Command Line Reference &para;

Entity type to lookup

Supported values: ip, domain, url, hash, vulnerability

IOC

One or more whitespace separated IOC to lookup

Options

--ai-insights, -a

Enable AI-generated insights from Recorded Future that summarize relevant risk rules and key references.

Note: Response times may be slightly longer due to AI processing.

--verbosity, -v verbosity-level

Controls the amount of data returned in the response (1-5). Higher verbosity levels include additional fields and details in the JSON output.

Note: Higher verbosity levels may result in slower response times due to increased data retrieval.

Defaults to 1

Available Fields by Verbosity Level

ip:

1: entity, risk, timestamps
2: entity, intelCard, location, risk, timestamps
3: analystNotes, entity, intelCard, links, location, risk, timestamps
4: analystNotes, enterpriseLists, entity, intelCard, links, location, risk, riskMapping, sightings, threatLists, timestamps
5: analystNotes, dnsPortCert, enterpriseLists, entity, intelCard, links, location, risk, riskMapping, scanner, sightings, threatLists, timestamps

domain:

1: entity, risk, timestamps
2: entity, intelCard, risk, timestamps
3: analystNotes, entity, intelCard, links, risk, timestamps
4: analystNotes, enterpriseLists, entity, intelCard, links, risk, riskMapping, sightings, threatLists, timestamps
5: analystNotes, enterpriseLists, entity, intelCard, links, risk, riskMapping, sightings, threatLists, timestamps

url:

1: entity, risk, timestamps
2: entity, intelCard, risk, timestamps
3: analystNotes, entity, intelCard, links, risk, timestamps
4: analystNotes, enterpriseLists, entity, intelCard, links, risk, riskMapping, sightings, timestamps
5: analystNotes, enterpriseLists, entity, intelCard, links, risk, riskMapping, sightings, timestamps

hash:

1: entity, hashAlgorithm, risk, timestamps
2: entity, fileHashes, hashAlgorithm, intelCard, risk, timestamps
3: analystNotes, entity, fileHashes, hashAlgorithm, intelCard, links, risk, timestamps
4: analystNotes, enterpriseLists, entity, fileHashes, hashAlgorithm, intelCard, links, risk, riskMapping, sightings, threatLists, timestamps
5: analystNotes, enterpriseLists, entity, fileHashes, hashAlgorithm, intelCard, links, risk, riskMapping, sightings, threatLists, timestamps

vulnerability:

1: entity, lifecycleStage, risk, timestamps
2: entity, intelCard, lifecycleStage, risk, timestamps
3: analystNotes, entity, intelCard, lifecycleStage, links, risk, timestamps
4: analystNotes, cvss, cvssv3, cvssv4, enterpriseLists, entity, intelCard, lifecycleStage, links, risk, riskMapping, sightings, threatLists, timestamps
5: analystNotes, cpe, cpe22uri, cvss, cvssv3, cvssv4, enterpriseLists, entity, intelCard, lifecycleStage, links, nvdDescription, nvdReferences, risk, riskMapping, sightings, threatLists, timestamps

--pretty, -p

Pretty print the results in a human readable format

--help, -h

Show help for this command

Example Usage


banshee ioc lookup ip 139.224.189.177
banshee ioc lookup domain overafazg.org
banshee ioc lookup ip 8.140.135.23 -v 3
banshee ioc lookup ip 8.140.135.23,139.224.189.177 -p

Pipe a comma or newline separated list of IOCs to lookup:


cat test_ips.csv| banshee ioc lookup ip -p

banshee ioc bulk-lookup¶

Fast bulk enrichment for any number of IOCs of a single type. The command batches up to 1000 IOCs per API call and handles batching automatically, making it significantly faster than banshee ioc lookup for large volumes.

Returns a fixed set of fields per indicator: risk score and triggered risk rules. Use this for high-volume triage.

By default the command will print the results in JSON format.

