Threat Intelligence Engine for Recorded Future Integration User Guide

Overview

The ThreatConnect® integration with Recorded Future® ingests Risk List entities (Domain, Hash, IP, URL, and Vulnerability), Threat Map entities (Malware and Actor), Alert (Standard and Playbook) entities, and Analyst Notes from Recorded Future. It then creates corresponding objects with select Recorded Future metadata in ThreatConnect.

Dependencies

ThreatConnect Dependencies

• Active ThreatConnect Application Programming Interface (API) key
• ThreatConnect instance with version 7.6.2 or newer installed

Recorded Future Dependencies

• Active Recorded Future API token
  Important

  Follow the instructions in the “Setup” section of the Recorded Future Get Started guide to generate a Recorded Future API token. You must be an Enterprise Admin in Recorded Future to generate a Recorded Future API token. Refer to the Recorded Future Get Started guide for information on the entitlements assigned to the API token, based on the modules included in your Recorded Future subscription.
• Active Recorded Future module subscriptions:
  • Risk List: SecOps Intelligence, Threat Intelligence, and/or Vulnerability Intelligence (see the “Risk List Types” row in Table 1 for more information)
  • Threat Map: Threat Intelligence module
  • Standard Alerts: The required subscription varies by module. Please refer to the Recorded Future documentation (requires a login to view) for more information.
  • Playbook Alerts: The required subscription varies by module. Please refer to the Recorded Future documentation (requires a login to view) for more information.

Application Setup and Configuration

Follow these steps to install the ThreatConnect Intelligence Engine for Recorded Future App

1. Identify the version of the ThreatConnect integration with Recorded Future you have deployed as a Service on your ThreatConnect instance.
2. If Version 1 is deployed as a Service, turn off and delete the Service for Version 1.
3. Install and configure Version 2.

Step 1: Identify Deployed App Version

There are two versions of the ThreatConnect integration with Recorded Future:

• Version 1: Recorded Future Intelligence Engine 1.0.x (deprecated)
• Version 2: Threat Intelligence Engine for Recorded Future 2.0.x (formerly Recorded Future Intelligence Engine 2.0.x)

Follow these steps to determine the version of the ThreatConnect integration with Recorded Future that is deployed as a Service on your ThreatConnect instance:

1. Log into ThreatConnect with a System Administrator account.
2. From the Automation & Feeds menu on the top navigation bar, select Services.
3. Enter recorded future in the Name search bar at the top of the Services screen. The App name returned by the search results (Recorded Future Intelligence Engine for Version 1; Threat Intelligence Engine for Recorded Future for Version 2) identifies the version of the ThreatConnect integration with Recorded Future that is deployed as a Service on your ThreatConnect instance (or, if no results are returned, then you do not have any version of the App deployed as a Service on your ThreatConnect instance):
   • Recorded Future Intelligence Engine: Version 1
   • Threat Intelligence Engine for Recorded Future: Version 2

Step 2: Turn Off and Delete the Service for Version 1

Follow these steps to turn off and delete the Service for the Recorded Future Intelligence Engine (Version 1) App:

1. Log into ThreatConnect with a System Administrator account.
2. From the Automation & Feeds dropdown on the top navigation bar, select Services.
3. Locate the Recorded Future Intelligence Engine Feed Service.
4. Turn off the toggle in the Type column.
5. Select Delete from the Options ⋮ menu for the Service.
6. Click Delete in the Delete Service? window to delete the Service for Recorded Future Intelligence Engine.

Step 3: Install and Configure Version 2

Follow these steps to install and configure the Threat Intelligence Engine for Recorded Future (Version 2) App via TC Exchange™:

1. Log into ThreatConnect with a System Administrator account.
2. From the Settingsmenu on the top navigation bar, select TC Exchange Settings. Then select the Catalog tab on the TC Exchange Settings screen.
3. Locate the Threat Intelligence Engine for Recorded Future App on the Catalog tab. Then click Installin the Options column to install the App.
4. After you install the Threat Intelligence Engine for Recorded Future App, the Feed Deployer will open automatically. Use the Feed Deployer to set up and configure the App. See the “Configuration Parameters” section for more information on the parameters available during the configuration and deployment process.
   Important

   If you turned off and deleted the Service for the Recorded Future Intelligence Engine (Version 1) App in Step 2, make sure to enter the name of the Source used for the Recorded Future Intelligence Engine App in the Sources to Create field on the Source tab of the Feed Deployer window. If you enter a different name, then a new Source will be created for data ingestion from the Threat Intelligence Engine for Recorded Future (Version 2) App.

