Adaptive Response

The Adaptive Response action provided by the app allows for enriching IOCs with information from Recorded Future. This is similar to the enrichment based on the Recorded Future but for a few differences:

Risklist enrichment	Adaptive Response
Enrichment is based upon what information is present in the risklist.	Enrichment is done real-time towards the Recorded Future API
Information may not be fully up-to-date due to refresh cycles of the risklists.	Information is always fully up-to-date
Only IOCs present in the risk lists are enriched (see note).	Any known IOC is enriched.
The enrichment uses no API credit.	The enrichment uses one API credit per successfully enriched IOC.

Note: Typically list only contain IOCs with a risk score above some threshold. This is done to keep the lists to a manageable size.

Setup Adaptive Response

The normal way to use an Adaptive Response is to add it to the list of Adaptive Responses of a Correlation Search which gathers events that should be investigated.

Once this has been setup the Adaptive Response is executed for each event found by the search.

An example of such a search is "Threat Activity Detected" which detects all network events that matches threats known to Splunk's Threat Intelligence framework.

It is possible to use the same Adaptive Response on multiple Correlation Searches.

Adding an Adaptive Response action

Here is how you would add the Adaptive Response to that Correlation Search:

1. In Splunk Enterprise Security, go to Configure->Content Management.
2. Locate "Threat Activity Detected" and click on the name.
3. Near the bottom of the page is the section "Adaptive Response Action". Click on "+ Add New Response Action".
4. From the drop-down list, click on "Enrich with Recorded Future"
   
5. In most cases no changes are necessary - just click on Save. If the Correlation Search uses another field than "threat_match_value" to indicate which IOC it has detected that field name must be entered as the field value.
   

Warning: each IOC that is enriched may consume one API credit. Ensure that the Correlation Search used does not yield excessive numbers of events.

Removing the Adaptive Response action

If at some point the Adaptive Response action needs to be removed from a Correlation Search this is very straight forward.

1. In Splunk Enterprise Security, go to Configure->Content Management.
2. Locate the correlation search and select it.
3. Near the bottom of the page is the section "Adaptive Response Action".
4. Click on the X next to the action and save.
   

Ad-hoc use of the Adaptive Response

It is possible to make ad-hoc calls to the Adaptive Response, for example from with the Incident Review panel.

1. When reviewing a notable event in the Incident Review panel, click on event actions.
2. Select "Run an Adaptive Response".
   
3. Select "Recorded Future" and run it. Close the pop-up.
   
4. Click on the reload symbol just above the "Adaptive Responses" section of the panel.
   
5. When the Check mark and "success" is visible in the Status column the enrichment is done. Clicking on the "Enrich with Recorded Future" will open an enrichment view (in a separate view) with the information returned by the enrichment.