Usage

1	`banshee ioc bulk-lookup [OPTIONS] ENTITY_TYPE IOC...`

Arguments

Entity type to enrich

Supported values: ip, domain, url, hash, vulnerability

IOC

One or more whitespace separated IOCs to enrich. Also accepts input from stdin (see examples below).

Options

--pretty, -p: Pretty print the results in a human readable format
--help, -h: Show help for this command

Example Usage


banshee ioc bulk-lookup ip 92.38.178.133 203.0.113.17
banshee ioc bulk-lookup domain overafazg.org coolbeans.org -p
banshee ioc bulk-lookup hash e3f236e4aeb73f8f8f0caebe46f53abbb2f71fa4b266a34ab50e01933709e877

File / Stdin Input

Pipe or redirect a newline-separated file of IOCs (one per line):

> cat cves.txt
CVE-2012-4792
CVE-2011-0611
CVE-2013-0422
CVE-2021-22204
CVE-2016-4557


banshee ioc bulk-lookup vulnerability < cves.txt
cat cves.txt | banshee ioc bulk-lookup vulnerability

Extract Names and Scores

Use jq to extract specific fields from the JSON output, for example:


banshee ioc bulk-lookup vulnerability CVE-2021-22204 CVE-2016-4557 | jq '[.[] | {ioc: .entity.name, risk_score: .risk.score}]'

banshee ioc search¶

Search for Classic Alerts.

By default the command will print the results in JSON format.

Usage

1	`banshee ioc search [OPTIONS] ENTITY_TYPE`

Arguments

Entity type to lookup

Supported values: ip, domain, url, hash, vulnerability

Options

--limit, -l limit

Limit the number of results

The maximum limit is 1000

Defaults to 5

--risk-score, -r risk-score

Filter by risk score range, for example:

--risk-score '[20,90]' → same as 20 <= riskScore <= 90
--risk-score '(20,90)' → same as 20 < riskScore < 90
--risk-score '[20,90)' → same as 20 <= riskScore < 90
--risk-score '[20,)' → same as 20 <= riskScore
--risk-score '[,90)' → same as riskScore < 90

Surround the risk score range with quotes to ensure correct parsing

--risk-rule, -R rule-name

Filter by risk rule name

For available options refer to this support article, specifically the Machine Name column in the risk rules tables, or use the banshee ioc rules command

--verbosity, -v verbosity-level

Controls the amount of data returned in the response (1-5). Higher verbosity levels include additional fields and details in the JSON output.

Note: Higher verbosity levels may result in slower response times due to increased data retrieval.

Defaults to 1

Available Fields by Verbosity Level

ip:

1: entity, risk, timestamps
2: entity, intelCard, location, risk, timestamps
3: analystNotes, entity, intelCard, links, location, risk, timestamps
4: analystNotes, enterpriseLists, entity, intelCard, links, location, risk, riskMapping, sightings, threatLists, timestamps
5: analystNotes, dnsPortCert, enterpriseLists, entity, intelCard, links, location, risk, riskMapping, scanner, sightings, threatLists, timestamps

domain:

1: entity, risk, timestamps
2: entity, intelCard, risk, timestamps
3: analystNotes, entity, intelCard, links, risk, timestamps
4: analystNotes, enterpriseLists, entity, intelCard, links, risk, riskMapping, sightings, threatLists, timestamps
5: analystNotes, enterpriseLists, entity, intelCard, links, risk, riskMapping, sightings, threatLists, timestamps

url:

1: entity, risk, timestamps
2: entity, intelCard, risk, timestamps
3: analystNotes, entity, intelCard, links, risk, timestamps
4: analystNotes, enterpriseLists, entity, intelCard, links, risk, riskMapping, sightings, timestamps
5: analystNotes, enterpriseLists, entity, intelCard, links, risk, riskMapping, sightings, timestamps

hash:

