Pivoting to Recorded Future Enrichment Data in Splunk

These instructions will show you how to add a workflow actions for easy pivoting to enrichment data from any event in Splunk.  Here we assume you have already installed the Splunk Enterprise integration from Recorded Future.

 

This is a typical event view within the search app in Splunk, notice there are limited actions available:

screenshot1.png 

screenshot2.png

It is important to note the fields you want to enrich. In this case we will use “dst” as this is the destination point for traffic going through our firewall originating from our network. 

Step 1: Go to Settings>Fields on your Splunk Search Head:

screenshot3-.png

 

Step 2. Select “Add new” to the right of Workflow actions:

screenshot4-.png

 

Step 3. Select the destination app as “TA_recordedfuture-cyber” NOTE: You can select other apps as the destination, we recommend this for organization only and possible role based access controls only:

screenshot5.png

Step 4. Select a unique name for your workflow action:

screenshot6.png

Step 5. Select a label for your Workflow Action. NOTE: You can use the variable ($dst$)in this field to have the menu say “RF Enrich IPADDRESS(Used in this example)” or use a static value like “RF destination enrichment”

screenshot7.png

Step 6. Select the field we wish to enrich:

screenshot8.png

Step 7. If you want to restrict to specific event types enter them here, else leave this blank. NOTE: Event types are typically defined as part of a TA or App, event types can be created by any search. Example - Creating an event type named fwaccepts with a search string of “index=extfws sourcetype=netscreen:firewall action=allowed” would allow you to restrict the workflow from displaying for any traffic from other devices or any dropped traffic from the firewall.

screenshot9.png

Step 8. Select show action in Both and action type of link in the dropdown menus.

screenshot10.png

Step 9. Enter http://yoursearchhead.company.com/en-US/app/TA_recordedfuture-cyber/recorded_future_ip_enrichment?form.name=$dst$ into the URI where yoursearchhead.company.com is the DNS name for your Splunk Search Head. NOTE: We are replacing the end with the variable name from our selected field “$dst”:

screenshot11.png  

Step 10. Select Open link to “New Window” and Link Method to “Get” in the dropdown menus:

screenshot12.png

Step 11. Select “Save” in the bottom right corner to save your Workflow Action:

screenshot13-.png

 

After the new Workflow action is saved, it is setup to private only within the Recorded Future App:

screenshot14-.png

Step 12. Select Permissions to the right of the Workflow Actions.

Step 13. Select “All apps” to enable the pivot from other Splunk apps, the appropriate “Role permissions” for the Workflow Action, and then select save:

screenshot15-.png

 

Step 14. Select an event (in any app if permissions are set to global.) You should now see your Workflow Action available through the event menus:

screenshot16.png 

screenshot17.png

When you select the action you will be presented with a new window/tab with the entity enrichment dashboard:

screenshot18.png

If you have any questions or need assistance please reach out to [email protected]

Was this article helpful?
0 out of 0 found this helpful

The content of this article is confidential and intended solely for the use of individuals with authorized access to the Recorded Future service. Do not download or distribute this article.
Have more questions? Submit a request

Comments

0 comments

Please sign in to leave a comment. Please note that your name will be displayed. If you would like to change how your name appears, please update your profile name.