Recorded Future: Feature - Added Threat hunting commands. Small bug fixes.

[rderkachrf]

Please ensure your pull request (PR) adheres to the following guidelines:

• Please refer to our contributing documentation for any questions on submitting a pull request, link: Contribution Guide

Pull Request Checklist

Please check if your PR fulfills the following requirements:

• [x] Testing of all the changes has been performed (for bug fixes / features)
• [x] The manual_readme_content.md has been reviewed and added / updated if needed (for bug fixes / features)
• [x] Use the following format for the PR description: <App Name>: <PR Type> - <PR Description>
• [x] Provide release notes as part of the PR submission which describe high level points about the changes for the upcoming GA release.
• [x] Verify all checks are passing.
• [x] Do NOT use the next branch of the forked repo. Create separate feature branch for raising the PR.
• [x] Do NOT submit updates to dependencies unless it fixes an issue.

  Pull Request Type

Please check the type of change your PR introduces:

• [ ] New App
• [x] Bugfix
• [x] Feature
• [ ] Code style update (formatting, renaming)
• [ ] Refactoring (no functional changes, no api changes)
• [ ] Documentation
• [ ] Other (please describe):

Security Considerations (REQUIRED)

• [ ] If you are exposing any endpoints using a REST handler, please document them in the manual_readme_content.md.
• [ ] If this is a new connector or you are adding new actions
  • [ ] Please document in the manual_readme_content.md all methods (eg, OAuth) used to authenticate with the service that the connector is integrating with.
  • [ ] If any actions are unable to run on SOAR Cloud, please document this in the manual_readme_content.md.
• [ ] Are you introducing any new cryptography modules? If yes, please elaborate their purpose:
• [x] Are you are accessing the file system? If yes, please verify that you are only accessing paths returned through the Vault API.
• [ ] Are you are marking code to be ignored by Semgrep with nosemgrep? If yes, please provide justification in an additional comment next to the ignored code.

Release Notes (REQUIRED)

In these release several command was added to help with threat hunting.

• links search - find links data in Recorded Future dataset.
• detection rule search - download detection rules (yara, sigma, snort) into the system for provided entity.
• threat actor intelligence - get intelligence data for threat actor.
• threat map - get a threat map from Recorded Future. Changed how Playbook alerts are polled from Recorded Future.

What is the new behavior? (OPTIONAL)

• Changed how Playbook alerts are polled from Recorded Future - On the first poll the creation date is used to poll the alerts and all the next poll the alert that was updated during the time period from the last poll to the current poll time.
• Now the intelligence commands will not fail with the error NotFound but will successfully finish with the message that Recorded future does not have data for that entity.

Screenshots (if relevant)

---

Thanks for contributing!

[splunk-soar-connectors-bot]

Thank you for your submission! We have a total of 16 PRs open right now, and we are working hard on all of them! We will take a look as soon as we can.

[splunk-soar-connectors-bot]

@rderkachrf Static Tests results for commit 2b156a3c39e818ff77dd5ede9ac7a0bfe4380fb6 - https://drive.google.com/file/d/1evSOfjEcPfKe5G6j-rQXekiyYPEFYTzD/view?usp=drivesdk

[splunk-soar-connectors-bot]

@rderkachrf Compile Tests results for commit 2b156a3c39e818ff77dd5ede9ac7a0bfe4380fb6 - https://drive.google.com/file/d/1Zkxm8Cls3jqzyhAXT_zSpV4w_Wm90Pg1/view?usp=drivesdk

[splunk-soar-connectors-bot]

@rderkachrf Static Tests results for commit 6a1239c802198a764dad92d9f74910e6ae5ea8fa - https://drive.google.com/file/d/1LCpRqGliXU_F9GbTfpR30EwOL60C5jEh/view?usp=drivesdk

[splunk-soar-connectors-bot]

@github-actions[bot] Static Tests results for commit 47105e8c9bee76d094e38c793b19171bddd28029 - https://drive.google.com/file/d/1eEMENQzLes24flNGB7LSCZ7w1mCZqBg0/view?usp=drivesdk

[splunk-soar-connectors-bot]

@github-actions[bot] Compile Tests results for commit 47105e8c9bee76d094e38c793b19171bddd28029 - https://drive.google.com/file/d/1UjU46OrGutoCcPJaXrUCsFA5Ei_9uBR0/view?usp=drivesdk

[splunk-soar-connectors-bot]

@rderkachrf Static Tests results for commit 160c1aed8e1f275f7261afb82a7f578d70b972f0 - https://drive.google.com/file/d/1useVwzAeoQ9pn_0i1OZZq0mEGv6f5THr/view?usp=drivesdk

[splunk-soar-connectors-bot]

@github-actions[bot] Static Tests results for commit 9d72f8579ae819075c42eea0320ee02b1f4ef6c8 - https://drive.google.com/file/d/1PpowTckcUEDliAmJ_grq6PS6kHAhI4Mi/view?usp=drivesdk

[splunk-soar-connectors-bot]

@github-actions[bot] Compile Tests results for commit 9d72f8579ae819075c42eea0320ee02b1f4ef6c8 - https://drive.google.com/file/d/1EL76LtjevTWSCFTjEXVumJHNMoapiiqg/view?usp=drivesdk

[splunk-soar-connectors-bot]

@spopat-crest Static Tests results for commit d4cb4d1043f87d7dfe3b568fadb5ff58cf8171dc - https://drive.google.com/file/d/1ELpMvxQCU73xwhwylx4rOpLWirY4ys-X/view?usp=drivesdk

[splunk-soar-connectors-bot]

@spopat-crest Compile Tests results for commit d4cb4d1043f87d7dfe3b568fadb5ff58cf8171dc - https://drive.google.com/file/d/1HBfIT_gaJA2zvo-p0AB8aJMFunwEuYoQ/view?usp=drivesdk

[splunk-soar-connectors-bot]

@spopat-crest Static Tests results for commit 4bbac321263b3f4079fe3b69ba363dc487fcfd2e - https://drive.google.com/file/d/1ynUNinkKk6lZx5bt7d9GHz0ShJBBynO0/view?usp=drivesdk

[splunk-soar-connectors-bot]

@spopat-crest Compile Tests results for commit 4bbac321263b3f4079fe3b69ba363dc487fcfd2e - https://drive.google.com/file/d/1R7W7bkFLwEyggd7wMMbPl0p5hC23IiC9/view?usp=drivesdk