Platform

Featured Integrations

Reduce risk and mitigate cyber attacks, no matter your IT & security stack, maturity journey, or industry

See our Threat Intelligence Solutions in Action

Outcomes

Industries

Threat Intelligence solves pervasive challenges

Reduce operational risk through timely, precise, and actionable intelligence.

See Recorded Future’s Intelligence in Action

Products

Services

Research

Experience our platform live every week. Minimize risks with timely, actionable threat intelligence that helps you stay ahead of threats.

Join our Weekly Platform Preview

Resource Center

Additional Resources

Additional Topics

Resources

Why Recorded Future

About Us

Partner With Us

Join Us

Company

brand-logo-long-black.svg

Rectangular Logo - Digital (RGB).svg

Home

Blog

Careers

Contact Us

Splunk Explorer Dashboard

The Splunk Explorer Dashboard is found under Other → Splunk Explorer Dashboard. It is designed to perform a quick correlation between the Recorded Future Risk Lists and a subset of Splunk events. The Dashboard uses a <a href="https://en.wikipedia.org/wiki/Representational_state_transfer">REST</a> call to find all the available <a href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup">lookup</a> files in the lookups folder within the Splunk App.
To perform a new correlation:
<ul>
<li>Select a Risk List in the first drop down menu.</li>
<li>Select one of the available source types, specified in the local install, in the second drop down menu.</li>
<li>The fields contained in third drop down menu depends on the source type. The correlation will start automatically when the field is chosen.</li>
</ul>
The following panels show the result of the correlation:
<ul>
<li>Current Entity Risk List Size shows the number of items in the selected Risk List.</li>
<li>Events with the Selected Values displays the number of events in Splunk which contain the selected source type and field during the last 36 hours.</li>
<li>Recorded Future Match Count of Selected Values contains the number of events where the chosen field matches one item in the Risk List.</li>
<li>Most Active Selected Values displays the most frequently occurring values in the selected field and source type.</li>
<li>Recorded Future Matches Details of Selected Values shows the correlated matches enriched with information from the Risk List.</li>
</ul>
Below is an example screenshot of the Splunk Explorer Dashboard using an IP address Risk List combined with firewall logs/dst as source type/field where dst typically stands for destination IP address.
Example of the Splunk Explorer Dashboard
<div class="image-block-6">
<img src="/wp-content/uploads/recorded_future_help_splunk_explorer.png" alt="Splunk Explorer Dashboard" class="">
</div>
<h3>Further Help</h3>
“Recorded Future App for Splunk” has been developed by Recorded Future.
Further information and support can be found on our Support web site: <a href="https://support.recordedfuture.com/hc/en-us/articles/360003588753">support.recordedfuture.com</a>

Refine your search

We could not find any results for your search, so why not start with the articles listed below?

Splunk Explorer Dashboard

Weitere Hilfe