Skip to content

PS Banshee

Recorded Future Logo

PS Banshee is a command-line tool for fast, efficient access to Recorded Future Intelligence, built for security professionals and SOC teams.

Welcome to PS Banshee!

Powered by PSEngine

PS Banshee is powered by the PSEngine library.

Key Features

  • E-mail (EML) enrichment
  • IOC lookup and search
  • Packet capture (pcap) enrichment
  • Recorded Future Alert search, lookup, update and export
  • Recorded Future Detection Rules (YARA, Snort, Sigma) search and download
  • Recorded Future Entity search and lookup
  • Recorded Future List & Watch List management
  • Recorded Future Playbook Alert search, lookup, update and export
  • Recorded Future Risk List download, and creation

Installation

PS Banshee is available on PyPI and can be installed using pip or pipx.

PS Banshee requires Python 3.10 or later (up to 3.13).

To install globally, run:

1
pipx install ps-banshee

Installing pipx

If you don't have pipx installed, see the installation guide.

Alternative: pip (current environment)

To install in the current environment, run: 

1
pip install ps-banshee

Dependencies

All required Python dependencies are resolved automatically by pipx.
To use the pcap command, ensure you have:

  • tshark 3.0.0 or later

Command Auto Completion

After installing PS Banshee, enable command auto completion with:

1
banshee --install-completion

Restart your shell to complete the installation. You can now use TAB to auto-complete commands.

Documentation

To view available commands, just run:

1
banshee

Authorization

PS Banshee reads your Recorded Future API key from the RF_TOKEN environment variable (recommended) or from the -k / --api-key flag on each command.

Current shell only:

1
export RF_TOKEN=<your_api_key>

Persist for future shells (zsh — adjust to ~/.bashrc for bash). Open a new shell after running this (or run source ~/.zshrc to apply in the current shell):

1
echo 'export RF_TOKEN=<your_api_key>' >> ~/.zshrc

Current session only:

1
$env:RF_TOKEN = '<your_api_key>'

Persist for future sessions (open a new PowerShell after running this):

1
setx RF_TOKEN <your_api_key>

Current session only:

1
set RF_TOKEN=<your_api_key>

Persist for future sessions (open a new Command Prompt after running this):

1
setx RF_TOKEN <your_api_key>

Option 2: Pass with -k per command

1
banshee -k <your_api_key> <command> <sub-command> <arguments>

This works on any platform, but is more verbose and the key may land in shell history.

Proxies

If you are behind a proxy, set the HTTP_PROXY and HTTPS_PROXY environment variables.

To disable SSL verification, use the -s flag:

1
banshee -s ca rules

Next steps

Get started using PS Banshee now!