Platform

Featured Integrations

Reduce risk and mitigate cyber attacks, no matter your IT & security stack, maturity journey, or industry

See our Threat Intelligence Solutions in Action

Outcomes

Industries

Threat Intelligence solves pervasive challenges

Reduce operational risk through timely, precise, and actionable intelligence.

See Recorded Future’s Intelligence in Action

Products

Services

Research

Experience our platform live every week. Minimize risks with timely, actionable threat intelligence that helps you stay ahead of threats.

Join our Weekly Platform Preview

Resource Center

Additional Resources

Additional Topics

Resources

Why Recorded Future

About Us

Partner With Us

Join Us

Company

brand-logo-long-black.svg

Rectangular Logo - Digital (RGB).svg

Home

Blog

Careers

Contact Us

Customizing the Global Map

<p>The Global Map shows the geolocation of all matching IP Addresses when correlating firewall logs with a Recorded Future Risk List.</p>
<h4>Adapting to Local Source Types</h4>
<p>It is possible to change the source type as long as the field name in the search statement is modified at the same time.</p>
<pre><code>
    sourcetype=netscreen:firewall earliest=-24h
    | eval Name=dst
    | eval Time=start_time
    | lookup default_ip_risklist.csv Name OUTPUT Risk, RiskString, EvidenceDetails
    | search Risk != ""
    | eval RiskScore = Risk
    | eval Rule = spath(EvidenceDetails,"EvidenceDetails{}.Rule")
    | eval EvidenceString = spath(EvidenceDetails,"EvidenceDetails{}.EvidenceString")
    | search Risk != ""
    | iplocation Name
    | fields + Name, Risk, lat, lon, City, Country
    | geostats count latfield=lat longfield=lon
</code></pre>
<p>The search can be adapted to suit the local setup. The most typical changes are involve the first 4 rows of the search:</p>
<ul>
<li>The value <strong>netscreen:firewall</strong> should match the source type of your firewall logs.</li>
<li>The <strong><a href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval">eval</a> Name=dst</strong> statement should match the field name of the destination IP Address in your firewall logs</li>
<li>The <a href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup">lookup</a> <strong>default_ip_risklist.csv</strong> should match the name of the risk list you want to correlate the firewall logs with</li>
</ul>
<h4>Customize with a Different Map Widget</h4>
<p>The style of the map can be changed by installing additional Splunk Apps containing visualisations, such as leaflet_maps_app. Click <strong>Edit</strong> on the dashboard:</p>
<div class="image-block-6">
<img src="/wp-content/uploads/recorded_future_edit_button.png " alt="Edit button " class="">
</div>
<p>Choose the new theme of the map by clicking on the <strong>Select visualization</strong>:</p>
<div class="image-block-6">
<img src="/wp-content/uploads/recorded_future_map_vis.png " alt="Select visualization " class="">
</div>
<p>This is what the map looks like within the leaflet theme:</p>
<div class="image-block-6">
<img src="/wp-content/uploads/recorded_future_map_vis_2.png " alt="Global Map with Leaflet theme applied " class="">
</div>
<p>This is the standard Splunk map:</p>
<div class="image-block-6">
<img src="/wp-content/uploads/recorded_future_map_vis_3-1.png " alt="Global Map with the default Splunk theme " class="">
</div>
<h4>Active Threats</h4>
<p>The first row shows the current size of each of category of the default Risk Lists which are the following:</p>
<ul>
<li>IP</li>
<li>Domain</li>
<li>Hash</li>
<li>Vulnerability</li>
<li>URL</li>
</ul>
<p>The map collates the IP addresses in the Risk List based on location and displays top ten countries in a pie chart as well as the top ten risk rules per entity that have been triggered the most by the correlated events.</p>
<h3>Further Help</h3>
<p>“Recorded Future App for Splunk” has been developed by Recorded Future.</p>
<p>Further information and support can be found on our Support web site: <a href="https://support.recordedfuture.com/hc/en-us/articles/360003588753">support.recordedfuture.com</a></p>

