entity-match) can be used to retrieve additional entity details.

## Request body

- SearchRequest: Search parameters
  - `filters` object: Filtering criteria for selecting enriched events
    - `associated_threats` object: Filter by threat entities associated with the event
      - `malware` object: Filter by associated malware
        - `id` union: Recorded Future malware entity. Entity IDs can be obtained using the [Entity Match API](https://docs.recordedfuture.com/reference/entity-match).
          - 'present' | 'absent'
          - string[]: Recorded Future malware entity IDs
      - `mitre_code` object: Filter by associated MITRE ATT&CK codes
        - `id` union: MITRE ATT&CK tactic or technique ID, prefixed with "mitre:"
          - 'present' | 'absent'
          - string[]: Recorded Future MITRE code IDs
      - `threat_actor` object: Filter by associated threat actors
        - `id` union: Recorded Future threat actor entity. Entity IDs can be obtained using the [Entity Match API](https://docs.recordedfuture.com/reference/entity-match).
          - 'present' | 'absent'
          - string[]: Recorded Future threat actor entity IDs
    - `autonomous_threat_operations` object: Search Autonomous Threat Operations results by related parameters
      - `job` object: Filter by Threat Hunting job ID. Jobs can be searched using [Autonomous Threat Operations API](https://api.recordedfuture.com/autonomous-threat-operations).
        - `id` union
          - 'present' | 'absent'
          - string[]
      - `profile` object: Filter by Threat Hunting, Threat Detection, or Threat Prevention automation profile ID. Profile can be searched using [Autonomous Threat Operations API](https://api.recordedfuture.com/autonomous-threat-operations).
        - `id` union
          - 'present' | 'absent'
          - string[]
      - `use_case` union: Filter by Autonomous Threat Operations use case: * `hunting` - Threat Hunting * `detection` - Threat Detection * `prevention` - Threat Prevention
        - 'present' | 'absent'
        - string[]
    - `detection_rule` object: Filter by associated detection rules
      - `id` union
        - 'present' | 'absent'
        - string[]
        - string[]
    - `detection_time` object: Filter by event detection time as submitted to Collective Insights
      - `from` string, date-time: Start time (inclusive)
      - `to` string, date-time: End time (inclusive)
    - `detection_type` union: The detection method used by the security tool to find the event
      - 'present' | 'absent'
      - string[]
    - `indicator` object
      - `risk` object
        - `score` object
          - `at_detection` union
            - 'present' | 'absent'
            - object: Range filter for risk score of the indicator at time of detection
              - …
    - `indicator_type` union: Filter by indicator of compromise (IOC) type associated with the event
      - 'present' | 'absent'
      - string[]
    - `integration_type` object: Filter by integration types used to submit events
      - `id` union
        - 'present' | 'absent'
        - string[]
    - `organizations` string[]: Filter by organizations in your Recorded Future enterprise. If not supplied then the search will include events from all organizations that the caller has access to.
    - `submission_method` union: The method used to submit events to Collective Insights: * `api` - public APIs such as [Collective Insights API](https://api.recordedfuture.com/collective-insights) or [Autonomous Threat Operations API](https://api.recordedfuture.com/autonomous-threat-operations) * `integration` - [integrations and connectors with Collective Insights capabilities](https://app.recordedfuture.com/portal/integration-center?filter_use_cases=Collective+Insights) provided by Recorded Future and its partners * `sandbox` - submissions to Recorded Future Sandbox
      - 'present' | 'absent'
      - string[]
  - `limit` integer: Maximum number of events to return
  - `offset` string: Pagination offset for retrieving the next batch of events

## Response `200`

Enriched events matching the search query

- SearchResponse
  - `counts` object: Counts of enriched events matching the query
    - `returned` integer: Number of events in the current response
    - `total` integer: Total number of events matching the query
  - `data` SearchEntry[]: List of enriched events matching the search query
    - `action` string: Action taken by the security tool in response to the event activity
    - `action_category` 'detect' | 'prevent': Classification of the action taken by the security tool in response to the event activity
    - `associated_threats` object
      - `malware` Malware[]: Recorded Future malware entities associated with the event
        - `displayName` string: Entity display name
        - `id` string, required: Entity ID
        - `name` string: Entity name
        - `type` 'Malware', required: Entity type
      - `mitre_codes` MitreAttackIdentifier[]: Recorded Future MITRE ATT&CK entities associated with the event
        - `displayName` string: Entity display name
        - `id` string, required: Entity ID
        - `name` string: Entity name
        - `type` 'MitreAttackIdentifier', required: Entity type
      - `threat_actors` ThreatActor[]: Recorded Future threat actor entities associated with the event
        - `displayName` string: Entity display name
        - `id` string, required: Entity ID
        - `name` string: Entity name
        - `type` 'Organization' | 'Company' | 'Person' | 'Username', required: Entity type
    - `autonomous_threat_operations` object: Autonomous Threat Operations parameters if the event was submitted as part of an Autonomous Threat Operations workflow
      - `job` object
        - `id` string: Threat Hunting job ID used to submit the event
      - `profile` object
        - `id` string: Threat Hunting, Threat Detection, or Threat Prevention automation profile ID used to submit the event
      - `use_case` 'hunting' | 'detection' | 'prevention': Autonomous Threat Operations use case associated with the event: * `hunting` - Threat Hunting * `detection` - Threat Detection * `prevention` - Threat Prevention
    - `context` object: Additional source-specific context information submitted in the event
      - `type` string, required: The type of context object. The context object should contain a property with the same name as the value of this property
    - `detection_rules` object[]: Recorded Future detection rules used by the security tool to find the event
      - `id` string, required: Recorded Future detection rule ID
    - `detection_time` string, date-time: Time when the event was detected by the security tool
    - `detection_type` 'correlation' | 'playbook' | 'detection_rule' | 'sandbox' | 'threat_hunt' | 'vulnerability_scan': The detection method used by the security tool to find the event
    - `id` string: Event ID
    - `incident` object: The incident associated with the event in the security tool
      - `id` string: The incident ID
      - `name` string: The incident name
      - `type` string: The incident type
    - `indicator` object: Indicator of compromise (IOC) associated with the event
      - `field` string: Data field in the event source from which the IOC was extracted
      - `risk` object
        - `score` object
          - `at_detection` integer
      - `type` 'ip' | 'domain' | 'hash' | 'url' | 'vulnerability': IOC type
      - `value` string: IOC value as Recorded Future entity ID
    - `integration_type` object: Integration type used to submit the event.
      - `displayName` string: Integration display name
      - `id` string, required: Integration ID
      - `name` string: Integration name
    - `organizations` string[]: Organization IDs (uhashes) to which the event is attributed
    - `submission_method` 'api' | 'integration' | 'sandbox': The method used to submit events to Collective Insights: * `api` - public APIs such as [Collective Insights API](https://api.recordedfuture.com/collective-insights) or [Autonomous Threat Operations API](https://api.recordedfuture.com/autonomous-threat-operations) * `integration` - [integrations and connectors with Collective Insights capabilities](https://app.recordedfuture.com/portal/integration-center?filter_use_cases=Collective+Insights) provided by Recorded Future and its partners * `sandbox` - submissions to Recorded Future Sandbox
  - `next_offset` string: Pagination offset for retrieving the next batch of events

## Other responses

- `400`: Client error
- `401`: Client error
- `403`: Client error
- `429`: Too many requests
- `500`: Server error
- `502`: Server error
- `503`: Server error
- `504`: Server error

---

[API](https://skmtc.dev/recordedfuture/apis/collective-insights-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/collective-insights-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/collective-insights-api/revisions/260c9863a7cf?raw)