Skip to content

Links

Introduction

The LinksMgr class of the links module allows you to search for technically validated relationships between threat intelligence entities in the Recorded Future Intelligence Cloud — connections established through sandbox analysis, infrastructure analysis, network traffic analysis, and Insikt Group research.

See the API Reference for internal details of the module.

Notes

The search method expects Recorded Future entity IDs (for example, QCwdoU), not entity names. If you only have a name, use the entity_match module first to resolve the ID.

The response is batched: you get one result per input entity. A specific entity can fail while others succeed, so always check result.error before iterating over result.links.

For filters such as sections, events, and entity types, use the metadata methods (list_sections, list_events, and list_entity_types) to retrieve valid IDs before calling search.

Examples

Warning

The following examples demonstrate how to use this module. Be sure to add appropriate error handling as needed; all possible errors for each method or function are listed in the API Reference page.

Additionally, you must configure the RF_TOKEN environment variable before getting started. For instructions, see Learn.

In this example, we call search with a single entity ID. For each result, we first check result.error. If there is no error, we print the source entity and the first 5 linked entities returned by the API.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
from psengine.links import LinksMgr

mgr = LinksMgr()

results = mgr.search(entities='QCwdoU')

for result in results:
    if result.error:
        print(f'Failed: {result.error.message}')
        continue

    entity = result.entity
    print(f'Entity: {entity.name}')

    for link in result.links[:5]:
        print(f'  -> {link.name} source: {link.source}')

The output will be:

1
2
3
4
5
6
Entity: Lazarus Group
  -> CVE-2022-47966 source: insikt
  -> 24988feb1b38f400069acec4514aa4deea3f6ca8ceb5296f54926e2b22af1e5a source: insikt
  -> 36db27f5eb3343cfc72d261d78da44957a49cb6731acb50a96ea5694f4d616c5 source: insikt
  -> ffec6e6d4e314f64f5d31c62024252abde7f77acdd63991cb16923ff17828885 source: insikt
  -> 3e5fd9acdab438ffc8b2cce48c91679d3f980d08f9dea47d5e1039d352cd64fb source: insikt

In this example, we pass filter and limit arguments directly to search (for example sources, entity_types, timeframe, search_scope, and per_entity_type) to narrow results to technical malware links seen in the last 90 days and cap result size per entity type.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
from psengine.links import LinksMgr

mgr = LinksMgr()

results = mgr.search(
    entities='I60vfZ',
    sources='technical',
    entity_types='type:Malware',
    timeframe='-90d',
    search_scope='small',
    per_entity_type=50,
)

for result in results:
    if result.error:
        print(f'Failed: {result.error.message}')
        continue

    for link in result.links:
        print(f'{link.name} ({link.type_})')

Each item returned by LinksMgr.search() is an EntityLinks object. After checking result.error, you can use helper methods to extract common subsets from result.links:

  • result.iocs(): returns linked IOCs grouped by IOC type (type:InternetDomainName, type:CyberVulnerability, type:IpAddress, type:Hash, type:Url). Each IOC item includes id, type, name, risk_score, and source.
  • result.ttps(): returns linked MITRE ATT&CK techniques (type:MitreAttackIdentifier). Each item includes id, type, name, display_name, and source.
  • result.malwares(): returns linked malware entities (type:Malware) with id, type, name, and source.
  • result.threat_actors(): returns linked organizations (type:Organization) that are marked as threat actors through the threat_actor attribute.
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
from psengine.links import LinksMgr

mgr = LinksMgr()

results = mgr.search(entities=['QCwdoU'])

for result in results:
    if result.error:
        print(f'Failed: {result.error.message}')
        continue

    print(f'Entity: {result.entity.name}')

    print('\nIOCs grouped by type:')
    for ioc_type, iocs in result.iocs().items():
        print(f'  {ioc_type}: {len(iocs)}')
        for ioc in iocs[:3]:
            print(
                f'    - {ioc.name} score:{ioc.risk_score}'
            )

    print('\nTTPs:')
    for ttp in result.ttps()[:5]:
        print(f'  - {ttp.name} ({ttp.display_name})')

    print('\nMalwares:')
    for malware in result.malwares()[:5]:
        print(f'  - {malware.name}')

    print('\nThreat actors:')
    for threat_actor in result.threat_actors()[:5]:
        print(f'  - {threat_actor.name}')

This will output:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
Entity: Lazarus Group

IOCs grouped by type:
  type:CyberVulnerability: 5
    - CVE-2022-47966 score:99
    - CVE-2019-3396 score:89
    - CVE-2022-0609 score:79
  type:Hash: 1273
    - c8706a586afa880fbf23ce662b7fc2925fd0384b8cde0a40f3c00a182c5a3d06 score:89
    - 9ab05d771d6face27502052af8e3a945ad66e3c6726a2dda637fa12641e2bca2 score:89
    - 084f904249f8655e925b4b330426df6b979cd3f630f7765dac405f2144755738 score:89
  type:InternetDomainName: 144
    - calendly.live score:74
    - pypilibrary.com score:72
    - test-wolf.com score:69
  type:IpAddress: 29
    - 172.96.137.224 score:55
    - 103.231.75.101 score:38
    - 23.27.140.49 score:32

TTPs:
  - T1082 (T1082 (System Information Discovery))
  - T1071 (T1071 (Application Layer Protocol))
  - TA0010 (TA0010 (Exfiltration))
  - T1027 (T1027 (Obfuscated Files or Information))
  - T1497.001 (T1497.001 (Virtualization/Sandbox Evasion: System Checks))

Malwares:
  - CIPHERROCKET
  - QuiteRAT
  - PondRAT
  - Trickbot
  - NukeSped