Platform

Featured Integrations

Reduce risk and mitigate cyber attacks, no matter your IT & security stack, maturity journey, or industry

See our Threat Intelligence Solutions in Action

Solutions

Threat Intelligence solves pervasive challenges

Reduce operational risk through timely, precise, and actionable intelligence.

See Recorded Future’s Intelligence in Action

Products

Services

Research

Minimize operational risks with our timely, precise, and actionable intelligence.

See Recorded Future in Action

Resource Center

Additional Resources

Additional Topics

Resources

Why Recorded Future

About Us

Partner With Us

Join Us

Company

brand-logo-long-black.svg

Rectangular Logo - Digital (RGB).svg

Home

Careers at Recorded Future

Contact Us

Configure and Manage Risk Lists

<p>Risk Lists can be used to correlate and enrich events. Each element in a Risk List, like an IP number or Domain, contains has a risk score and the information which contributed to its risk score.</p>
<h4>Default Risk Lists</h4>
<p>The Recorded Future App is shipped with the five Recorded Future Risk Lists:</p>
<ul>
<li>IP address</li>
<li>Domain names</li>
<li>URLs</li>
<li>Hashes of files</li>
<li>Vulnerabilities (mainly CVEs)</li>
</ul>
<p>With Fusion access, it is possible to work with customized Risk Lists.</p>
<h3>Add Risk Lists</h3>
<div class="image-block-6">

</div>
<p>Additional Risk Lists can be downloaded by clicking <strong>Add Risk List</strong>. The following fields appear at the top:</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Significance</th>
<th>Comment</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>Name</strong></td>
<td>Risk List name within the Splunk instance.</td>
<td>The lookup file will be named .csv.</td>
</tr>
<tr>
<td><strong>Risk List category</strong></td>
<td>The type of entity contained in the Risk List.</td>
<td>IP, Domain, Hash, Vulnerability, or URL.</td>
</tr>
<tr>
<td><strong>Fusion file</strong></td>
<td>The path to the Fusion Risk List.</td>
<td>The path must point to a defined Fusion file stored as an uncompressed CSV file if used as a lookup.</td>
</tr>
<tr>
<td><strong>Update Interval</strong></td>
<td> The interval used to check for updates.</td>
<td>Default is as soon as an updated version is available.</td>
</tr>
</tbody>
</table>
<p>When done configuring the new Risk List, click on <strong>Save</strong> to save the new configuration.</p>
<p>Manage Risk Lists<br>
All configured Risk Lists are listed under <strong>Configuration → Configuration → Risk Lists</strong>. The list of Risk List inputs is sorted to show any custom Risk Lists at the top and the default configuration at the bottom. The default Risk List inputs can not be deleted, only disabled.</p>
<p>To edit a configured Risk List, just click on <strong>Edit</strong> and the fields will unlock. Click <strong>Save</strong> when done editing the settings.</p>
<p>To remove a Risk List, select the corresponding <strong>Delete Risk List</strong> checkbox and click on <strong>Save</strong>.</p>
<h3>Special Considerations for Recorded Future App on Splunk ES</h3>
<p>Both Recorded Future App for Splunk and Recorded Future App for Splunk ES fetch the same set of default Risk Lists. To avoid unnecessary credit consumption and processing load, it is recommended to access the Risk Lists through Recorded Future App for Splunk ES and to disable them in Recorded Future App for Splunk.</p>
<h3>Further Help</h3>
<p>“Recorded Future App for Splunk” has been developed by Recorded Future.</p>
<p>Further information and support can be found on our Support web site: <a href="https://support.recordedfuture.com/hc/en-us/articles/360003588753">support.recordedfuture.com</a>
</p>

Refine your search

We could not find any results for your search, so why not start with the articles listed below?

畑	意味	コメント
名前	Splunkインスタンス内のリスクリスト名。	ルックアップファイルの名前は .csv になります。
リスク・リスト・カテゴリー	リスク・リストに含まれるエンティティのタイプ。	IP、ドメイン、ハッシュ、脆弱性、または URL。
Fusion ファイル	フュージョン・リスク・リストへのパス。	パスは、ルックアップとして使用する場合、非圧縮CSVファイルとして保存されている定義済みのFusionファイルを指す必要があります。
更新間隔	更新の確認に使用される間隔。	デフォルトでは、更新されたバージョンが利用可能になるとすぐになります。

リスクリストの設定と管理

デフォルト・リスク・リスト

リスクリストの追加

Splunk ES で今後記録されるアプリに関する特別な考慮事項

さらにヘルプ