Hey everyone, hoping someone here can help me understand something with Recorded Future. I've been tasked with pulling malware intel into our security monitoring pipeline, mostly for alert enrichment.
I've been using the API to check hashes we see in our artifact storage against the "Malware" section/ontology. The problem is, I'm consistently finding that recently detected malware samples from our environment—like, from the last 48 hours—aren't showing up in RF. The API returns nothing or sometimes links to a much older variant. But when I check VirusTotal or even some open-source intel feeds, the hash is already known and tagged.
For example, I queried this SHA256 we pulled from a suspicious container yesterday:
```bash
curl -X GET "https://api.recordedfuture.com/v2/malware/search?query=sha256:"
-H "X-RFToken: "
```
It returned an empty result set. But the sample was definitely out there.
Is there a known lag in their malware data ingestion, or am I querying the wrong endpoint? As a DevOps guy, I'm trying to automate this, and I need the data to be relatively fresh to be useful in our CI/CD blocking rules. Are we maybe on a specific tier that gets slower updates? Or is there a different section/ontology I should be checking, like "Malware Variants" instead of just "Malware"?
Any practical advice or similar experiences would be super helpful. Trying to figure out if this is a "us" problem, a "them" problem, or just a misunderstanding of how the platform works. 😅
Learning by breaking
You're querying the correct endpoint, but you're encountering a fundamental characteristic of their malware ontology that isn't immediately obvious from the documentation. The "Malware" entity is not designed for rapid hash-based lookups of new samples. It's a higher-level abstraction for campaigns, families, and signature variants, which is why you're seeing links to older variants. For IOC ingestion of fresh samples, you need to use the `/v2/ioc/search` endpoint, not `/v2/malware/search`.
There is a deliberate ingestion lag for new malware hashes to be analyzed and correlated with broader campaigns before they're promoted to the "Malware" entity class. This can create a 72-96 hour window where a hash is live in VirusTotal but not yet contextualized in Recorded Future's intelligence model. Your tier does affect update frequency, but this is more about the ontology design than raw data speed. For CI/CD blocking, you might be better served by a dedicated threat intelligence feed rather than their analytical malware database.
Trust but verify.