Configuration Parameters

Parameter Definitions

The parameters defined in Table 1 apply to the configuration parameters available when using the Feed Deployer to configure the Threat Intelligence Engine for Recorded Future App.

Threat Intelligence Engine for Recorded Future UI

After installing and deploying the Threat Intelligence Engine for Recorded Future App, you can access the Threat Intelligence Engine for Recorded Future user interface (UI), where you can manage data ingestion from Recorded Future into ThreatConnect.

Follow these steps to access the Threat Intelligence Engine for Recorded Future UI:

1. Log into ThreatConnect with a System Administrator account.
2. From the Automation & Feeds dropdown on the top navigation bar, select Services.
3. Locate and turn on the Threat Intelligence Engine for Recorded Future Feed Service.
4. Click the link in the Service’s API Path field. The Threat Intelligence Engine for Recorded Future UI will open in a new browser tab.

The following screens are available in the Threat Intelligence Engine for Recorded Future UI:

• Dashboard
• Jobs
• Tasks
• Download
• Batch Errors
• Attachment Status

Dashboard

The Dashboard screen (Figure 1) provides an overview of the total number of Risk List entities (Domain, Hash, IP, URL, and Vulnerability), Threat Map entities (Malware and Intrusion Set), Alert entities (Event and Document) and Analyst Notes (Report, Email Address, Domain, Hash, IP, URL, Vulnerability, Malware, and Intrusion Set) retrieved from Recorded Future. Depending on the available data, cards representing all or a subset of these object types will be displayed on the Dashboard screen.

Jobs

The Jobs screen (Figure 2) breaks down the ingestion of Recorded Future data into manageable Job-like tasks, displaying all processes that are pending, in progress, complete, and failed. The ⋯ menu in a Job’s row provides the following options:

• Details: View details for the Job, such as counts of downloaded and batched Groups and start and end times for Alert monitoring, download, and upload.
• Download Files: Download metadata files for all Jobs and data (convert, download, and upload) files for completed Jobs.
• Batch Errors: View errors that have occurred for the Job on the Batch Errors screen.

You can filter Threat Intelligence Engine for Recorded Future App Jobs by the following elements:

• Job ID: Enter text into this box to search for a Job by its Job ID.
• Job Type: Select Job types to display on the Jobs screen. 
• Status: Select Job statuses to display on the Jobs screen.
• Pipeline: Select the pipeline types to display on the Jobsscreen:
  • alerts: Alert entities
  • analyst_note: Analyst Note entities
  • threat_intel: Risk List and Threat Map entities

Add a Job

You can add ad-hoc Jobs on the Jobs screen. Follow these steps to create a request for an ad-hoc Job for the Threat Intelligence Engine for Recorded Future App:

1. Click Add Job (Figure 2).
2. Fill out the fields on the Add Job drawer (Figure 3) as follows: 

    

   • Risklist Types: (Optional) Select the Risk List entity types to include in the ad-hoc Job.
   • Threat Map Types: (Optional) Select the Threat Map entity types to include in the ad-hoc Job.
   • Alert Types: (Optional) Select the Alert entity types to include in the ad-hoc Job.
   • Alert Start Time: (Optional) Enter the time at which monitoring for triggered Alerts should start.
     Note

     Alert Start Time applies only to Alert entities. If no value is specified, the 1000 most recent Alerts will be downloaded.
   • Alert End Time: (Optional) Enter the time at which monitoring for triggered Alerts should end.
     Note

     Alert End Time applies only to Alert entities. If no value is specified, the 1000 most recent Alerts will be downloaded.
   • Download Analyst Notes: (Optional) Select Yes to download Analyst Notes for the selected Risklist Types.
   • Analyst Note Timeframe: (Optional) Enter the timeframe for which Analyst Notes should be downloaded, using one of the following formats:
     Note

     If you do not enter a value, then the default value of -1d will be used.
     • Absolute date: Enter a date in YYYYMMDD format. Analyst Notes published on or after that date will be downloaded.
       Example

       The following format variations provide valid input:

       • 20250908
       • 2025-09-08
       • 2025-9-8
     • Relative date: Enter a lookback time window. Analyst Notes published on or after the date and time at which the lookback window begins will be downloaded. The lookback window must start with a minus sign (-) to indicate that the window is historic.
       Example

       The following format variations provide valid input:

       • -3d
       • -2d 50m
       • -0d 50m 30s
3. Click Submit to submit the request for the ad-hoc Job.

