This workflow template offers a robust solution for analyzing domain reputations using Recorded Future's API. Designed primarily for threat intelligence enrichment, it efficiently checks for previously cached domain reputation information within a 24-hour period before querying Recorded Future. If cached data exists, it’s quickly returned; otherwise, the template obtains fresh analysis summaries and preserves them for subsequent requests, optimizing both speed and resource usage during threat assessment processes.
Optional Triggers
"This workflows is intended to be used as a function."
Use Cases
Function, Threat Intelligence Enrichment
Workflow Breakdown
Trigger the workflow and provide a domain.
Lookup global variables to see if domain's reputation has been saved in the past 24 hours.
If reputation is found on local cache, the saved data is returned to the parent workflow.
When no reputation is found cached, a summary of the analysis data is created and saved with the original api data.
Vendors
Utils, Recorded Future, Torq
Workflow Output
Returns full analysis data and a summary of the information.
Tips
Set \"Provide Raw Data Analysis\" to true or false to add or remove original vendor information to the output