Enrich hashes, IPs, and domains with Recorded Future
Build a reusable workflow that accepts an indicator (hash, IP, or domain) and its type. Call the corresponding Recorded Future SecOps/Threat Intel endpoint, parse the risk score, criticality, evidence summary, and portal link. Validate the indicator type, handle unknown indicators and rate limits, and retry transient failures. Output the structured enrichment for the caller.
What this prompt builds
Send an IOC to Recorded Future and get back its criticality, score, summary, and link.
The problem
Analysts need a fast, authoritative risk read on an indicator, but pivoting into Recorded Future for every IOC interrupts the investigation flow. Inconsistent enrichment leads to inconsistent decisions.
Solution and impact
This workflow sends a hash, IP, or domain to Recorded Future and returns the criticality, score, summary, and a link. Indicators get an authoritative risk rating in seconds, ready to feed automated decisions.