Platform

Featured Integrations

Reduce risk and mitigate cyber attacks, no matter your IT & security stack, maturity journey, or industry

See our Threat Intelligence Solutions in Action

Outcomes

Industries

Threat Intelligence solves pervasive challenges

Reduce operational risk through timely, precise, and actionable intelligence.

See Recorded Future’s Intelligence in Action

Products

Services

Research

Experience our platform live every week. Minimize risks with timely, actionable threat intelligence that helps you stay ahead of threats.

Join our Weekly Platform Preview

Resource Center

Additional Resources

Additional Topics

Resources

Why Recorded Future

About Us

Partner With Us

Join Us

Company

brand-logo-long-black.svg

Rectangular Logo - Digital (RGB).svg

Home

Blog

Careers

Contact Us

Configure and Manage Risk Lists

<p>Risk Lists can be used to correlate and enrich events. Each element in a Risk List, like an IP number or Domain, contains has a risk score and the information which contributed to its risk score.</p>
<h4>Default Risk Lists</h4>
<p>The Recorded Future App is shipped with the five Recorded Future Risk Lists:</p>
<ul>
<li>IP address</li>
<li>Domain names</li>
<li>URLs</li>
<li>Hashes of files</li>
<li>Vulnerabilities (mainly CVEs)</li>
</ul>
<p>With Fusion access, it is possible to work with customized Risk Lists.</p>
<h3>Add Risk Lists</h3>
<div class="image-block-6">

</div>
<p>Additional Risk Lists can be downloaded by clicking <strong>Add Risk List</strong>. The following fields appear at the top:</p>
<table>
<thead>
<tr>
<th>Field</th>
<th>Significance</th>
<th>Comment</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>Name</strong></td>
<td>Risk List name within the Splunk instance.</td>
<td>The lookup file will be named .csv.</td>
</tr>
<tr>
<td><strong>Risk List category</strong></td>
<td>The type of entity contained in the Risk List.</td>
<td>IP, Domain, Hash, Vulnerability, or URL.</td>
</tr>
<tr>
<td><strong>Fusion file</strong></td>
<td>The path to the Fusion Risk List.</td>
<td>The path must point to a defined Fusion file stored as an uncompressed CSV file if used as a lookup.</td>
</tr>
<tr>
<td><strong>Update Interval</strong></td>
<td> The interval used to check for updates.</td>
<td>Default is as soon as an updated version is available.</td>
</tr>
</tbody>
</table>
<p>When done configuring the new Risk List, click on <strong>Save</strong> to save the new configuration.</p>
<p>Manage Risk Lists<br>
All configured Risk Lists are listed under <strong>Configuration → Configuration → Risk Lists</strong>. The list of Risk List inputs is sorted to show any custom Risk Lists at the top and the default configuration at the bottom. The default Risk List inputs can not be deleted, only disabled.</p>
<p>To edit a configured Risk List, just click on <strong>Edit</strong> and the fields will unlock. Click <strong>Save</strong> when done editing the settings.</p>
<p>To remove a Risk List, select the corresponding <strong>Delete Risk List</strong> checkbox and click on <strong>Save</strong>.</p>
<h3>Special Considerations for Recorded Future App on Splunk ES</h3>
<p>Both Recorded Future App for Splunk and Recorded Future App for Splunk ES fetch the same set of default Risk Lists. To avoid unnecessary credit consumption and processing load, it is recommended to access the Risk Lists through Recorded Future App for Splunk ES and to disable them in Recorded Future App for Splunk.</p>
<h3>Further Help</h3>
<p>“Recorded Future App for Splunk” has been developed by Recorded Future.</p>
<p>Further information and support can be found on our Support web site: <a href="https://support.recordedfuture.com/hc/en-us/articles/360003588753">support.recordedfuture.com</a>
</p>

Refine your search

We could not find any results for your search, so why not start with the articles listed below?

필드	중요성	설명
이름	Splunk 인스턴스 내의 위험 목록 이름입니다.	조회 파일의 이름은 .csv입니다.
위험 목록 카테고리	위험 목록에 포함된 엔티티의 유형입니다.	IP, 도메인, 해시, 취약점 또는 URL.
퓨전 파일	퓨전 위험 목록으로 이동하는 경로입니다.	조회로 사용되는 경우 경로는 압축되지 않은 CSV 파일로 저장된 정의된 Fusion 파일을 가리켜야 합니다.
업데이트 간격	업데이트 확인에 사용되는 간격입니다.	기본값은 업데이트된 버전이 출시되는 즉시 적용됩니다.

위험 목록 구성 및 관리

기본 위험 목록

위험 목록 추가

Splunk ES의 기록된 미래 앱에 대한 특별 고려 사항

추가 도움말