Account Types: Express, Core and Advanced

Recorded Future has three user account types: ExpressCore and Advanced.

Express accounts give access to the Recorded Future browser extension, which allow security analyst to enrich any browser page with risk scores and corresponding risk rules.

Core accounts give access to Intelligence Cards and Alert Notifications. Core accounts are optimal for security practitioners such as SOC analysts and Incident Responders, who investigate alert rule notifications, indicators, and incident artifacts and generally refer more open-ended external threat investigations to their TI analyst colleagues.

Advanced user accounts give broad access to investigation, analysis, alerting, and reporting capabilities. Advanced accounts are optimal for Threat Intelligence analysts, who need to interactively investigate emerging threats and define precisely tailored alert rules. Advanced user accounts are required for additional access to Cyber and Locations Threat Views.

The table below compares access levels for Core and Advanced accounts.

Capability Express Core Advanced
Browser Extension Yes Yes Yes
Mobile App   Yes Yes
Intelligence Cards   Yes Yes
Intelligence Card Extensions   Yes Yes
Drill down to event details from Intelligence card or alert   Yes  Yes
View all Threat Views   Yes Yes
Alerts and Alert Emails   Yes Yes
Source Requests   Yes Yes
View configuration items shared by Analysts   Yes Yes
Write Analyst Notes   Yes Yes
 ------    ---  ---
Search Entities   IPs, Domains, URLs, Hashes, Email Addresses, Vulnerabilities, Malware, Threat Actors and Companies All entity types
Create ad-hoc searches in Analyze mode     Yes
Create Alerting Rules     Yes
Save ad-hoc searches as Saved Queries     Yes
Manage Lists of Entities, Sources, References     Yes
Create Reports     Yes
Create Link Collections     Yes
Share configurations with other users     Yes
 ------    --- --- 
Cyber Threat Views   With subscription With subscription
Locations Threat Views   With subscription  With subscription
Geofences     With subscription


With subscription means Advanced users can access the capability, depending on their organization's service subscriptions.

Was this article helpful?
1 out of 2 found this helpful

This content is confidential. Downloading or distributing this content is in violation of your Recorded Future license agreement. Sharing this content outside of licensed Recorded Future users constitutes a breach of the terms and/or agreement and shall be considered a breach by your organization.
Have more questions? Submit a request


  • If there are features the 'Analyst' has over 'Security Operations', there needs to be help or documents on those (i.e. "Create Alerting Rules").

    Comment actions Permalink
  • Hi E-SME - you can find documentation on features at the Advanced seat level (formerly called 'Full Analyst') using search on this site. The docs on alerting, for example, are here:

    We will also take your comment as feedback that this page will be more useful if we add links from features in this table to the related docs pages, so there is no need to use site search.

    Comment actions Permalink

Please sign in to leave a comment. Please note that your name will be displayed. If you would like to change how your name appears, please update your profile name.