Tasks

The Tasks screen (Figure 4) displays all Tasks that may be part of a Job, including each step of the download, convert, and upload processes, as well as Tasks for the Threat Intelligence Engine for Recorded Future App, such as Monitor, Scheduler, and Cleaner. The current status (Idle, Paused, or Running), name, description, and heartbeat timeout length, in minutes, are displayed for each Task. The ⋯ menu in a Task’s row provides the following options, depending on the Task’s status:

• Run (idle and paused Tasks only)
• Pause (idle and running Tasks only)
• Resume (paused Tasks only)
• Kill (running Tasks only)

Under the table is a dashboard where you can view runtime analytics.

Download

The Download screen (Figure 5) lets you download JavaScript® Object Notation (JSON) data for Recorded Future entities and then upload the data into ThreatConnect.

Follow these steps to download JSON data for a Recorded Future entity on the Download screen and then upload the data into ThreatConnect:

1. Recorded Future Type: Select a Recorded Future entity type from the following options: IPAddress (IP), URL, Hash, InternetDomainName (Domain), CyberVulnerability (Vulnerability), Analyst Note, Malware, Actor, StandardAlert, Playbook Alert: Domain Abuse, Playbook Alert: Vulnerability, Playbook Alert: Third Party Risk, Playbook Alert: Data Leak On Code Repo, Playbook Alert: Malware Report, Playbook Alert: Geopolitics Facility, and Playbook Alert: Identity Novel Exposures.
2. External ID: Enter the ID for the Recorded Future entity of the selected type. For IP, URL, Hash, and Domain Risk List entities, prepend ip:, url:, hash:, and idn:, respectively, to the entity's ID. For Vulnerability Risk List entities, use the CVE ID or Recorded Future ID. The following examples demonstrate the ID format for each Recorded Future entity type:
   • IPAddress: ip:124.71.84.65
   • URL: url:https://send.exploit.in/
   • Hash: hash:092910024190a2521f21658be849c4ac9ae6fa4d5f2ecd44c9055cc353a26875
   • InternetDomainName: idn:efavengh.com
   • CyberVulnerability: CVE-2019-0841or ZgFn9x
   • Analyst Note: 4gSsx8
   • Malware: l3moPJ
   • Actor: eTMnra
   • StandardAlert: -QfHWt
   • Playbook Alerts: task:09e6c192-0f88-4f3e-813c-f6b73bbc95a4
     Note

     All Playbook Alert types have the same ID format.
3. Click Download. The JSON data will be displayed in two columns: Results (raw JSON data) and Converted (JSON data in ThreatConnect batch format) (Figure 6).

    

4. Click Upload to submit the converted threat intelligence data via the ThreatConnect Batch API.

Batch Errors

The Batch Errors screen (Figure 7) displays an overview of the batch error types that have occurred for Job requests. You can enter keywords to filter by Job ID.

Select an error type to open a drawer containing a table with details on all batch errors of that type (Figure 8). You can enter keywords to filter by reason for error.

Attachment Status

The Attachment Status screen (Figure 9) displays a table with details on ThreatConnect's attempts to download Report attachments from Recorded Future.  You can enter keywords to filter the table by the Recorded Future Group ID, which can be useful if you do not see a Recorded Future attachment in ThreatConnect as expected, or by status.

Data Mappings

The data mappings in Table 2 through Table 18 illustrate how data are mapped from Recorded Future Intelligence API endpoints into the ThreatConnect data model.

Domain

ThreatConnect object type: Host Indicator

Hash

ThreatConnect object type: File Indicator

IP

ThreatConnect object type: Address Indicator

URL

ThreatConnect object type: URL Indicator

Vulnerability

ThreatConnect object type: Vulnerability Group

Analyst Note

ThreatConnect object type: Report Group

Note Entity

ThreatConnect object type: Report Group

Actor

ThreatConnect object type: Intrusion Set Group

Malware

ThreatConnect object type: Malware Group

Standard Alerts

ThreatConnect object type: Event Group

Playbook Alerts: Domain Abuse

ThreatConnect object type: Event Group

Playbook Alerts: Vulnerability

ThreatConnect object type: Event Group

Playbook Alerts: Third Party Risk

ThreatConnect object type: Event Group

Playbook Alerts: Data Leak on Code Repo

ThreatConnect object type: Event Group

Playbook Alerts: Malware Report

ThreatConnect object type: Event Group

Playbook Alerts: Geopolitics Facility

ThreatConnect object type: Event Group

Playbook Alerts: Identity Novel Exposures

ThreatConnect object type: Event Group

Risk Score Mappings

ThreatConnect follows the Criticality mapping in Recorded Future when assigning a Threat Rating to data ingested from Recorded Future; however, because the Recorded Future Criticality rating goes only from 0–4, it has been augmented by 1 in ThreatConnect to fit the 0–5 scale for Threat Rating. Table 19 shows how the Recorded Future risk scores are mapped to Threat Rating in ThreatConnect.

