It's terribly inefficient to request uncompressed CSV data from the API. The integration sets gzip=false. As a result the integration transfers 114M when it could transfer 8.3M. If the httpjson input can accept it then we should switch to gzip=true.

-rw-r--r--    1 akroh  staff   114M Apr 26 22:06 hash.csv
-rw-r--r--    1 akroh  staff   8.3M Apr 26 22:07 hash.csv.gz

A system test should be added. And we should run a test against the real API.

References

• https://docs.recordedfuture.com/reference/domain-risk-list