Platform

Featured Integrations

Reduce risk and mitigate cyber attacks, no matter your IT & security stack, maturity journey, or industry

See our Threat Intelligence Solutions in Action

Outcomes

Threat Intelligence solves pervasive challenges

Reduce operational risk through timely, precise, and actionable intelligence.

See Recorded Future’s Intelligence in Action

Products

Services

Research

Minimize operational risks with our timely, precise, and actionable intelligence.

See Recorded Future in Action

Resource Center

Additional Resources

Additional Topics

Resources

Why Recorded Future

About Us

Partner With Us

Join Us

Company

brand-logo-long-black.svg

Rectangular Logo - Digital (RGB).svg

Blog

Careers at Recorded Future

Contact Us

Pivoting to Recorded Future Enrichment Data in Splunk

These instructions will show you how to add a workflow actions for easy pivoting
 to enrichment data from any event in Splunk.&nbsp; Here we assume you have already
 installed the
 <a href="https://splunkbase.splunk.com/app/2629/">Splunk Enterprise integration from Recorded Future</a>.

&nbsp;

 This is a typical event view within the search app in Splunk, notice there are
 limited actions available:

<img src="https://cms.recordedfuture.com/uploads/pivoting_recorded_future_enrichment_data_splunk_screenshot1_1fcdded9d9.png" alt="pivoting-recorded-future-enrichment-data-splunk-screenshot1.png"/>


<img src="https://cms.recordedfuture.com/uploads/pivoting_recorded_future_enrichment_data_splunk_screenshot2_faae6d6312.png" alt="pivoting-recorded-future-enrichment-data-splunk-screenshot2.png"/>


 It is important to note the fields you want to enrich. In this case we will use
 “dst” as this is the destination point for traffic going through our firewall
 originating from our network.&nbsp;


 Step 1: Go to Settings&gt;Fields on your Splunk Search Head:

<img src="https://cms.recordedfuture.com/uploads/pivoting_recorded_future_enrichment_data_splunk_screenshot3_8b42d15b63.png" alt="pivoting-recorded-future-enrichment-data-splunk-screenshot3-.png"/>

&nbsp;
Step 2. Select “Add new” to the right of Workflow actions:
<img src="https://cms.recordedfuture.com/uploads/pivoting_recorded_future_enrichment_data_splunk_screenshot4_474afc8614.png" alt="pivoting-recorded-future-enrichment-data-splunk-screenshot4-.png"/>

&nbsp;

 Step 3. Select the destination app as “TA_recordedfuture-cyber”
 NOTE: You can select other apps as the destination, we recommend
 this for organization only and possible role based access controls only:

<img src="https://cms.recordedfuture.com/uploads/pivoting_recorded_future_enrichment_data_splunk_screenshot5_9bb451dd77.png" alt="pivoting-recorded-future-enrichment-data-splunk-screenshot5.png"/>

Step 4. Select a unique name for your workflow action:
<img src="https://cms.recordedfuture.com/uploads/pivoting_recorded_future_enrichment_data_splunk_screenshot6_b16bf80676.png" alt="pivoting-recorded-future-enrichment-data-splunk-screenshot6.png"/>



 Step 5. Select a label for your Workflow Action. NOTE: You can
 use the variable ($dst$)in this field to have the menu say “RF Enrich IPADDRESS(Used
 in this example)” or use a static value like “RF destination enrichment”

<img src="https://cms.recordedfuture.com/uploads/pivoting_recorded_future_enrichment_data_splunk_screenshot7_bd3a26973e.png" alt="pivoting-recorded-future-enrichment-data-splunk-screenshot7.png"/>

Step 6. Select the field we wish to enrich:
<img src="https://cms.recordedfuture.com/uploads/pivoting_recorded_future_enrichment_data_splunk_screenshot8_d216bc3567.png" alt="pivoting-recorded-future-enrichment-data-splunk-screenshot8.png"/>


 Step 7. If you want to restrict to specific event types enter them here, else
 leave this blank. NOTE: Event types are typically defined as part of a TA or
 App, event types can be created by any search. Example - Creating an event type
 named fwaccepts with a search string of “index=extfws sourcetype=netscreen:firewall
 action=allowed” would allow you to restrict the workflow from displaying for
 any traffic from other devices or any dropped traffic from the firewall.