1: entity, hashAlgorithm, risk, timestamps
2: entity, fileHashes, hashAlgorithm, intelCard, risk, timestamps
3: analystNotes, entity, fileHashes, hashAlgorithm, intelCard, links, risk, timestamps
4: analystNotes, enterpriseLists, entity, fileHashes, hashAlgorithm, intelCard, links, risk, riskMapping, sightings, threatLists, timestamps
5: analystNotes, enterpriseLists, entity, fileHashes, hashAlgorithm, intelCard, links, risk, riskMapping, sightings, threatLists, timestamps

vulnerability:

1: entity, lifecycleStage, risk, timestamps
2: entity, intelCard, lifecycleStage, risk, timestamps
3: analystNotes, entity, intelCard, lifecycleStage, links, risk, timestamps
4: analystNotes, cvss, cvssv3, cvssv4, enterpriseLists, entity, intelCard, lifecycleStage, links, risk, riskMapping, sightings, threatLists, timestamps
5: analystNotes, cpe, cpe22uri, cvss, cvssv3, cvssv4, enterpriseLists, entity, intelCard, lifecycleStage, links, nvdDescription, nvdReferences, risk, riskMapping, sightings, threatLists, timestamps

--pretty, -p

Pretty print the results in a human readable format

--help, -h

Show help for this command

banshee ioc rules¶

Search for IOC rules for a given entity type.

By default the command will print the results in JSON format.

Usage

1	`banshee ioc rules [OPTIONS] ENTITY_TYPE`

Arguments

Entity type of the IOC rules

Supported values: ip, domain, url, hash, vulnerability

Options

--freetext, -F freetext-rule-name

Filter by risk rule name using freetext search

--mitre-code, -M mitre-code

Filter by MITRE ATT&CK code

--criticality, -C criticality

Filter by criticality. Higher the value, higher the criticality

Accepted values are from 1 to 5

Criticality Levels (IP, Domain, URL, Hash)

4 – Very Malicious (Risk Score band: 90–99)
3 – Malicious (Risk Score band: 65–89)
2 – Suspicious (Risk Score band: 25–64)
1 – Unusual (Risk Score band: 5–24)
0 – No evidence of risk (Risk Score band: 0)

Criticality Levels (Vulnerability)

5 – Very Critical (Risk Score band: 90–99)
4 – Critical (Risk Score band: 80–89)
3 – High (Risk Score band: 65–79)
2 – Medium (Risk Score band: 25–64)
1 – Low (Risk Score band: 5–24)
0 – No evidence of risk (Risk Score band: 0)

--pretty, -p

Pretty print the results in a human readable format

--help, -h

Show help for this command

banshee list¶

Manage Recorded Future lists and Watch lists

Usage

1	`banshee list [OPTIONS] COMMAND [ARGS]...`

banshee list create: Create a new list
banshee list info: Get basic information about a list
banshee list search: Search for lists
banshee list status: Get the status of a list
banshee list entities: Get the entities in a list
banshee list add: Add an entity to a list
banshee list bulk-add: Bulk add entities to a list
banshee list remove: Remove an entity from a list
banshee list bulk-remove: Bulk remove entities from a list
banshee list clear: Clear all entities from a list
banshee list entries: Get text entries from a list

banshee list create¶

Create a new list.

By default the command will print the results in JSON format.

Usage

1	`banshee list create [OPTIONS] NAME [LIST_TYPE]`

Arguments

NAME

List name to create

LIST_TYPE

List type to create

Supported types are:

entity
source
text

Defaults to entity

Options

--pretty, -p: Pretty print the results in a human readable format
--help, -h: Show help for this command

banshee list info¶

Get information about a list, such as name, type, timestamps and owner details.

By default the command will print the results in JSON format.

Usage

1	`banshee list info [OPTIONS] LIST_ID`

Arguments

List ID to get information about

List ID can be supplied with and without the 'report:' prefix

Options

--pretty, -p: Pretty print the results in a human readable format
--help, -h: Show help for this command

banshee list search¶

Search for lists

By default the command will print the results in JSON format.

