Platform

Featured Integrations

Reduce risk and mitigate cyber attacks, no matter your IT & security stack, maturity journey, or industry

See our Threat Intelligence Solutions in Action

Outcomes

Industries

Threat Intelligence solves pervasive challenges

Reduce operational risk through timely, precise, and actionable intelligence.

See Recorded Future’s Intelligence in Action

Products

Services

Research

Experience our platform live every week. Minimize risks with timely, actionable threat intelligence that helps you stay ahead of threats.

Join our Weekly Platform Preview

Resource Center

Additional Resources

Additional Topics

Resources

Why Recorded Future

About Us

Partner With Us

Join Us

Company

brand-logo-long-black.svg

Rectangular Logo - Digital (RGB).svg

Home

Blog

Contact Us

Correlation Dashboards

<p>The Correlation Dashboards display correlations between events and Recorded Future Risk Lists. The Risk List used for the correlation depend on which type of Correlation Dashboard is chosen. By default only the events of the last 24 hours are used.</p>
<p>The Correlation Dashboards need to be configured to ensure that the events used contain the correct type of entity, for instance that the IP address Risk List is matched to events that contain IP addresses.</p>
<p>The correlation dashboards contain four elements:</p>
<ul>
<li><strong>Summary</strong> shows the number of entities which were found to match one or more events.</li>
<li>“Top Rule Hits” shows the rules which are triggered by these entities.</li>
<li>“Top Counts” displays the the entities with the number of events they were matched to.</li>
<li>“High Risk” contains matching entities with the risk information.</li>
</ul>
<h3>Dashboard Sections</h3>
<h4>Summary</h4>
<p><strong>Summary</strong> displays the number of the events for which a match was found in the Risk List.</p>
<h4>Top Rule Hits</h4>
<p>Section “Top Rule Hits” contains a list of all Recorded Future Rules that have been triggered by the matching entities and is sorted by the number of entities that have triggered the rule.</p>
<h4>Top Counts</h4>
<p>Section “Top Counts” lists all the entities were matched to the events and the list is sorted by the number of events that the entity was matched to. Click on an entity to bring up its corresponding Enrichment Dashboard in a new window.</p>
<h4>High Risk</h4>
<p>This is a table with the matched entities listed in descending Risk order. The Risk column is ordered and color coded according to the risk score.</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>Risk</td>
<td>The risk score assigned to the entity by Recorded Future</td>
</tr>
<tr>
<td>Entity</td>
<td>The matched entity</td>
</tr>
<tr>
<td>Count</td>
<td>The number of events matched to the entity</td>
</tr>
<tr>
<td>Rules</td>
<td>The number of Recorded Future rules triggered for the entity out of the total number of rules set up for this type of entity by Recorded Future.</td>
</tr>
<tr>
<td>Evidence</td>
<td>Each of the triggered rules is listed in descending criticality. The criticality is signalled by a color coded dot at the start of the line. The rule is written in bold followed by the details in regular text.</td>
</tr>
</tbody>
</table>
<p>Further information can be obtained by two drill down options:</p>
<ul>
<li>Click on the entity, such as the IP address or the Domain, to open a new Search window looking for events involving the entity.</li>
<li>Click on any other part of the line to open the Enrichment Dashboard for the entity.</li>
</ul>
<p><img src="https://www.recordedfuture.com/de/wp-content/uploads/rf_help_correlation_dashboards_matched_entities-1024x297.png" alt="rf_help_correlation_dashboards_matched_entities" style="width:100%;"></p>
<h4>Configuration</h4>
<p>Information on how to configure the Correlation Dashboards can be found under <strong>Help → Adapt and tune → Adapt dashboards.</strong></p>
<h4>Further Help</h4>
<p>“Recorded Future App for Splunk Enterprise” has been developed by Recorded Future.</p>
<p>Further information and support can be found on our Support web site: <a href="https://support.recordedfuture.com/hc/en-us/articles/360003588753">support.recordedfuture.com</a></p>

Refine your search

We could not find any results for your search, so why not start with the articles listed below?

Feld	Beschreibung
Risiko	Der Risiko-Score, der der Entität von Recorded Future zugewiesen wurde
Entität	Die übereinstimmende Entität
Zählen	Die Anzahl der Ereignisse, die der Entität zugeordnet sind
Regeln	Die Anzahl der Recorded Future-Regeln, die für die Entität ausgelöst wurden, aus der Gesamtzahl der Regeln, die von Recorded Future für diesen Entitätstyp eingerichtet wurden.
Beweis	Jede der ausgelösten Regeln wird in absteigender Kritikalität aufgelistet. Die Kritikalität wird durch einen farblich gekennzeichneten Punkt am Anfang der Zeile signalisiert. Die Regel ist fett gedruckt, gefolgt von den Details in normalem Text.

Korrelations- Dashboards

Dashboard-Abschnitte

Zusammenfassung

Top-Regel-Treffer

Top-Zählungen

Hohes Risiko

Konfiguration

Weitere Hilfe