Recorded Future
Connector Category: API Feed Source
About Integration
CTIX integrates with Recorded Future to retrieve IP, URL, domain, hash, and vulnerability risk lists. This integration retrieves the relationship data of suspicious indicators and adds contextual information for faster threat investigation.
Use Cases
Understand the threat patterns and reveal unknown threats.
Collect and analyze threat intelligence feeds coming from various sources, such as technical, open, and dark web.
Review evidence details to make an informed decision on the intel
Get rich context for faster analysis of real-time threat intelligence feeds.
Benefits
Prioritize and uncover threats by using real-time access to the rich context.
Automatically collect threat intel from Recorded Future.
Configure Recorded Future as API Feed Source
Configure Recorded Future as an API feed source in CTIX to retrieve IP address, domain, URL, hash, and vulnerability data feeds from Recorded Future.
Before you Start
You must have the View API Feed, View Feed Source, Create Feed Source, and Update Feed Source permissions in CTIX.
You must have the base URL and API key of your Recorded Future account.
Important
Ensure that the API key includes the permissions to retrieve IP address, domain, URL, hash, and vulnerability data. If the API key does not have permission to retrieve a threat data feed, then the respective feed channel is disabled automatically and displays a connection error.
Steps
To configure Recorded Future as an API feed source in CTIX, do the following:
Go to Administration > Integration Management > FEED SOURCES > APIs.
Click Add API Source.
Search and select the Recorded Future app.
Click Add Instance.
Enter a unique name to identify the instance. For example, Prod-RecordedFuture.
Enter the base URL of your Recorded Future instance. The default base URL is
https://api.recordedfuture.com/v2.Enter the API key of your Recorded Future account to authenticate communication between the CTIX and Recorded Future servers.
Select Verify SSL to verify the SSL certificate and secure the connection between the CTIX and Recorded Future servers. By default, Verify SSL is selected.
Note
Cyware recommends you select Verify SSL. If you disable this option, CTIX may configure an instance for an expired SSL certificate. This may not establish the connection properly and CTIX will not be able to notify you in case of a broken or improper connection.
Click Save.
The Recorded Future instance is configured and you can view the Recorded Future feed channels. You can configure multiple instances of this integration by clicking Manage > Add More.
Configure Recorded Future Feed Channel
Configure the respective feed channels to retrieve the domain, vulnerability, hash, IP, and URL intelligence feeds from Recorded Future and store the feeds in a collection.
Steps
To configure a Recorded Future channel, do the following:
Go to Administration > Integration Management > FEED SOURCES > APIs.
Search and select the Recorded Future app.
Click the ellipsis on the top right corner and select Manage.
Click Manage Feed Channels.
Select a feed channel and enable the toggle.
Enter the name of the collection to group the feed data. For example, RF Feeds. CTIX creates the collection and stores all the feeds from the feed channel.
Select the risk list types to select the files from which the data is polled. We recommend you to select the default risk list type only.
Select from one of the following Polling Cron Schedule types to define when to poll the data:
Manual: Allows you to manually poll from the source collection.
Auto: Allows you to automatically poll for threat intel from sources at specific time intervals. The default polling cron schedule is Auto.
Enter a frequency in minutes between 60 and 10080 minutes in Polling Time. The default polling time is 240 minutes.
Set a default TLP and confidence score to assign to the feeds that do not have a TLP and confidence score already assigned. By default, the default TLP and confidence score are set to Amber and 100 respectively.
Select any tags to identify and categorize the feeds.
Click Save.
The feed channel is configured and you can poll feeds from the channel. You can enable the other feed channels, poll feeds, and view the feeds. For more information, see API Integrations.
Note
Indicators reported by Recorded Future are deprecated after seven days once they are dropped by Recorded Future and not reported by another source.
Test Recorded Future Feed Channel Connectivity
Test the connectivity of the Recorded Future API feed channels to ensure that the connection with the correct API endpoint is established and you have permission to poll feeds.
Before you Start
Ensure that the Recorded Future API integration is enabled.
Ensure that the feed channel for which you want to test connectivity is enabled.
Steps
To test the connectivity of a feed channel, do the following:
Go to Administration > Integration Management > FEED SOURCES > APIs.
Search and select the Recorded Future app.
On a feed channel, click the vertical ellipses and select View Details.
In the Working Status section, click Test Connectivity.
If the connection is established, then the working status shows Running. If the connectivity is broken, then the working status shows Connection Error. Hover over the tooltip next to Connection Error to view the error code.
Note
When the connectivity of a feed channel breaks, CTIX disables the channel and re-attempts to restore the connectivity three times every hour. After a successful re-attempt to restore the connectivity, CTIX enables the feed channel automatically.
To understand the error code and troubleshoot broken connectivity, see Troubleshoot Integrations.
Recorded Future Feed Channels
CTIX provides multiple channels to poll feeds from Recorded Future. The following table lists all the feed channels and the Recorded Future API endpoints used for each feed channel.
Feed Channel | API URL |
|---|---|
Retrieve URL Feeds Data |
|
Retrieve IP Feeds Data |
|
Retrieve Domain Feeds Data |
|
Retrieve Vulnerability Feeds Data |
|
Retrieve Hash Feeds Data |
|