Recorded Future

The Recorded Future Risk List job app takes advantage of new API endpoints and ingests the IP, Domain, and Hash Risk Lists from Recorded Future into ThreatConnect as a contextualized intelligence source. The ThreatConnect integration with the Recorded Future Risk List allows ThreatConnect to ingest Address, Host, and File Indicators that Recorded Future has added to its Risk List and enriches the Indicators with sourcing information, allowing analysts to have an improved context as well as a place to start their research when correlating Indicators from an incident.

The Recorded Future enrichment playbook app will accept addresses and host indicators and will query the Recorded Future Cyber API for enrichment. Returned data is passed to downstream playbook components in the form of output variables.

These apps can be found in the ThreatConnect App Catalog under the following names: Recorded Future (Playbook) and Recorded Future Risk List (Organization).