Platform

Featured Integrations

Reduce risk and mitigate cyber attacks, no matter your IT & security stack, maturity journey, or industry

See our Threat Intelligence Solutions in Action

Outcomes

Industries

Threat Intelligence solves pervasive challenges

Reduce operational risk through timely, precise, and actionable intelligence.

See Recorded Future’s Intelligence in Action

Products

Services

Research

Experience our platform live every week. Minimize risks with timely, actionable threat intelligence that helps you stay ahead of threats.

Join our Weekly Platform Preview

Resource Center

Additional Resources

Additional Topics

Resources

Why Recorded Future

About Us

Partner With Us

Join Us

Company

brand-logo-long-black.svg

Rectangular Logo - Digital (RGB).svg

Home

Blog

Careers

Contact Us

Using the Alert API to view Recorded Future Alerts in Splunk

<div class="aHl">&nbsp;</div>
<h1 class="aHl">Introduction</h1>
<div class="aHl">
  With the new
  <a href="https://support.recordedfuture.com/hc/en-us/articles/115000916954-Alert-API">Alert API</a>
  introduced in 2018,&nbsp;clients can access their Recorded Future alerts programmatically.&nbsp;
  In this support page, we outline how Splunk Integration clients can use the Alert
  API to incorporate alerts into Splunk.&nbsp; For a general overview of how to
  use the Alert API, check out this
  <a href="https://support.recordedfuture.com/hc/en-us/articles/115003717854-How-to-use-the-Alert-API">support page</a>.&nbsp;
</div>
<div class="aHl">&nbsp;</div>
<div class="aHl">
  Note that this add-on functionality assume that a 3.x version of Recorded Future's&nbsp;(core)
  Splunk Enterprise Integration Application (see&nbsp;<a href="https://splunkbase.splunk.com/app/2629/">https://splunkbase.splunk.com/app/2629/</a>)
  is installed.&nbsp; Also, in v4.x of this integration application (release in
  September 2018), an "Alerts" dashboard will be incorporated into the standard
  package.&nbsp;
</div>
<div id=":egb" tabindex="-1">&nbsp;</div>
<div id=":eka" class="ii gt ">
  <div id=":elf" class="a3s aXjCH m16297930a600d2d7">
    <div>
      <div>
        <div>&nbsp;</div>
      </div>
      <div>
        <div>
          <h1>Basic Instructions</h1>
          <ol>
            <li>
              The alerts.py file should be places in the bin directory
              of the Recorded Future App.
            </li>
            <ul>
              <li>May need to chown file to splunk:splunk</li>
              <li>May need to chmod file to 755</li>
            </ul>
            <li>
              .conf files should be placed into local directory of
              the Recorded Future App.
            </li>
            <ul>
              <li>May need to chown files to splunk:splunk</li>
              <li>
                May need to adjust path in files if splunk home directory
                is not /opt/splunk/
              </li>
            </ul>
            <li>
              Copy xml file into the local/data/ui/views directory&nbsp;of
              the Recorded Future App.
            </li>
            <ul>
              <li>May need to chown files to splunk:splunk</li>
              <li>
                May need to adjust permissions for access, set global
                view (all apps, everyone read, admin write)
              </li>
              <li>
                Will need to add to default navigation for visibility
                in the app
              </li>
            </ul>
          </ol>
          <div>
            The scripts should pull the api key stored in the kv store,
            nothing should need to be entered. &nbsp;If you have any
            issues during the setup or configuration, please schedule
            a remote session through your account team. &nbsp;The user
            for the API key must have alerts shared with them in order
            to pull the alerts from the API.
          </div>
        </div>
      </div>
    </div>
  </div>
</div>

Refine your search

We could not find any results for your search, so why not start with the articles listed below?

Verwenden der Alert-API zum Anzeigen aufgezeichneter zukünftiger Alerts in Splunk

Einführung

Grundlegende Anweisungen