autobotAI

Recorded Future

Overview

The Recorded Future integration connects autobotAI to Recorded Future, a threat intelligence platform that delivers real-time risk scoring and context across IPs, domains, file hashes, vulnerabilities, and identities. Once connected, autobotAI can enrich alerts, score indicators, and trigger downstream actions inside playbooks and detection workflows using Recorded Future's Connect API.

This guide walks through setting up the Recorded Future integration in your autobotAI account.

Prerequisites

Before starting, ensure you have:

  • An active Recorded Future tenant with API access enabled.
  • A Connect API token issued for your account, with the modules you intend to query (for example IP Intelligence).

Instructions for generating an API token are in the Additional Information section.

Steps to Set Up the Recorded Future Integration

Step 1: Navigate to the Integrations page from the menu and click the + Add Integration button in the top-right corner.

Step 2: From the list, under the Security Tools section, select Recorded Future + Add to start a new integration.

Step 3: Fill in the required fields as follows:

Note: Fields marked with an asterisk (*) are mandatory.

  • Alias: A meaningful name for this integration.
  • Groups: Optional grouping label for organizing multiple integrations.
  • API Token: The Connect API token from the Recorded Future portal. Sent as the X-RFToken header.
  • Skip Test Integration: Set to Yes to bypass the live token check during setup. Useful when the API is temporarily unreachable or you are seeding credentials offline. Defaults to No.

Verify the information, then click Create to complete the integration.

Step 4: After the integration is created, locate it under Integrations. Click the three-dot menu and select Test to confirm autobotAI can reach Recorded Future with the provided token.

Additional Information

How to Generate a Connect API Token

  1. Log in to the Recorded Future portal.
  2. Open User Settings → API Access.
  3. Click Request Token (or copy an existing one) and select the modules you need (for example IP Intelligence, Domain Intelligence, Vulnerability).
  4. Copy the token — it is shown only once, so store it in a secure secret manager.

If your account does not show an API Access tab, contact your Recorded Future administrator or customer success manager to request API entitlement.

How the Token Is Validated

When Skip Test Integration is No, the integration calls:

GET https://api.recordedfuture.com/v2/ip/8.8.8.8?fields=entity

with header X-RFToken: <your-token>. A 200 response confirms the token is valid; 401 or 403 indicates the token is invalid or unauthorized for that module.

Supported Connection Interfaces

  • REST API — call Recorded Future Connect API endpoints (IP, domain, hash, vulnerability, identity, alerts, fusion files, and more) using the configured token as X-RFToken.

Troubleshooting

  • "API token is invalid or unauthorized." — The token has been revoked, mistyped, or lacks access to the IP Intelligence module. Re-issue the token or enable the missing module.
  • Connection / timeout errors — Confirm outbound HTTPS to api.recordedfuture.com is allowed from the autobotAI environment.
  • Need to save credentials before the API is reachable — Toggle Skip Test Integration to Yes, save, then run a test action once connectivity is restored.

References