Recorded Future [DEPRECATED]
Recorded Future Connector enables access to the Recorded Future Intelligence. The connector has dedicated actions for pulling Recorded Future indicators (IP, Domain, URL, Hash) and associated context (Risk Score, Risk Rules, Intelligence Card Link and Related Entities) , Vulnerabilities, Recorded Future Alerts and enables access to Recorded Future SOAR API and Fusion Files
This connector is available in the following products and regions:
Service | Class | Regions |
---|---|---|
Logic Apps | Standard | All Logic Apps regions except the following: - Azure Government regions - Azure China regions - US Department of Defense (DoD) |
Power Automate | Premium | All Power Automate regions except the following: - US Government (GCC) - US Government (GCC High) - China Cloud operated by 21Vianet - US Department of Defense (DoD) |
Power Apps | Premium | All Power Apps regions except the following: - US Government (GCC) - US Government (GCC High) - China Cloud operated by 21Vianet - US Department of Defense (DoD) |
Contact | |
---|---|
Name | Recorded Future Support |
URL | https://support.recordedfuture.com |
support@recordedfuture.com |
Connector Metadata | |
---|---|
Publisher | Recorded Future |
Website | https://www.recordedfuture.com |
Privacy Policy | https://www.recordedfuture.com/privacy-policy/ |
Categories | AI;Data |
The Recorded Future integration allows real-time security intelligence to be integrated into popular Microsoft services like Sentinel, Defender ATP, and others. This empowers our clients to maximize their existing security investments, ensuring they have real-time intelligence to secure their cloud environments and reduce risk to the organization. The Recorded Future connector for Microsoft Azure enables access to dedicated actions for pulling Recorded Future indicators (IP, Domain, URL, Hash, Vulnerabilities), associated context (Risk Score, Risk Rules, Intelligence Card Link and Related Entities), and Recorded Future alerts.
To enable the Recorded Future for Microsoft Azure integration, users must be provisioned a Recorded Future API token. Please reach to your account manager to obtain the necessary API token.
Prior to use of the Recorded Future integration for Microsoft Azure, users must provision an API token from their account manager or from within the Recorded Future portal necessary for the integration.
Login to the Recorded Future Portal (https://app.recordedfuture.com). Click on the menu in the upper right and choose “User Settings”.
On the User Settings menu, choose the “API Access” section and click the “Generate New API Token” link.
Provide a name for your token, select a “Description” of “Microsoft Azure”, and then click the “Create” button. Save the API token that is generated, since you will configure it within the Microsoft Azure connector for the integration.
N/A
The connector supports the following authentication types:
Default | Parameters for creating connection. | All regions | Not shareable |
Applicable: All regions
Parameters for creating connection.
This is not shareable connection. If the power app is shared with another user, another user will be prompted to create new connection explicitly.
Name | Type | Description | Required |
---|---|---|---|
API Key | securestring | The API Key for this api | True |
Name | Calls | Renewal Period |
---|---|---|
API calls per connection | 100 | 60 seconds |
Domain Enrichment (deprecated) [DEPRECATED] |
Domain Enrichment with Recorded Future data (deprecated) |
Domain Extension Enrichment (deprecated) [DEPRECATED] |
Domain Enrichment with Recorded Future Extension Partner data (deprecated) |
Hash Enrichment (deprecated) [DEPRECATED] |
Hash Enrichment with Recorded Future data (deprecated) |
Hash Extension Enrichment (deprecated) [DEPRECATED] |
Hash Enrichment with Recorded Future Extension Partner data (deprecated) |
IP Enrichment (deprecated) [DEPRECATED] |
IP Enrichment with Recorded Future data (deprecated) |
IP Extension Enrichment (deprecated) [DEPRECATED] |
IP Enrichment with Recorded Future Extension Partner data (deprecated) |
Lookup Alert Notification (deprecated) [DEPRECATED] |
Lookup Alert Notification (deprecated) |
Recorded Future Risk |
Recorded Future RiskList & Security Control Feeds Download (deprecated) |
Search Alert Notifications (deprecated) [DEPRECATED] |
Search Alert Notifications (deprecated) |
