# PS Banshee

> A Recorded Future CLI for terminal-based threat intelligence investigations.

Full single-file bundle (every command group inlined): <https://recordedfuture-professionalservices.github.io/ps-banshee/latest/llms-full.txt>

Set `RF_TOKEN` in the shell environment before invoking any command.

**Alerts:** Recorded Future has two distinct alert systems. Use `ca` for Classic Alerts - legacy rule-based alerts with short opaque IDs (6+ chars, e.g. `tybakN`). Use `pba` for Playbook Alerts - automation-driven alerts with 36-char UUID IDs (the `task:` prefix is optional; `pba search` returns them with the prefix). Categories exclusive to PBA: `domain_abuse`, `cyber_vulnerability`, `third_party_risk`, `code_repo_leakage`, `identity_novel_exposures`, `geopolitics_facility`, `malware_report`. If the user gives you an alert ID, pick the group by ID length; if they describe the category, the categories above route to `pba`.


## Commands

- [Banshee CLI Knowledge Base](https://recordedfuture-professionalservices.github.io/ps-banshee/latest/1.4/knowledge-base/index.md): Authentication, readiness checks, output conventions, and shared LLM notes for the CLI.
- [ca](https://recordedfuture-professionalservices.github.io/ps-banshee/latest/1.4/knowledge-base/ca/index.md): Classic Alerts (legacy rule-based, short opaque IDs of 6+ chars like `tybakN`). Search, lookup, update, export.
- [email](https://recordedfuture-professionalservices.github.io/ps-banshee/latest/1.4/knowledge-base/email/index.md): Enrich EML files with RF intelligence.
- [entity](https://recordedfuture-professionalservices.github.io/ps-banshee/latest/1.4/knowledge-base/entity/index.md): Entity search and lookup.
- [ioc](https://recordedfuture-professionalservices.github.io/ps-banshee/latest/1.4/knowledge-base/ioc/index.md): IOC enrichment, bulk enrichment, search, rules.
- [list](https://recordedfuture-professionalservices.github.io/ps-banshee/latest/1.4/knowledge-base/list/index.md): Manage RF Lists & Watch Lists (create, add/remove entities, entries).
- [pba](https://recordedfuture-professionalservices.github.io/ps-banshee/latest/1.4/knowledge-base/pba/index.md): Playbook Alerts (36-char UUID IDs, `task:` prefix optional; PBA-exclusive categories: domain_abuse, cyber_vulnerability, third_party_risk, code_repo_leakage, identity_novel_exposures, geopolitics_facility, malware_report). Search, lookup, update, export.
- [pcap](https://recordedfuture-professionalservices.github.io/ps-banshee/latest/1.4/knowledge-base/pcap/index.md): Enrich packet captures with RF intelligence.
- [risklist](https://recordedfuture-professionalservices.github.io/ps-banshee/latest/1.4/knowledge-base/risklist/index.md): Fetch, create, and inspect risk lists.
- [rules](https://recordedfuture-professionalservices.github.io/ps-banshee/latest/1.4/knowledge-base/rules/index.md): Search and download detection rules (Sigma, YARA, Snort).

## Optional

- [Installation](https://recordedfuture-professionalservices.github.io/ps-banshee/latest/1.4/getting-started/installation/index.md): Install the ps-banshee CLI and set RF_TOKEN authentication.
- [Using with AI agents](https://recordedfuture-professionalservices.github.io/ps-banshee/latest/1.4/getting-started/llms/index.md): Wire banshee into an AI agent (CLAUDE.md / AGENTS.md) and authenticate.
- [PS Banshee use cases overview](https://recordedfuture-professionalservices.github.io/ps-banshee/latest/1.4/usecases/index.md): Worked, end-to-end use-case walkthroughs (alerts, enrichment, risk lists, etc.).