Install and Configure: Global Map

<p>
  <em>[this is for v4.0.x of the Recorded Future App for Splunk Enterprise]</em>
</p>
<h1>Global Map</h1>
<p>
  The Global Map shows the geolocation of all matching IP Addresses when correlating
  firewall logs with a Recorded Future risk list.<br>
  <a id="user-content-global-map-1" class="anchor" href="http://localhost:8000/en-US/app/TA_recordedfuture-cyber/recorded_future_help_global_map#global-map-1" aria-hidden="true"></a>
</p>
<pre lang="splunk"><code>    sourcetype=netscreen:firewall earliest=-24h
    | eval Name=dst
    | eval Time=start_time
    | lookup rf_ip_risklist.csv Name OUTPUT Risk, RiskString, EvidenceDetails
    | search Risk != ""
    | eval RiskScore = Risk
    | eval Rule = spath(EvidenceDetails,"EvidenceDetails{}.Rule")
    | eval EvidenceString = spath(EvidenceDetails,"EvidenceDetails{}.EvidenceString")
    | search Risk != ""
    | iplocation Name
    | fields + Name, Risk, lat, lon, City, Country
    | geostats count latfield=lat longfield=lon
</code></pre>
<p>
  The search might have to be adapted to suit the local setup. The most common
  changes lie in the first 4 rows of the search.
</p>
<ul>
  <li>
    The value 'netscreen:firewall' should match the sourcetype of your firewall
    logs.
  </li>
  <li>
    The '<a href="http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Eval" rel="nofollow">eval</a>&nbsp;Name=dst'
    statement should match the fieldname of the destination IP Address in your
    firewall logs
  </li>
  <li>
    The&nbsp;<a href="https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Lookup" rel="nofollow">lookup</a>&nbsp;'rf_ip_risklist.csv'
    should match the name of the risk list you want to correlate the firewall
    logs with
  </li>
</ul>
<p>
  Furthermore the style of the map can be changed by installing additional Splunk
  Apps containing visualisations, such as leaflet_maps_app. These changes are done
  by clicking on the 'Edit' button on the dashboard:
</p>
<p>
  <a href="http://localhost:8000/en-US/static/@51d9cac7b837:0/app/TA_recordedfuture-cyber/img/recorded_future_edit_button.png" target="_blank" rel="noopener"><img src="http://localhost:8000/en-US/static/@51d9cac7b837:0/app/TA_recordedfuture-cyber/img/recorded_future_edit_button.png" alt="Edit button"></a>
</p>
<p>
  and then clicking on the 'Select visualization' button to select the new theme
  for the map:
</p>
<p>
  <a href="http://localhost:8000/en-US/static/@51d9cac7b837:0/app/TA_recordedfuture-cyber/img/recorded_future_map_vis.png" target="_blank" rel="noopener"><img src="http://localhost:8000/en-US/static/@51d9cac7b837:0/app/TA_recordedfuture-cyber/img/recorded_future_map_vis.png" alt="Select visualization"></a>
</p>
<p>
  Here is an example of how the map looks with the leaflet theme:
</p>
<p>
  <a href="http://localhost:8000/en-US/static/@51d9cac7b837:0/app/TA_recordedfuture-cyber/img/recorded_future_map_vis_2.png" target="_blank" rel="noopener"><img src="http://localhost:8000/en-US/static/@51d9cac7b837:0/app/TA_recordedfuture-cyber/img/recorded_future_map_vis_2.png" alt="Global Map with Leaflet theme applied" width="649" height="314"></a>
</p>
<p>Compared to the standard Splunk map:</p>
<p>
  <a href="http://localhost:8000/en-US/static/@51d9cac7b837:0/app/TA_recordedfuture-cyber/img/recorded_future_map_vis_3.png" target="_blank" rel="noopener"><img src="http://localhost:8000/en-US/static/@51d9cac7b837:0/app/TA_recordedfuture-cyber/img/recorded_future_map_vis_3.png" alt="Global Map with the default Splunk theme" width="649" height="211"></a>
</p>
<h2>
  <a id="user-content-active-threats" class="anchor" href="http://localhost:8000/en-US/app/TA_recordedfuture-cyber/recorded_future_help_global_map#active-threats" aria-hidden="true"></a>Active
  Threats
</h2>
<p>
  The first row shows the current size of each of the default risk lists are shown.
  The default risk lists are:
</p>
<ul>
  <li>IP</li>
  <li>Domain</li>
  <li>Hash</li>
  <li>Vulnerability</li>
  <li>URL</li>
</ul>
<p>
  The pie chart shows the top 10 countries in the IP Risk List. The tables show
  the top 10 risk rules that have triggered in each list.
</p>
<h1>
  <a id="user-content-further-help" class="anchor" href="http://localhost:8000/en-US/app/TA_recordedfuture-cyber/recorded_future_help_global_map#further-help" aria-hidden="true"></a>Further
  help
</h1>
<p>
  Your Recorded Future Intelligence Services consultant would be happy to help
  you with additional questions and advice.&nbsp; If you do not know who that is,
  you can also contact support@recordedfuture.com.
</p>
<p>
  Please do not contact Splunk support about "Recorded Future for Splunk Enterprise".
</p>

Refine your search

We could not find any results for your search, so why not start with the articles listed below?

Anpassen der Weltkarte

Anpassung an lokale Quellentypen

Anpassen mit einem anderen Karten-Widget

Aktive Bedrohungen

Weitere Hilfe