Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 8 Next »

Overview

Recorded Future is a threat intelligence provider that allows you to access known bad incidents of compromise and entity enrichment capabilities. It has 6 different modules and charges on a per-user basis for access to the product. The 6 different modules are:

  • Security Operations: Providing intel into SIEM / SOAR platforms.

  • Standalone Threat Intelligence: An extension of Security Operations providing context and enrichment of known and emerging threats/incidents.

  • Brand Intelligence: Monitoring an organization’s external exposure.

  • Vulnerability Management: Intelligence into the prioritization of threats.

  • Third party intelligence: Data from third party sources.

  • Geo-political: More focussed on nation-state attacks and threat indicators.

Recorded Future also charges customers for each integration they use. For example, a mutual customer of Recorded Future and Devo using this integration will pay Recorded Future a subscription fee.

Devo collector features

Feature

Details

Allow parallel downloading (multipod)

  • Not allowed

Running environments

  • Collector server

  • On-premise

Populated Devo events

  • Lookups

Data sources

Data Source

Description

API Endpoint

Collector service name

Devo Table

Available from release

IpAddressLookupPuller

This endpoint provides a list of IPs classified as Threat by Recorded Future.

https://api.recordedfuture.com/v2/ip/risklist?format=csv%2Fsplunk

lookup_puller

type: ip

Lookup

my.lookuplist.Recorded_Future_IPv4_Address_Threat_List

my.lookuplist.Recorded_Future_IPv6_Address_Threat_List

v1.0.0

DomainLookupPuller

This endpoint provides a list of domains classified as Threat by Recorded Future.

https://api.recordedfuture.com/v2/domain/risklist?format=csv%2Fsplunk

lookup_puller

type: domain

Lookup

my.lookuplist.Recorded_Future_Domain_Threat_List

v1.0.0

FileHashLookupPuller

This endpoint returns a list of file hashes classified as Threat by Recorded Future.

https://api.recordedfuture.com/v2/hash/risklist?format=csv%2Fsplunk

lookup_puller

type: hash

Lookup

my.lookuplist.Recorded_Future_File_Hash_Threat_List

v1.0.0

UrlLookupPuller

This endpoint returns a list of URL classified as Threat by Recorded Future.

https://api.recordedfuture.com/v2/url/risklist?format=csv%2Fsplunk

lookup_puller

type: url

Lookup

my.lookuplist.Recorded_Future_URL_Threat_List

v1.0.0

VulnerabilityLookupPuller

This endpoint returns a list of vulnerabilities classified as Threat by Recorded Future.

https://api.recordedfuture.com/v2/vulnerability/risklist?format=csv%2Fsplunk

lookup_puller

type: vulnerability

Lookup

my.lookuplist.Recorded_Future_Vulnerability_Threat_List

v1.0.0

PublicUkraineRussiaIpsLookupPuller

This endpoint returns a list of IPs related with Russia and Ukraine.

https://api.recordedfuture.com/v2/fusion/files/?path=/public/ukraine/ukraine_russia_ip.csv

lookup_puller

type: PublicUkraineRussiaIps

Lookup

my.lookuplist.Recorded_Future_IPv4_Public_Ukranie_Russia_List

my.lookuplist.Recorded_Future_IPv6_Public_Ukranie_Russia_List

v1.2.0

Vendor setup

This collector only requires a source configuration by generating a Recorded Future API key. Recorded Future clients with Advanced or Core licenses, and one or more Connect API subscriptions can create and manage their API tokens directly in the Recorded Future portal.

Enable the collection

Here you find the necessary steps to enable the collection.

Steps

Screenshots

1

Login to your Recorded Future account. Open the Menu in the upper-right corner and select the option User Settings.

2

Select the API Access tab.  To create a new API token, click on Generate New API Token.

3

Enter a name for the token in the Name field. Then click on Generate.

 -

4

Select Devo from the drop-down integration list

 -

5

Click on the Generate new API token button. The new API token appears in the table below. Make a note of the token value as this is required for the ingest Configuration.

 

-

Minimum configuration required for basic pulling

Although this collector supports advanced configuration, the fields required to retrieve data with basic configuration are defined below.

This minimum configuration refers exclusively to those specific parameters of this integration. There are more required parameters related to the generic behavior of the collector. Check setting sections for details.

Setting

Details

url_value

This param refers to the endpoint used by the collector to pull data.

api_token_value

This is the access token provided by Recorded Future.

list_of_sources

This configuration allows you to define what data sources will be pulled.

Accepted authentication methods

Authentication Method

Token

Token

REQUIRED

Run the collector

Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector), or deploy and host the collector in your own machine using a Docker image (On-premise collector).

Change log for v1.x.x

Release

Released on

Release type

Details

Recommendations

v1.0.0

FEATURES

New features:

  • Initial release with the following Recorded Future Threat List default data sources:

    • IPs

    • Domains

    • URLs

    • File Hashes

    • Vulnerabilities

Upgrade

v1.1.0

IMPROVEMENTS
VULNS

Improvement:

  • Upgrade the IFC SDK Lookup Factory Service to improve the data model validation.

  • The underlay Devo Collector SDK has been upgraded to v1.1.4 to improve efficiency, increase the resilience and mitigate vulnerabilities.

  • The hard-reset procedure when losing connection with Devo has been improved.

Vulnerabilities mitigated:

  • CVE-2022-1664

  • CVE-2021-33574

  • CVE-2022-23218

  • CVE-2022-23219

  • CVE-2019-8457

  • CVE-2022-1586

  • CVE-2022-1292

  • CVE-2022-2068

  • CVE-2022-1304

  • CVE-2022-1271

  • CVE-2021-3999

  • CVE-2021-33560

  • CVE-2022-29460

  • CVE-2022-29458

  • CVE-2022-0778

  • CVE-2022-2097

  • CVE-2020-16156

  • CVE-2018-25032

Upgrade

v1.2.0-stable

FEATURES

New features:

  • Added new custom data source for retrieving IPs related to Ukraine and Russia countries.

Recommended version

Configuration checklist

Here you will find a brief checklist of the important configurations that need to be done for deploying this collector:

Configuration

Requirements

Recorded Future API key

  • Generate your API token.

Refer to the Enable the collection section.

  • No labels