Account Types: Express, Core and Advanced

Recorded Future has two basic types of user accounts: ExpressCore and Advanced.

Express accounts give access to the Recorded Future browser extension, which allow security analyst to enrich any browser page with risk scores and corresponding risk rules.

Core accounts give access to Intelligence Cards and Alert Notifications. Core accounts are optimal for security practitioners such as SOC analysts and Incident Responders, who investigate alert rule notifications, indicators, and incident artifacts and generally refer more open-ended external threat investigations to their TI analyst colleagues.

Advanced user accounts give broad access to investigation, analysis, alerting, and reporting capabilities. Advanced accounts are optimal for Threat Intelligence analysts, who need to interactively investigate emerging threats and define precisely tailored alert rules. Advanced user accounts are required for additional access to Cyber and Locations Threat Views.

The table below compares access levels for Core and Advanced accounts.

Capability Core Advanced
Intelligence Cards Yes Yes
Intelligence Card Extensions Yes Yes
Drill down to event details from Intelligence card or alert Yes  Yes
View all Threat Views Yes Yes
Alerts and Alert Emails Yes Yes
Source Requests Yes Yes
View configuration items shared by Analysts Yes Yes
Write Analyst Notes Yes Yes
 ------  ---  ---
Search Entities IPs, Domains, URLs, Hashes, Email Addresses, Vulnerabilities, Malware All entity types
Create ad-hoc searches in Analyze mode No Yes
Create Alerting Rules No Yes
Save ad-hoc searches as Saved Queries No Yes
Manage Lists of Entities, Sources, References No Yes
Create Reports No Yes
Create Link Collections No Yes
Share configurations with other users No Yes
 ------  --- --- 
Cyber Threat Views   With subscription
Locations Threat Views   With subscription
Geofences   With subscription


With subscription means Advanced users can access the capability, depending on their organization's service subscriptions.

Was this article helpful?
1 out of 2 found this helpful

The content of this article is confidential and intended solely for the use of individuals with authorized access to the Recorded Future service. Do not download or distribute this article.
Have more questions? Submit a request


  • If there are features the 'Analyst' has over 'Security Operations', there needs to be help or documents on those (i.e. "Create Alerting Rules").

  • Hi E-SME - you can find documentation on features at the Advanced seat level (formerly called 'Full Analyst') using search on this site. The docs on alerting, for example, are here:

    We will also take your comment as feedback that this page will be more useful if we add links from features in this table to the related docs pages, so there is no need to use site search.

Please sign in to leave a comment. Please note that your name will be displayed. If you would like to change how your name appears, please update your profile name.