Skip to content

Entity Match

Introduction

The EntityMatchMgr class of the entity_match module allows to search for the Recorded Future ID of an entity.

See the API Reference for internal details of the module.

Notes

In this module the match and resolve_entity_id method are very similar. match will return a list of all the possible matches, while the resolve_entity_id is more strict, it will return a single match.

Specifying the type of the entity leads to better results.

Examples

Warning

Below are some examples of usage of the module. Consider adding error handling as necessary. All the errors that can be raised by each method or function are specified in the API Reference page.

Also, you need to configure the RF_TOKEN environment variable before starting. See Learn.

Example 1: Find the ID of CVE-2022-0847

In this example we use the resolve_entity_id method to find the ID of the CVE. Since this method always return a single result, we only need to check if the is_found attribute has been set to True. If it is, we print the id_ of the entity which is in the content attribute.

1
2
3
4
5
6
7
8
9
from psengine.entity_match import EntityMatchMgr

CVE = 'CVE-2022-0847'

mgr = EntityMatchMgr()
entity = mgr.resolve_entity_id(CVE, 'CyberVulnerability')

if entity.is_found:
    print(entity.content.id_)

Example 2: Find which entity has ID b89Juu and print its name

In this example we use the lookup method to find the entity from the ID. In case of entity not found, the method will return None hence why we use the if before printing the attribute name.

1
2
3
4
5
6
7
8
from psengine.entity_match import EntityMatchMgr

ID = 'b89Juu'
mgr = EntityMatchMgr()

entity = mgr.lookup(ID)
if entity:
    print(entity.attributes.name)