Skip to content

Release History

v.1.4.1 - 2026-07-13

Changed

  • Bump psengine dependencies.

v.1.4.0 - 2026-07-13

Added

  • New -C/--count option for risklist stat to download the risk list and print a table of indicator counts per risk score.

v1.3.1 - 2026-06-30

Changed

  • Bump dependencies.

1.3.0 - 2026-06-15

Added

  • New email enrich sub-command to enrich EML files by extracting header IPs and body URLs, then returning Recorded Future intelligence including risk score, threat actor associations, malware links, and risk rule evidence.
  • New ca export sub-command to export Classic Alerts as full JSON or a summary CSV. Reads alert IDs piped from ca search.
  • New pba export sub-command to export Playbook Alerts as full JSON or a summary CSV. Reads the search results piped from pba search.
  • New -o/--org-id option for pba search to filter Playbook Alerts by owning organisation ID (repeatable).
  • New -o/--overwrite option for list bulk-add to make the list match the supplied entities exactly — adding new entities and removing any currently on the list that were not provided.
  • New list copy sub-command to copy entities from one list to another. Appends by default, or use -o/--overwrite to make the destination mirror the source exactly.
  • Support for using banshee with AI agents, so coding assistants can discover and run the CLI.

Changed

  • list clear now removes entities concurrently (much faster on large lists), matching list bulk-remove: it reports what was removed, grouping output by outcome (REMOVED, and any that could not be removed) and sorting it for readability.
  • list bulk-add now skips entities already on the list instead of attempting to re-add them, reporting them as UNCHANGED. This is a significant speed-up when repeatedly re-running the same input file to add and remove entities.
  • list bulk-add and list bulk-remove now group their output by outcome (ADDED, REMOVED, UNCHANGED) and sort it for readability.
  • ca search and pba search now write progress indicators to stderr, keeping stdout clean for piping into the new export commands.
  • ioc lookup and ioc bulk-lookup pretty output (-p, --pretty) now colour-codes the risk score based on maliciousness.
  • Upgraded PSEngine to ~v2.8.1.

Fixed

1.1.3 - 2026-03-18

Fixed

  • Fixed an issue in pcap enrich where multithreading was not being used in SOAR enrichment. The risk score enrichment is now faster for large captures.

1.1.0 - 2026-03-13

Added

  • New risklist create sub-command to build a custom risk list by merging one or more Recorded Future risk rules into a single deduplicated file. Supports CSV, JSON, and EDL output formats, optional minimum risk score filtering, and direct upload to Recorded Future Fusion.
  • New ioc bulk-lookup sub-command for fast bulk enrichment of IOCs. Batches up to 1,000 indicators per API call and returns risk score and triggered risk rules for each indicator. Supports all IOC types: IP, domain, URL, hash, and vulnerability.
  • pcap enrich JSON output now includes risk rule evidence details which details the specific evidence that caused the risk rule to trigger.

Changed

Fixed

  • Fixed an issue in ioc lookup where multithreading was not being used, causing bulk lookups to run sequentially. Lookups are now up to 20x faster when enriching multiple indicators.
  • Fixed an issue in risklist fetch where the command would fail when parsing unusually large column values in CSV files.
  • Fixed an issue where pcap enrich would fail when parsing empty IOC links.
  • Fixed an issue in list commands where the error cause was not always printed correctly when an API error occurred.

1.0.0 - 2025-12-05

Added

  • New risklist command to download and check metadata for Recorded Future Risk Lists.
  • New rules command to search for and download detection rules (YARA, Snort, Sigma).
  • CVSS v4 field support in ioc search and ioc lookup commands.

Fixed

Changed

  • pcap enrich JSON output now includes risk rule evidence details and all risk rules the IOC triggered.
  • Upgraded PSEngine to v2.4.0.

0.0.5 - 2025-11-12

Fixed

  • Fixed an issue in pcap enrich where the program would exit unexpectedly if no IPs or domains were found in the pcap file.

0.0.4 - 2025-11-07

Added

  • Added support for filtering by alert status in the ca search command.
  • Added support for filtering by entity in the pba search command.
  • Added support for the malware_report category to all pba commands.
  • Pretty output (-p, --pretty) for ioc lookup and ioc search now includes the hash algorithm for hashes.
  • Pretty output (-p, --pretty) for ioc lookup and ioc search now includes the lifecycle stage for vulnerabilities.
  • Added -r/--risk-score option to pcap enrich to filter results by risk score.
  • Added -t/--threat-hunt option to pcap enrich to enable threat hunting.

Changed

  • Optimized field selection for each verbosity level in ioc lookup.
  • Extended ioc search to support verbosity levels 1 through 5 (default is 1).
  • Renamed the pcap analyze sub-command to pcap enrich.
  • pcap enrich now produces a refined JSON output, including a Wireshark-compatible filter query.
  • Upgraded PSEngine to v2.3.0.

Fixed

  • Fixed an issue where ca rules would truncate results at 10 alerting rules.
  • Fixed an error in ioc lookup when an IOC had no evidence details.

Removed

  • Removed interactive TUI output from pba enrich; replaced with pretty output (--pretty, -p).

0.0.3 - 2025-09-02

Added

  • New ca update sub-command to update one or more Classic Alerts.
  • New pba update sub-command to update one or more Playbook Alerts.
  • pba commands now support geopolitics_facility category.
  • Python 3.13 compatibility.
  • tshark version check now enforces minimum version 4.4.5.

Fixed

  • pcap analyze no longer crashes due to version mismatch.
  • Improved exception handling throughout the CLI.

Changed

  • ioc search ENTITY_TYPE IOC now accepts whitespace separatated IOCs, instead of a comma-separated string.
  • pba lookup ALERT_ID -p output formatting improved.
  • ca search --triggered now supports time ranges.
  • ca search -r now accepts multiple rules by repeating -r (e.g. -r rule1 -r rule2), instead of a comma-separated string.
  • Upgraded PSEngine to v2.0.6.

0.0.2 - 2025-02-20

Added

  • New entity command to search and lookup entities
  • New list command to manage Recorded Future Lists & Watch Lists
  • New ioc rules sub-command to search and filter IOC rules
  • New --debug option for enhanced troubleshooting

Changed

  • Sub-command ioc lookup option -v now allows the user to pick a level of verbosity (from 1 to 5)
  • Sub-command ioc lookup now requires an entity type as an argument, for example banshee ioc lookup ip 8.8.8.8
  • Sub-command ca lookup now returns a refined pretty alert
  • PSEngine upgraded to v2.0.2

0.0.1 - 2024-09-01

Added

  • Beta release

🚀 Brought to you by the Cyber Security Engineers at Recorded