Contacting Our Support Team for Integration Support

Updated

Ticket Submission

Recorded Future's Product Support team is available 24/7 to address any concerns you have with a particular integration application, or to request a new Integration/API token.  Channels of communication and SLAs are specifically referenced in our Support at Recorded Future article.

To get optimal support for issues with our Product Integrations, you'll want to use the Integration Support ticket form.  This form will allow you to provide information specific to the integration you're working with, and any specific instance or environment information that will be helpful for our support team.

In addition, if submitting a product defect, please make sure to also include:

  • Steps to reproduce
  • Screenshots of the issue
  • Error messages or logs
  • Business impact so we can properly assess urgency
  • Any historical challenges or customizations with the integration implementation that could be helpful to the support team
  • For integrations-specific issues, please additionally provide as much of the following information as possible:

    • Version of{SIEM, SOAR, TIP, ETC Edit to fit use case}Application 

      • i.e Splunk 8.0.0, ServiceNow Madrid 

    • Version of Installed Recorded Future Integration 

      • i.e. Splunk Enterprise v5.0.10, Splunk 2.1.1, ServiceNow Vulnerability Response 1.1.1

    • If this is post-upgrade, please share what version of the integration application and Recorded Future Application were in place prior to the upgrade

    • Confirm the API endpoint in use 

    • The last 6 digits of the API key in use

    • Error logs and/or screenshots of the error

    • When did you first notice this issue? Has anything changed in your environment?

    • Is this error reproducible each time?

    • Are any elements of the integration working, or is it totally non functional?

    • What use-case or process are you attempting to perform, listing steps or providing a brief screen recording?

    • Is there a specific API call or curl that the integration is attempting to perform?

      • i.e

        https://api.recordedfuture.com/v2/malware/search?limit=10
        or 
        curl -H "X-RFToken: [API token]" "https://api.recordedfuture.com/v2/malware/search?limit=10"

From there, our team will begin triage and any applicable escalations with commence from there, if we cannot resolve the issue outright at the start.

If requesting a new token, please choose "Upgrade" or "New Installation" from the "Select Your Problem" menu, once choosing the affected integrations in the related dropdown fields.  This is covered in more detail here.

 

Premier Integrations (Recorded Future Owned Integrations)

When submitting issues to support for our Premium / Recorded Future owned integrations, our guidelines are as follows when triaging a support case:

  • Recorded Future provides installation, configuration, and troubleshooting support
  • The client is responsible for, at a minimum, technical resources to perform the integration

Our list of supported Premier integrations can be found here.

Note: If you would like to request a new Integration not part of the supported Premier Integration list, please submit a New Integration Development Request for our Product Management team. Click here to submit a ticket for review.

 

Connect Partner Integrations

The Recorded Future Connect Partner Technology Program is an integration category that consists of partner-owned, partner-built integrations where technology partners leverage the Recorded Future API to build and maintain integrations with their solution(s). 

As part of the Connect Program, our support guidelines are as follows when triaging a support case:

  • The partner is responsible for the overall support of the integration
  • Recorded Future is responsible for APIs that support these integrations
  • The partner and Recorded Future work together to certify the integration from a technical and marketing standpoint. A "certified" Connect integration is one that meets those requirements and Recorded Future has confidence in
  • The client should work with the partner around the installation, configuration, and troubleshooting of any issues

Field Enabled / Partner Owned Integrations

Field enabled or partner owned integrations, are where our clients are responsible for performing the integration implementation, with provided API access from Recorded Future.  Our support guidelines are as follows when triaging a support case:

  • We have field experience integrating, but not out-of-the-box turnkey solutions
  • We will provide API support and any install/configuration information, if available
  • The client is responsible for the installation, configuration, and troubleshooting
    • Professional Services support can be purchased to assist with these tasks
  • It’s highly recommended that the client has internal/external expertise around the product

Intelligence Card Extension Integrations

As part of our Connect partnership program, we have teamed with select intelligence providers to develop intelligence card extensions for our mutual clients.  To use Intelligence Card Extensions, your organization must have API access to the partner's threat intelligence service.  More details can be found on our extension overview and getting started articles.  Our support guidelines are as follows when triaging a support case:

  • We will provide assistance in install/configuration of the extension
  • The extension partner is responsible for API token support for tokens created on the partner's site

 

This content is confidential. Do not distribute or download content in a manner that violates your Recorded Future license agreement. Sharing this content outside of licensed Recorded Future users constitutes a breach of the terms and/or agreement and shall be considered a breach by your organization.
Was this article helpful?
0 out of 0 found this helpful

Articles in this section