Usage

1	`banshee list search [OPTIONS] LIST_ID`

Arguments

NAME

List name to search for

Not specifying a name will return all lists

Options

--list-type, -t list-type

Filter by list type

Supported types:

entity
source
text
custom
ip
domain
tech_stack
industry
brand
partner
industry_peer
location
supplier
vulnerability
company
hash
operation
attacker
target
method
executive

--limit, -l limit

Limit the number of results

The maximum limit is 3 000

Defaults to 1 000

--pretty, -p

Pretty print the results in a human readable format

--help, -h

Show help for this command

banshee list status¶

Get list status and number of entities.

By default the command will print the results in JSON format.

Usage

1	`banshee list status [OPTIONS] LIST_ID`

Arguments

List ID to get the status of

List ID can be supplied with and without the 'report:' prefix

Options

--pretty, -p: Pretty print the results in a human readable format
--help, -h: Show help for this command

banshee list entities¶

Get entities on the list

By default the command will print the results in JSON format.

Usage

1	`banshee list entities [OPTIONS] LIST_ID`

Arguments

List ID to fetch entities from

List ID can be supplied with and without the 'report:' prefix

Options

--pretty, -p: Pretty print the results in a human readable format
--help, -h: Show help for this command

banshee list entries¶

Get text entries on the list

By default the command will print the results in JSON format.

Usage

1	`banshee list entries [OPTIONS] LIST_ID`

Arguments

List ID to fetch text entries from

List ID can be supplied with and without the 'report:' prefix

Options

--pretty, -p: Pretty print the results in a human readable format
--help, -h: Show help for this command

banshee list clear¶

Fully clear the list and remove all entities. Please note this command will not clear text entries and is not supported.

Usage

1	`banshee list clear [OPTIONS] LIST_ID`

Arguments

List ID to clear

List ID can be supplied with and without the 'report:' prefix

Options

--help, -h: Show help for this command

banshee list add¶

Add an entity to the list.

Usage

1	`banshee list add [OPTIONS] LIST_ID ENTITY_ID [PROPERTIES]`

Arguments

List ID to add to

List ID can be supplied with and without the 'report:' prefix

Entity ID or name with type to add to the list, for example:

SoA6SP
wannacry,malware
www.duckdns.org,InternetDomainName

PROPERTIES

Optional properties to set on the entity

Properties can be supplied as key=value pairs, for example: type=malware,cool=beans,another=value

Options

--help, -h: Show help for this command

banshee list bulk-add¶

Add multiple entities to a list

Usage

1	`banshee list bulk-add [OPTIONS] LIST_ID ENTITY_INPUT...`

Arguments

List ID to add to

List ID can be supplied with and without the 'report:' prefix

One or more space/newline separated entities, for example:

SoA6SP
wannacry,malware
www.duckdns.org,InternetDomainName

The command also accepts input from stdin. Assume 'entities.txt' is a newline separated file of entities, for example:


    $ cat entities.txt
    verifyaccount.otzo.com,InternetDomainName
    92.38.178.133,IpAddress
    https://constructorachg.cl/eFSLb6eV/j.html,URL
    CVE-2019-1215,CyberVulnerability
    e3f236e4aeb73f8f8f0caebe46f53abbb2f71fa4b266a34ab50e01933709e877,Hash
    SoA6SP
    lYNvCK

Considering the above you could then run one of the following commands to bulk add the entities:


    $ banshee list bulk-add LIST_ID < entities.txt
    $ cat entities.txt | banshee list bulk-add LIST_ID

Options

--help, -h: Show help for this command

banshee list remove¶

Remove an entity from the list.

Usage

1	`banshee list remove [OPTIONS] LIST_ID ENTITY_ID`

Arguments

List ID to remove from

List ID can be supplied with and without the 'report:' prefix

Entity ID to remove from the list

Options

--help, -h: Show help for this command

banshee list bulk-remove¶

Remove multiple entities from a list

Usage

1	`banshee list bulk-remove [OPTIONS] LIST_ID ENTITY_INPUT...`

Arguments

List ID to remove from

List ID can be supplied with and without the 'report:' prefix