Versions Compared

Old Version 21

changes.mady.by.user Juan Tomás Alonso Nieto (Deactivated)

Saved on

compared with

New Version 22

changes.mady.by.user Juan Tomás Alonso Nieto (Deactivated)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

To run this collector, there are some configurations detailed below that you need to take into account.

Configuration

Details

Recorded Future API key

Generate your API token.

Info

Refer to the Vendor setup section to know more about these configurations.

...

Note

Recorded Future also charges customers for each integration they use. For example, a mutual customer of Recorded Future and Devo using this integration will pay Recorded Future a subscription fee.

Devo collector features

Feature

Details

Allow parallel downloading (multipod)

  • Not allowed

Running environments

  • Collector server

  • On-premise

Populated Devo events

  • Lookups

Flattening Preprocessing

  • No

Data sources

Data Source

Description

API Endpoint

Collector service name

Devo Table

Available from release

IpAddressLookupPuller

This endpoint provides a list of IPs classified as Threat by Recorded Future.

https://api.recordedfuture.com/v2/ip/risklist?format=csv%2Fsplunk

lookup_puller

type: ip

Lookup

my.lookuplist.Recorded_Future_IPv4_Address_Threat_List

my.lookuplist.Recorded_Future_IPv6_Address_Threat_List

v1.0.0

DomainLookupPuller

This endpoint provides a list of domains classified as Threat by Recorded Future.

https://api.recordedfuture.com/v2/domain/risklist?format=csv%2Fsplunk

lookup_puller

type: domain

Lookup

my.lookuplist.Recorded_Future_Domain_Threat_List

v1.0.0

FileHashLookupPuller

This endpoint returns a list of file hashes classified as Threat by Recorded Future.

https://api.recordedfuture.com/v2/hash/risklist?format=csv%2Fsplunk

lookup_puller

type: hash

Lookup

my.lookuplist.Recorded_Future_File_Hash_Threat_List

v1.0.0

UrlLookupPuller

This endpoint returns a list of URL classified as Threat by Recorded Future.

https://api.recordedfuture.com/v2/url/risklist?format=csv%2Fsplunk

lookup_puller

type: url

Lookup

my.lookuplist.Recorded_Future_URL_Threat_List

v1.0.0

VulnerabilityLookupPuller

This endpoint returns a list of vulnerabilities classified as Threat by Recorded Future.

https://api.recordedfuture.com/v2/vulnerability/risklist?format=csv%2Fsplunk

lookup_puller

type: vulnerability

Lookup

my.lookuplist.Recorded_Future_Vulnerability_Threat_List

v1.0.0

PublicUkraineRussiaIpsLookupPuller

This endpoint returns a list of IPs related with Russia and Ukraine.

https://api.recordedfuture.com/v2/fusion/files/?path=/public/ukraine/ukraine_russia_ip.csv

lookup_puller

type: PublicUkraineRussiaIps

Lookup

my.lookuplist.Recorded_Future_IPv4_Public_Ukranie_Russia_List

my.lookuplist.Recorded_Future_IPv6_Public_Ukranie_Russia_List

v1.2.0

Vendor setup

There are some minimal requirements to enable this collector:

  • Login on Recorded Future

  • Create a new token

Action

Steps

Login on Recorded Future

Create a new token

  • Click on Menu and select the option User Settings.

  • Select the API Access tab.

  • To create a new API token, click on Generate New API Token.

  • Enter a name for the token.

  • Select Devo from the integration list.

  • Click on the Generate new API token button.  

  • Make a note of the token value, as this is required for the Ingest Configuration.

Minimum configuration required for basic pulling

...

Info

This minimum configuration refers exclusively to those specific parameters of this integration. There are more required parameters related to the generic behavior of the collector. Check setting sections for details.

Setting

Details

url_value

This param refers to the endpoint used by the collector to pull data.

api_token_value

This is the access token provided by Recorded Future.

list_of_sources

This configuration allows you to define what data sources will be pulled.

Info

See the Accepted authentication methods section to verify what settings are required based on the desired authentication method.

Accepted authentication methods

Authentication Method

Token

Token

Status
colourGreen
titleREQUIRED

Run the collector

Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector), or deploy and host the collector in your own machine using a Docker image (On-premise collector).

...

Expand
titleEnable/disable the logging debug mode

Sometimes it is necessary to activate the debug mode of the collector's logging. This debug mode increases the verbosity of the log and allows you to print execution traces that are very helpful in resolving incidents or detecting bottlenecks in heavy download processes.

  • To enable this option you just need to edit the configuration file and change the debug_status parameter from false to true and restart the collector.

  • To disable this option, you just need to update the configuration file and change the debug_status parameter from true to false and restart the collector.

For more information, visit the configuration and parameterization section corresponding to the chosen deployment mode.

Change log

Release

Released on

Release type

Details

Recommendations

v1.0.2

Status
colourGreen
titleFEATURES

Initial release with the following Recorded Future Threat List default data sources:

  • IPs

  • Domains

  • URLs

  • File Hashes

  • Vulnerabilities

Upgrade to v1.2.0

v1.1.0

Status
colourGreen
titleFEATURES

Status
colourYellow
titleVULNERABILITIES

This release includes:

  • Upgrade the base docker-image from Debian to Ubuntu20 for vulnerabilities mitigation.

  • Upgrade the IFC SDK Lookup Factory Service to improve the data model validation.

Upgrade to v1.2.0

v1.2.0-stable

Status
colourGreen
titleFEATURES

Added new custom data sources from Recorded Future Threat List service:

  • IPs related to Ukraine and Russia countries.

Recommended version