Overview
Recorded Future is a threat intelligence provider that allows you to access known bad incidents of compromise and entity enrichment capabilities. It has 6 different modules and charges on a per-user basis for access to the product. The 6 different modules are:
Security Operations: Providing intel into SIEM / SOAR platforms.
Standalone Threat Intelligence: An extension of Security Operations providing context and enrichment of known and emerging threats/incidents.
Brand Intelligence: Monitoring an organization’s external exposure.
Vulnerability Management: Intelligence into the prioritization of threats.
Third party intelligence: Data from third party sources.
Geo-political: More focussed on nation-state attacks and threat indicators.
Recorded Future also charges customers for each integration they use. For example, a mutual customer of Recorded Future and Devo using this integration will pay Recorded Future a subscription fee.
Devo collector features
Feature | Details |
---|---|
Allow parallel downloading ( |
|
Running environments |
|
Populated Devo events |
|
Data sources
Data Source | Description | API Endpoint | Collector service name | Devo Table | Available from release |
IpAddressLookupPuller | This endpoint provides a list of IPs classified as Threat by Recorded Future. |
|
type: | Lookup
|
|
DomainLookupPuller | This endpoint provides a list of domains classified as Threat by Recorded Future. |
|
| Lookup
|
|
FileHashLookupPuller | This endpoint returns a list of file hashes classified as Threat by Recorded Future. |
|
| Lookup
|
|
UrlLookupPuller | This endpoint returns a list of URL classified as Threat by Recorded Future. |
|
| Lookup
|
|
VulnerabilityLookupPuller | This endpoint returns a list of vulnerabilities classified as Threat by Recorded Future. |
|
| Lookup
|
|
PublicUkraineRussiaIpsLookupPuller | This endpoint returns a list of IPs related with Russia and Ukraine. |
|
| Lookup
|
|
Vendor setup
This collector only requires a source configuration by generating a Recorded Future API key. Recorded Future clients with Advanced or Core licenses, and one or more Connect API subscriptions can create and manage their API tokens directly in the Recorded Future portal.
Enable the collection
Here you find the necessary steps to enable the collection.
Steps | Screenshots | |
1 | Login to your Recorded Future account. Open the Menu in the upper-right corner and select the option User Settings. | |
2 | Select the API Access tab. To create a new API token, click on Generate New API Token. | |
3 | Enter a name for the token in the Name field. Then click on Generate. | - |
4 | Select Devo from the drop-down integration list | - |
5 | Click on the Generate new API token button. The new API token appears in the table below. Make a note of the token value as this is required for the ingest Configuration. |
- |
Minimum configuration required for basic pulling
Although this collector supports advanced configuration, the fields required to retrieve data with basic configuration are defined below.
This minimum configuration refers exclusively to those specific parameters of this integration. There are more required parameters related to the generic behavior of the collector. Check setting sections for details.
Setting | Details |
---|---|
| This param refers to the endpoint used by the collector to pull data. |
| This is the access token provided by Recorded Future. |
| This configuration allows you to define what data sources will be pulled. |
Accepted authentication methods
Authentication Method | Token |
---|---|
Token | REQUIRED |
Run the collector
Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector), or deploy and host the collector in your own machine using a Docker image (On-premise collector).
Change log for v1.x.x
Release | Released on | Release type | Details | Recommendations |
---|---|---|---|---|
| FEATURES | New features:
|
| |
| IMPROVEMENTS | Improvement:
Vulnerabilities mitigated:
|
| |
| FEATURES | New features:
|
|
Configuration checklist
Here you will find a brief checklist of the important configurations that need to be done for deploying this collector:
Configuration | Requirements |
---|---|
Recorded Future API key |
Refer to the Enable the collection section. |