Frequently Asked Questions (FAQ)

Why are there several URL errors in the batch errors report? (e.g., [xyz.com] could not be processed as a valid URL due to missing or invalid data (summary is invalid for the given type))

URL errors occur when URL objects coming from Recorded Future use an invalid URL format. Some examples of this behavior include the following:

• ww3.xyz.com: This URL is missing the protocol, such as http://.
• http:ww2.xyz.com/page#: This URL is terminated with a special character.

URL objects with an invalid URL format will not be imported into ThreatConnect. Note that this issue occurs rarely.

Why are Indicators with risk scores that are less than the minimum risk score being ingested into ThreatConnect?

Indicators with risk scores that are less than the minimum risk score are ingested because they exist as links from other Risk List entities. To prevent Indicators with a risk score less than the minimum risk score (i.e., the value for the App's Minimum Risk Score parameter) from being ingested, clear the Collect Indicators Linked in Recorded Future Less Than the Minimum Risk Score checkbox in the Feed Deployer when configuring and deploying the App.

How does the Threat Intelligence Engine for Recorded Future Feed API Service App differ from the Recorded Future Risk List Job App?

The Recorded Future Risk List Job App does the following:

• collects data from Risk List entities
• creates Indicators with evidence details
• maps evidence details to a Description Attribute and risk rules to Tags

The Threat Intelligence Engine for Recorded Future Feed API Service App collects data in the following ways:

• ingests Risk List entities with several of their Attributes
• ingests all of the Analyst Notes and attached PDFs associated with Risk List entities
• ingests associated Risk List entities and allows you to view the first-level associations created between the entities and Analyst Notes (i.e., the actual link)
• obtains a link to each Risk List entity's Recorded Future Intelligence Card
• ingests Analyst Notes that have been published in the last 24 hours daily

For more information on how Feed API Service Apps function in ThreatConnect, see Feed API Services.

How long does the Threat Intelligence Engine for Recorded Future Feed API Service App take to ingest a complete set of data on its initial run?

In most cases, the Threat Intelligence Engine for Recorded Future App takes 2–4 days to complete the initial data ingestion, depending on how you configure risk score and which Risk List entity types you select to ingest in the Feed Deployer.

In which order are Risk List entities ingested on the initial run?

On the initial run of the Threat Intelligence Engine for Recorded Future App, Risk List entities are ingested in the following order:

1. Domain
2. Hash
3. IP
4. URL
5. Vulnerability

You will likely see Risk List entities ingested in chunks along with the associated or linked entities. Note that there may be delays between the creation of the Risk List source entities and the Risk List link entities in ThreatConnect.

How often does the Threat Intelligence Engine for Recorded Future App ingest each Risk List entity type after the initial run?

See Table 20 for each Risk List entity type's download frequency. Analyst Notes are downloaded daily.

How can I identify where the Threat Intelligence Engine for Recorded Future App collected Indicators and Groups from in Recorded Future?

The following "Source: " Tags, which are applied to Indicators and Groups in ThreatConnect that were ingested from Recorded Future, indicate where the integration collected them from in Recorded Future:

• Source: Risk List: The entity was ingested from a Risk List.
• Source: Risk List Link: The entity was ingested as a linked entity from a Risk List entity.
• Source: Analyst Note: The entity was ingested from an Analyst Note.
• Source: Analyst Note Link: The entity was ingested as a linked entity from an Analyst Note.
• Source: RF Alert: The entity was ingested from a Standard Alert.
• Source: RF Alert Link: The entity was ingested as a linked entity from a Standard Alert.
• Source: RF Threat Map: The entity was ingested from a Threat Map entity.
• Source: RF Threat Map Link: The entity was ingested as a linked entity from a Threat Map entity.
• Source: RF PB Alert: The entity was ingested from a Playbook Alert.
• Source: RF PB Alert Link: The entity was ingested as a linked entity from Playbook Alert.

Note that an Indicator or Group may have more than one of these Tags applied to them, as the corresponding entities could be associated to one another.

ThreatConnect^® is a registered trademark, and TC Exchange™ is a trademark, of ThreatConnect, Inc.
JavaScript^® is a registered trademark of Oracle Corporation.
Recorded Future^® is a registered trademark of Recorded Future, Inc.
MITRE ATT&CK^® and ATT&CK^® are registered trademarks of The MITRE Corporation.

30083-03 EN Rev. A