Platform

Featured Integrations

Reduce risk and mitigate cyber attacks, no matter your IT & security stack, maturity journey, or industry

See our Threat Intelligence Solutions in Action

Solutions

Threat Intelligence solves pervasive challenges

Reduce operational risk through timely, precise, and actionable intelligence.

See Recorded Future’s Intelligence in Action

Products

Services

Research

Minimize operational risks with our timely, precise, and actionable intelligence.

See Recorded Future in Action

Resource Center

Additional Resources

Additional Topics

Resources

Why Recorded Future

About Us

Partner With Us

Join Us

Company

brand-logo-long-black.svg

Rectangular Logo - Digital (RGB).svg

Home

Careers at Recorded Future

Contact Us

Initial Setup of the App

When the app has been installed on the Splunk server, finalise the initial setup under Configuration → Configuration.
The Configuration view has three panes: Setup, Risk Lists and Alerting Rules.
Configure the API-key with Connect API access and a working API endpoint under the Setup view.
The API-key must be configured in the Setup pane in order for the app to work. A user needs the capability of ‘list_storage_passwords’ to configure API key and Proxy settings in the App.
<h4>Setup</h4>
<div class="image-block-6">
<img src="/wp-content/uploads/recorded_future_setup_view-1.png " alt="Setup tab " class="">
</div>
Here all the settings except for Risk Lists and Alerting Rules are configured. The minimum possible configuration is setting the API-key here.
If you need to disable certificate validation, for example if a networking device in between the Splunk machine and the internet is modifying the SSL certificate, this can be done by unchecking the “SSL Verification” checkbox.
If the splunk server requires a proxy for Internet access, the Proxy checkbox should be checked. This will reveal new fields that need to be filled in. The username and password should only be configured if the proxy requires authentication. Proxy host and port are required settings.
Recorded Future support may in rare circumstances instruct a user to use a different URL to the Recorded Future API, in which case the Recorded Future API URL should be modified.
There are five levels of logging: CRITICAL, ERROR, WARNING, INFO and DEBUG.
The recommended log level is INFO. To report an issue with the Recorded Future App, temporarily change it to DEBUG to collect additional logs that can be used for trouble shooting.
The logs generated by the Recorded Future App are located in the default Splunk log directory $SPLUNK_HOME/var/log/splunk and will be written to the following file:
<ul>
<li>ta_recordedfuture_cyber_rest.log</li>
</ul>
The information contained in the log files can be viewed either in the Splunk GUI or as files on the Splunk server.
Example search:
<pre><code>
index=_* source="/opt/splunk/var/log/splunk/ta_recordedfuture_cyber_rest.log"
</code></pre>
More information about the other tabs can be found under their respective help pages.
<h3>Further Help</h3>
“Recorded Future App for Splunk” has been developed by Recorded Future.
Further information and support can be found on our Support web site: <a href="https://support.recordedfuture.com/hc/en-us/articles/360003588753">support.recordedfuture.com</a>

Refine your search

We could not find any results for your search, so why not start with the articles listed below?

앱 초기 설정

설정

추가 도움말