Search Alert Rules (deprecated) [DEPRECATED] |
Search Recorded Future UI Alert Rules (deprecated) |
SOAR API - Look up multiple entities (deprecated) [DEPRECATED] |
SOAR API - Look up multiple entities (Specific Access is Required) (deprecated) |
URL Enrichment (deprecated) [DEPRECATED] |
URL Enrichment with Recorded Future data (deprecated) |
URL Extension Enrichment (deprecated) [DEPRECATED] |
URL Enrichment with Recorded Future Extension Partner data (deprecated) |
Vulnerability Enrichment (deprecated) [DEPRECATED] |
Vulnerability Enrichment with Recorded Future data (deprecated) |
Vulnerability Extension Enrichment (deprecated) [DEPRECATED] |
Vulnerability Enrichment with Recorded Future Extension Partner data (deprecated) |
Domain Enrichment with Recorded Future data (deprecated)
Parameters
Name | Key | Required | Type | Description |
---|---|---|---|---|
Domain input
|
domain | True | string |
The domain to lookup. Must be a single domain |
Returns
Name | Path | Type | Description |
---|---|---|---|
intelCard
|
data.intelCard | string |
Recorded Future Intelligence Card Link |
criticalityLabel
|
data.risk.criticalityLabel | string |
Recorded Future Indicator Criticality Level |
score
|
data.risk.score | integer |
Recorded Future Indicator Risk Score |
evidenceDetails
|
data.risk.evidenceDetails | array of object |
evidenceDetails |
evidenceString
|
data.risk.evidenceDetails.evidenceString | string |
Recorded Future Risk Rules Evidence Details |
rule
|
data.risk.evidenceDetails.rule | string |
Recorded Future Indicator Risk Rules |
riskSummary
|
data.risk.riskSummary | string |
Recorded Future Risk Rules Summary |
Domain Enrichment with Recorded Future Extension Partner data (deprecated)
Parameters
Name | Key | Required | Type | Description |
---|---|---|---|---|
Domain input
|
domain | True | string |
The domain to lookup. Must be a single domain |
Extension to call
|
extension | True | string |
Extension to call |
Returns
Hash Enrichment with Recorded Future data (deprecated)
Parameters
Name | Key | Required | Type | Description |
---|---|---|---|---|
HASH input
|
hash | True | string |
The HASH to lookup. Must be a single HASH |
Returns
Name | Path | Type | Description |
---|---|---|---|
intelCard
|
data.intelCard | string |
Recorded Future Intelligence Card Link |
criticalityLabel
|
data.risk.criticalityLabel | string |
Recorded Future Indicator Criticality Level |
score
|
data.risk.score | integer |
Recorded Future Indicator Risk Score |
evidenceDetails
|
data.risk.evidenceDetails | array of object |
evidenceDetails |
evidenceString
|
data.risk.evidenceDetails.evidenceString | string |
Recorded Future Risk Rules Evidence Details |
rule
|
data.risk.evidenceDetails.rule | string |
Recorded Future Indicator Risk Rules |
riskSummary
|
data.risk.riskSummary | string |
Recorded Future Risk Rules Summary |
Hash Enrichment with Recorded Future Extension Partner data (deprecated)
Parameters
Name | Key | Required | Type | Description |
---|---|---|---|---|
HASH input
|
hash | True | string |
The HASH to lookup. Must be a single HASH |
Extension to call
|
extension | True | string |
Extension to call |
Returns
IP Enrichment with Recorded Future data (deprecated)
Parameters
Name | Key | Required | Type | Description |
---|---|---|---|---|
IP input
|
ip | True | string |
The IP address to lookup. Must be a single IP address |
Returns
Name | Path | Type | Description |
---|---|---|---|
intelCard
|
data.intelCard | string |
Recorded Future Intelligence Card Link |
criticalityLabel
|
data.risk.criticalityLabel | string |
Recorded Future Indicator Criticality Level |
score
|
data.risk.score | integer |
Recorded Future Indicator Risk Score |
evidenceDetails
|
data.risk.evidenceDetails | array of object |
evidenceDetails |
evidenceString
|
data.risk.evidenceDetails.evidenceString | string |
Recorded Future Risk Rules Evidence Details |
rule
|
data.risk.evidenceDetails.rule | string |
Recorded Future Indicator Risk Rules |
a
|
data.risk.riskSummary | string |
Recorded Future Risk Rules Summary |
IP Enrichment with Recorded Future Extension Partner data (deprecated)
Parameters
Name | Key | Required | Type | Description |
---|---|---|---|---|
Input IP
|
ip | True | string |
The IP address to lookup. Must be a single IP address |
Extension to call
|
extension | True | string |
Extension to call |
Returns