<img src="https://cms.recordedfuture.com/uploads/pivoting_recorded_future_enrichment_data_splunk_screenshot9_b2fd5d916a.png" alt="pivoting-recorded-future-enrichment-data-splunk-screenshot9.png"/>



 Step 8. Select show action in Both and action type of link in the dropdown menus.

<img src="https://cms.recordedfuture.com/uploads/pivoting_recorded_future_enrichment_data_splunk_screenshot10_c972d015a7.png" alt="pivoting-recorded-future-enrichment-data-splunk-screenshot10.png"/>



 Step 9. Enter http://yoursearchhead.company.com/en-US/app/TA_recordedfuture-cyber/recorded_future_ip_enrichment?form.name=$dst$
 into the URI where yoursearchhead.company.com is the DNS name for your Splunk
 Search Head. NOTE: We are replacing the end with the variable
 name from our selected field “$dst”:

<img src="https://cms.recordedfuture.com/uploads/pivoting_recorded_future_enrichment_data_splunk_screenshot11_7eace904b1.png" alt="pivoting-recorded-future-enrichment-data-splunk-screenshot11.png"/>



 Step 10. Select Open link to “New Window” and Link Method to “Get” in the dropdown
 menus:

<img src="https://cms.recordedfuture.com/uploads/pivoting_recorded_future_enrichment_data_splunk_screenshot12_d1e5212ef7.png" alt="pivoting-recorded-future-enrichment-data-splunk-screenshot12.png"/>


 Step 11. Select “Save” in the bottom right corner to save your Workflow Action:

<img src="https://cms.recordedfuture.com/uploads/pivoting_recorded_future_enrichment_data_splunk_screenshot13_38e2de190a.png" alt="pivoting-recorded-future-enrichment-data-splunk-screenshot13-.png"/>

&nbsp;

 After the new Workflow action is saved, it is setup to private only within the
 Recorded Future App:

<img src="https://cms.recordedfuture.com/uploads/pivoting_recorded_future_enrichment_data_splunk_screenshot14_af54145a78.png" alt="pivoting-recorded-future-enrichment-data-splunk-screenshot14-.png"/>


 Step 12. Select Permissions to the right of the Workflow Actions.


 Step 13. Select “All apps” to enable the pivot from other Splunk apps, the appropriate
 “Role permissions” for the Workflow Action, and then select save:

<img src="https://cms.recordedfuture.com/uploads/pivoting_recorded_future_enrichment_data_splunk_screenshot15_534307540e.png" alt="pivoting-recorded-future-enrichment-data-splunk-screenshot15-.png"/>

&nbsp;

 Step 14. Select an event (in any app if permissions are set to global.) You should
 now see your Workflow Action available through the event menus:

<img src="https://cms.recordedfuture.com/uploads/pivoting_recorded_future_enrichment_data_splunk_screenshot16_67c35ea29d.png" alt="pivoting-recorded-future-enrichment-data-splunk-screenshot16.png"/>

<img src="https://cms.recordedfuture.com/uploads/pivoting_recorded_future_enrichment_data_splunk_screenshot17_56d70d6dad.png" alt="pivoting-recorded-future-enrichment-data-splunk-screenshot17.png"/>



 When you select the action you will be presented with a new window/tab with the
 entity enrichment dashboard:

<img src="https://cms.recordedfuture.com/uploads/pivoting_recorded_future_enrichment_data_splunk_screenshot18_cc48c9c59c.png" alt="pivoting-recorded-future-enrichment-data-splunk-screenshot18.png"/>


 If you have any questions or need assistance please reach out to
 <a href="mailto:ps@recordedfuture.com">ps@recordedfuture.com</a>

Refine your search

We could not find any results for your search, so why not start with the articles listed below?

Splunk에서 기록된 미래 강화 데이터로 피벗하기