Recorded Future Intelligence Cloud features are only available to clients running Recorded Future Intelligence for SNOW SIR / TI with Recorded Future Security Operations Foundation Framework v1.8.0+
Collective Insights can be enabled when setting up the Recorded Future for Servicenow SIR/TI integration. The setting is part of Recorded Future Security Operations Foundation Framework and can be found as part of SIR - Observable Enrichment under Recorded Future Integration Connector of Recorded Future for Servicenow SIR/TI application. The checkbox 'Collective Insights' needs to be checked in order to send the writeback data to Intelligence Cloud. Please note that in case of Recorded Future for Servicenow SIR/TI integration, every indicator in an incident is automatically enriched with Recorded Future due to which we will be sending all the indicators part of all the security incidents except Recorded Future Alert based security incidents to the Intelligence Cloud.
Setup Collective Insights in Servicenow
Servicenow is one of premier integrations from Recorded Future that has native support for Collective Insights and this is controlled by a checkbox in the Configuration page of Recorded Future API Connector which is turned on by default.
Recorded Future for Servicenow Data Mappings for Collective Insights
As part of Collective Insights, anonymized data will be collected from all the Servicenow security incidents (except Recorded Future Alert based security incidents) including
- Incident - Type, ID
- Indicator - Type, Name
Note: Indicators enriched on-demand via Recorded Future but not part of any security incident are not collected as part of Collective Insights
See 'Getting Started with Collective Insights' to learn more about the benefits of Collective Insights