Recorded Future has two basic types of user accounts: Express, Core and Advanced.
Express accounts give access to the Recorded Future browser extension, which allow security analyst to enrich any browser page with risk scores and corresponding risk rules.
Core accounts give access to Intelligence Cards and Alert Notifications. Core accounts are optimal for security practitioners such as SOC analysts and Incident Responders, who investigate alert rule notifications, indicators, and incident artifacts and generally refer more open-ended external threat investigations to their TI analyst colleagues.
Advanced user accounts give broad access to investigation, analysis, alerting, and reporting capabilities. Advanced accounts are optimal for Threat Intelligence analysts, who need to interactively investigate emerging threats and define precisely tailored alert rules. Advanced user accounts are required for additional access to Cyber and Locations Threat Views.
The table below compares access levels for Core and Advanced accounts.
|Intelligence Card Extensions||Yes||Yes|
|Drill down to event details from Intelligence card or alert||Yes||Yes|
|View all Threat Views||Yes||Yes|
|Alerts and Alert Emails||Yes||Yes|
|View configuration items shared by Analysts||Yes||Yes|
|Write Analyst Notes||Yes||Yes|
|Search Entities||IPs, Domains, URLs, Hashes, Email Addresses, Vulnerabilities, Malware||All entity types|
|Create ad-hoc searches in Analyze mode||No||Yes|
|Create Alerting Rules||No||Yes|
|Save ad-hoc searches as Saved Queries||No||Yes|
|Manage Lists of Entities, Sources, References||No||Yes|
|Create Link Collections||No||Yes|
|Share configurations with other users||No||Yes|
|Cyber Threat Views||With subscription|
|Locations Threat Views||With subscription|
With subscription means Advanced users can access the capability, depending on their organization's service subscriptions.