Platform

Featured Integrations

Reduce risk and mitigate cyber attacks, no matter your IT & security stack, maturity journey, or industry

See our Threat Intelligence Solutions in Action

Outcomes

Industries

Threat Intelligence solves pervasive challenges

Reduce operational risk through timely, precise, and actionable intelligence.

See Recorded Future’s Intelligence in Action

Products

Services

Research

Experience our platform live every week. Minimize risks with timely, actionable threat intelligence that helps you stay ahead of threats.

Join our Weekly Platform Preview

Resource Center

Additional Resources

Additional Topics

Resources

Why Recorded Future

About Us

Partner With Us

Join Us

Company

brand-logo-long-black.svg

Rectangular Logo - Digital (RGB).svg

Home

Blog

Contact Us

<h3 id="h.vkwzvjvjt08e" class="wysiwyg-color-black70">
 C2 Communicating IPs SCF Splunk Dashboard 
</h3>

 Recorded Future <a href="https://support.recordedfuture.com/hc/en-us/articles/360023512854-Internet-Scanning">Internet Scanning</a>&nbsp;collects live information about internet hosts and <a href="https://support.recordedfuture.com/hc/en-us/articles/360020582674-Network-Traffic-Analysis">Network Traffic Analysis</a>&nbsp;observes the midpoint between the adversary and their victims as they build, stage, and launch attacks. &nbsp;The Command and Control dataset fuses those two methods to identify and track IPs that we have scanned as positive C2 and then observed communications to understand how the C2 is interacting with infected machines as well as being controlled by the adversary. By leveraging this data in Splunk we can correlate, with high confidence, network
 activity in your logs with command and control infrastructure over specific ports
 and protocols, and tied to specific malware families.

&nbsp;

 This allows us to work towards two goals:

<ul>
 <li>
 Detecting communications with known C2 IPs over relevant ports and protocols.
 </li>
 <li>
 Hunting for activity potentially related to specific Malware.
 &nbsp;
 </li>
</ul>
&nbsp;

 This dashboard enables clients to detect higher confidence and fidelity correlations between their Network Traffic logs and Known C2 infrastructure by leveraging the metadata included in our C2 Communicating IPs SCF. It also marries this information with the Recorded Future Risk Score and Evidence Details to give the analyst further insight into the IP address. Finally, the user can filter results based on the malware variant if there is particular activity they are searching for.

&nbsp;

<img src="https://cms.recordedfuture.com/uploads/c2_communicating_ips_scf_splunk_dashboard_image_0_61a680c161.png" alt="c2-communicating-ips-scf-splunk-dashboard-image-0.png" />



<img src="https://cms.recordedfuture.com/uploads/c2_communicating_ips_scf_splunk_dashboard_image_1_80b82b741c.png" alt="c2-communicating-ips-scf-splunk-dashboard-image-1.png" />


&nbsp;

 From a technical perspective, the integration will include and need to be configured: 

<ul>
 <li>
 C2 Communicating IPs SCF fusion file converted to risklist format with metadata added to the Recorded Future App for Splunk 
 </li>
 <li>C2 SCF Correlation Dashboard XML code</li>
</ul>

 This service will require Threat or Brand Intelligence Modules, Splunk Integration, and Two (2) Professional Service Credits for implementation. On-going support covered by Integration or Premium Support. If you have any additional questions, please contact your Intelligence Services Consultant.

&nbsp;

C2 Communicating IPs SCF Splunk Dashboard

Refine your search

We could not find any results for your search, so why not start with the articles listed below?

C2 통신 IP SCF 스플렁크 대시보드