An inconsistency was detected in the sources: variants or an invalid file. Check the files and commit shown below.
Description
Imports Recorded Future data into Microsoft Sentinel via the Log Ingestion API. Writes playbook alerts to `RecordedFuturePlaybookAlerts_V2_CL`, classic alerts to `RecordedFutureClassicAlerts_V2_CL`, threat map data to `RecordedFutureThreatMap_V2_CL` and `RecordedFutureThreatMapMalware_V2_CL`, and sandbox results to `RecordedFutureSandboxResults_V2_CL`.
- Declared status
- 1
- Declared author / publisher
- Recorded Future
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Data types
Declared permissions
Read and write permissions are required.
Workspace
Workspace
Azure Subscription
Monitoring Contributor and Log Analytics Contributor permissions required to deploy the Data Connectors infrastructure. Owner or Role Based Access Control Administrator required to deploy playbooks with automatic role assignment.
Recorded Future API Token
A Recorded Future API token is required to authorize the Recorded Future Custom Connector used by the playbooks.
Connector instructions
Content published in the repository. Refer to the original file for all parameters.
Step 1 — Deploy Data Connectors infrastructure
Deploys the shared Data Collection Endpoint (DCE), Data Collection Rules (DCRs), Log Analytics tables, and this connector definition tile. Deploy this into the same resource group as your Log Analytics Workspace.
[](https://aka.ms/sentinel-RecordedFutureDataConnector-azuredeploy)
Step 2 — Deploy the Recorded Future Custom Connector
The custom connector handles authentication towards the Recorded Future API. Deploy it once — it is shared by the playbooks.
[](https://aka.ms/sentinel-RecordedFuture2FPlaybooksConnector-azuredeploy)
Step 3 — Deploy playbooks
Deploy one or more playbooks depending on your use case. No manual configuration is needed — each playbook connects to the Data Connectors infrastructure deployed in Step 1 automatically.
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
RecordedFuture
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC