Platform

Featured Integrations

Reduce risk and mitigate cyber attacks, no matter your IT & security stack, maturity journey, or industry

See our Threat Intelligence Solutions in Action

Outcomes

Threat Intelligence solves pervasive challenges

Reduce operational risk through timely, precise, and actionable intelligence.

See Recorded Future’s Intelligence in Action

Products

Services

Research

Minimize operational risks with our timely, precise, and actionable intelligence.

See Recorded Future in Action

Resource Center

Additional Resources

Additional Topics

Resources

Why Recorded Future

About Us

Partner With Us

Join Us

Company

brand-logo-long-black.svg

Rectangular Logo - Digital (RGB).svg

Blog

Careers at Recorded Future

Contact Us

Install and Configure: Getting Started

<p>
  <em>[this is for v4.0.x of the Recorded Future App for Splunk Enterprise]</em>
</p>
<h1>Download the App</h1>
<p>
  The latest version of the Recorded Future app for Splunk Enterprise is available
  on
  <a href="https://splunkbase.splunk.com/app/2629/" target="_self">splunkbase</a>.
</p>
<h1>Initial setup of the App</h1>
<p>
  Once the app has been installed on the Splunk server the initial setup of the
  app is done under Configuration-&gt;Global configuration.
</p>
<p>
  The Configuration view has three panes: Proxy, Logging and Add-on Settings.
</p>
<p>
  To be able to see and configure API key, Proxy settings and API URL in the Splunk
  App, the user needs the capability 'list_storage_passwords'. To be able to change
  the logging level, the user needs the capability 'admin_all_objects'.
</p>
<p>
  The&nbsp;<strong>API key must be configured</strong>&nbsp;in the Add-on Settings
  pane in order for the app to work.
</p>
<h2>
  <a id="user-content-proxy" class="anchor" href="http://localhost:8000/en-US/app/TA_recordedfuture-cyber/recorded_future_help_setup#proxy" aria-hidden="true"></a>Proxy
</h2>

<p>
  If the Splunk server uses a proxy to access the Internet this should be configured
  here. If no proxy is used leave the Enabled checkbox unchecked.
</p>
<p>
  Host and port must always be set. If the proxy requires authentication the username
  and password should be set here. If authentication is not used these fields should
  be left empty.
</p>
<h2>
Logging
</h2>
<p>
  If additional logging is required it's possible to adjust the log level here.
</p>
<p>The recommended log level is INFO.</p>
<p>
  The integration logs to the standard Splunk log directory ($SPLUNK_HOME/var/log/splunk).
  The following log files will be created (depending on app configuration and usage
  all may not exist):
</p>
<ul>
  <li>ta_recordedfuture_cyber_recorded_future_risk_list.log</li>
  <li>ta_recordedfuture_cyber_recorded_future_alerts.log</li>
  <li>ta_recordedfuture_cyber_rest.log</li>
</ul>
<p>
  The events logged into these files can be viewed either as files on the Splunk
  server of via the Splunk GUI.
</p>
<p>Example search:</p>
<pre><code>index=_* source="/opt/splunk/var/log/splunk/ta_recordedfuture_cyber_recorded_future_alerts.log"
</code></pre>
<h2>
Add-on
  Settings
</h2>

<p>
  The Recorded Future API key required for the proper operation of the app is entered
  in the Api key field.
</p>
<p>
  In some rare situations it may be necessary to change the URL the the Recorded
  Future API. If Recorded Future support instructs you to do so the URL should
  be entered in the Recorded Future Api URL field.
</p>
<h1>
Further
  help
</h1>
<p>
  Your Recorded Future Intelligence Services consultant would be happy to help
  you with additional questions and advice.&nbsp; If you do not know who that is,
  you can also contact support@recordedfuture.com.
</p>
<p>
  Please do not contact Splunk support about "Recorded Future for Splunk Enterprise".
</p>

Refine your search

We could not find any results for your search, so why not start with the articles listed below?

설치 및 구성 시작하기

앱 다운로드

앱 초기 설정

프록시

로깅

애드온 설정

추가 도움말