Lookup Alert Notification (deprecated)
Parameters
Name | Key | Required | Type | Description |
---|---|---|---|---|
Alert Notification ID
|
id | True | string |
Alert Notification ID |
Returns
Recorded Future RiskList & Security Control Feeds Download (deprecated)
Parameters
Name | Key | Required | Type | Description |
---|---|---|---|---|
Path to file
|
path | True | string |
Path to file |
Returns
Search Alert Notifications (deprecated)
Parameters
Name | Key | Required | Type | Description |
---|---|---|---|---|
Triggered
|
triggered | string |
All Elasticsearch compatible date formats are valid. |
|
Alert Rule ID
|
alertRule | True | string |
Alert Rule ID |
Maximum number of records
|
limit | integer |
Maximum number of records |
|
Records from offset
|
from | integer |
Records from offset |
Returns
- response
- string
Search Recorded Future UI Alert Rules (deprecated)
Parameters
Name | Key | Required | Type | Description |
---|---|---|---|---|
Freetext search
|
freetext | string |
Freetext search for Alert Rule Name |
|
Maximum number of records
|
limit | integer |
Maximum number of records |
Returns
Name | Path | Type | Description |
---|---|---|---|
results
|
data.results | array of object |
results |
Alert Rule Title
|
data.results.title | string |
title |
Alert Rule ID
|
data.results.id | string |
id |
Returned Number of Alert Rules
|
counts.returned | integer |
returned |
Total Number of Alert Rules
|
counts.total | integer |
total |
SOAR API - Look up multiple entities (Specific Access is Required) (deprecated)
Parameters
Name | Key | Required | Type | Description |
---|---|---|---|---|
ip
|
ip | array of string |
ip |
|
url
|
url | array of string |
url |
|
domain
|
domain | array of string |
domain |
|
hash
|
hash | array of string |
hash |
|
vulnerability
|
vulnerability | array of string |
vulnerability |
Returns
- response
- string
URL Enrichment with Recorded Future data (deprecated)
Parameters
Name | Key | Required | Type | Description |
---|---|---|---|---|
URL input
|
url | True | string |
The URL to lookup. Must be a single URL |
Returns
Name | Path | Type | Description |
---|---|---|---|
criticalityLabel
|
data.risk.criticalityLabel | string |
Recorded Future Indicator Criticality Level |
score
|
data.risk.score | integer |
Recorded Future Indicator Risk Score |
evidenceDetails
|
data.risk.evidenceDetails | array of object |
evidenceDetails |
evidenceString
|
data.risk.evidenceDetails.evidenceString | string |
Recorded Future Risk Rules Evidence Details |
rule
|
data.risk.evidenceDetails.rule | string |
Recorded Future Indicator Risk Rules |
riskSummary
|
data.risk.riskSummary | string |
Recorded Future Risk Rules Summary |
URL Enrichment with Recorded Future Extension Partner data (deprecated)
Parameters
Name | Key | Required | Type | Description |
---|---|---|---|---|
URL input
|
url | True | string |
The URL to lookup. Must be a single URL |
Extension to call
|
extension | True | string |
Extension to call |
Returns
Vulnerability Enrichment with Recorded Future data (deprecated)
Parameters
Name | Key | Required | Type | Description |
---|---|---|---|---|
Vulnerability ID (CVE, name) input
|
id | True | string |
The Vulnerability ID (CVE, name) to lookup. Must be a single Vulnerability ID (CVE, name) |
Returns
Name | Path | Type | Description |
---|---|---|---|
intelCard
|
data.intelCard | string |
Recorded Future Intelligence Card Link |
criticalityLabel
|
data.risk.criticalityLabel | string |
Recorded Future Vulnerability Criticality Level |
score
|
data.risk.score | integer |
Recorded Future Vulnerability Risk Score |
evidenceDetails
|
data.risk.evidenceDetails | array of object |
evidenceDetails |
evidenceString
|
data.risk.evidenceDetails.evidenceString | string |
Recorded Future Risk Rules Evidence Details |
rule
|
data.risk.evidenceDetails.rule | string |
Recorded Future Vulnerability Risk Rules |
riskSummary
|
data.risk.riskSummary | string |
Recorded Future Risk Rules Summary |
Vulnerability Enrichment with Recorded Future Extension Partner data (deprecated)
Parameters
Name | Key | Required | Type | Description |
---|---|---|---|---|
Vulnerability ID (CVE, name) input
|
id | True | string |
The Vulnerability ID (CVE, name) to lookup. Must be a single Vulnerability ID (CVE, name) |
Extension to call
|
extension | True | string |
Extension to call |
Returns
This is the basic data type 'string'.