Platform

Featured Integrations

Reduce risk and mitigate cyber attacks, no matter your IT & security stack, maturity journey, or industry

See our Threat Intelligence Solutions in Action

Outcomes

Industries

Threat Intelligence solves pervasive challenges

Reduce operational risk through timely, precise, and actionable intelligence.

See Recorded Future’s Intelligence in Action

Products

Services

Research

Experience our platform live every week. Minimize risks with timely, actionable threat intelligence that helps you stay ahead of threats.

Join our Weekly Platform Preview

Resource Center

Additional Resources

Additional Topics

Resources

Why Recorded Future

About Us

Partner With Us

Join Us

Company

brand-logo-long-black.svg

Rectangular Logo - Digital (RGB).svg

Home

Blog

Careers

Contact Us

Configure and Manage Risk Lists

<p>Risk Lists can be used to correlate and enrich events. Each element in a Risk List, like an IP number or Domain, contains has a risk score and the information which contributed to its risk score.</p>
<h4>Default Risk Lists</h4>
<p>The Recorded Future App is shipped with the five Recorded Future Risk Lists:</p>
<ul>
<li>IP address</li>
<li>Domain names</li>
<li>URLs</li>
<li>Hashes of files</li>
<li>Vulnerabilities (mainly CVEs)</li>
</ul>
<p>With Fusion access, it is possible to work with customized Risk Lists.</p>
<h3>Add Risk Lists</h3>
<div class="image-block-6">

</div>
<p>Additional Risk Lists can be downloaded by clicking <strong>Add Risk List</strong>. The following fields appear at the top:</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Significance</th>
<th>Comment</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>Name</strong></td>
<td>Risk List name within the Splunk instance.</td>
<td>The lookup file will be named .csv.</td>
</tr>
<tr>
<td><strong>Risk List category</strong></td>
<td>The type of entity contained in the Risk List.</td>
<td>IP, Domain, Hash, Vulnerability, or URL.</td>
</tr>
<tr>
<td><strong>Fusion file</strong></td>
<td>The path to the Fusion Risk List.</td>
<td>The path must point to a defined Fusion file stored as an uncompressed CSV file if used as a lookup.</td>
</tr>
<tr>
<td><strong>Update Interval</strong></td>
<td> The interval used to check for updates.</td>
<td>Default is as soon as an updated version is available.</td>
</tr>
</tbody>
</table>
<p>When done configuring the new Risk List, click on <strong>Save</strong> to save the new configuration.</p>
<p>Manage Risk Lists<br>
All configured Risk Lists are listed under <strong>Configuration → Configuration → Risk Lists</strong>. The list of Risk List inputs is sorted to show any custom Risk Lists at the top and the default configuration at the bottom. The default Risk List inputs can not be deleted, only disabled.</p>
<p>To edit a configured Risk List, just click on <strong>Edit</strong> and the fields will unlock. Click <strong>Save</strong> when done editing the settings.</p>
<p>To remove a Risk List, select the corresponding <strong>Delete Risk List</strong> checkbox and click on <strong>Save</strong>.</p>
<h3>Special Considerations for Recorded Future App on Splunk ES</h3>
<p>Both Recorded Future App for Splunk and Recorded Future App for Splunk ES fetch the same set of default Risk Lists. To avoid unnecessary credit consumption and processing load, it is recommended to access the Risk Lists through Recorded Future App for Splunk ES and to disable them in Recorded Future App for Splunk.</p>
<h3>Further Help</h3>
<p>“Recorded Future App for Splunk” has been developed by Recorded Future.</p>
<p>Further information and support can be found on our Support web site: <a href="https://support.recordedfuture.com/hc/en-us/articles/360003588753">support.recordedfuture.com</a>
</p>

Refine your search

We could not find any results for your search, so why not start with the articles listed below?

Feld	Bedeutung	Kommentar
Name	Name der Risikoliste innerhalb der Splunk-Instanz.	Die Nachschlagedatei erhält den Namen .csv.
Kategorie "Risikoliste"	Der Typ der Entität, die in der Risikoliste enthalten ist.	IP, Domäne, Hash, Schwachstelle oder URL.
Fusion-Datei	Der Weg zur Fusionsrisikoliste.	Der Pfad muss auf eine definierte Fusion-Datei verweisen, die als unkomprimierte CSV-Datei gespeichert ist, wenn sie als Suche verwendet wird.
Aktualisierungs-Intervall	Das Intervall, das für die Suche nach Updates verwendet wird.	Die Standardeinstellung ist, sobald eine aktualisierte Version verfügbar ist.

Konfigurieren und Verwalten von Risikolisten

Liste der Ausfallrisiken

Hinzufügen von Risikolisten

Besondere Überlegungen für aufgezeichnete zukünftige Apps auf Splunk ES

Weitere Hilfe