↳ Source GitHubConnecteur

Recorded Future Identity - Credential Exposure Importer

Description

Imports Recorded Future Identity credential exposure data into Microsoft Sentinel. Writes malware log exposures to `RFI_MalwareLogs_V2_CL`, credential dump exposures to `RFI_CredentialDumps_V2_CL`, and user lookup results to `RFI_UsersLookupResults_V2_CL`. For full installation details, see the [readme](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Recorded%20Future%20Identity/Playbooks/v3.0/readme.md).

Statut déclaré: 1
Auteur / éditeur déclaré: Recorded Future

Sources déclarées

Métadonnées du fichier source. Aucune dépendance déduite du KQL.

Types de données

RFI_MalwareLogs_V2_CL RFI_CredentialDumps_V2_CL RFI_UsersLookupResults_V2_CL

Permissions déclarées

Read and write permissions are required.

Workspace

Workspace

Azure Subscription

Monitoring Contributor and Log Analytics Contributor permissions required to deploy the Data Connectors infrastructure. Owner or Role Based Access Control Administrator required to deploy playbooks with automatic role assignment.

Recorded Future API Token

A Recorded Future Identity API token is required to authorize the RFI Custom Connector used by the playbooks.

Instructions du connecteur

Contenu publié dans le dépôt. Consultez le fichier original pour l’ensemble des paramètres.

Step 1 — Deploy Data Connectors infrastructure

Deploys the shared Data Collection Endpoint (DCE), Data Collection Rules (DCRs), Log Analytics tables (`RFI_MalwareLogs_V2_CL`, `RFI_CredentialDumps_V2_CL`, `RFI_UsersLookupResults_V2_CL`), and this connector definition tile. Deploy this into the same resource group as your Log Analytics Workspace. [![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Recorded%2520Future%2520Identity/Data%2520Connectors/azuredeploy-v3.json)

Step 2 — Deploy RFI-CustomConnector

The custom connector handles authentication towards the Recorded Future API. Deploy it once — it is shared by the playbooks. [![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Recorded%2520Future%2520Identity/Playbooks/v3.0/RFI-CustomConnector-0-1-0/azuredeploy.json)

Step 3 — Deploy playbooks

Deploy one or more of the search/lookup playbooks depending on your use case. See the [readme](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Recorded%20Future%20Identity/Playbooks/v3.0/readme.md) for full deployment instructions, parameters, and post-deployment configuration.

Traçabilité de la source

GitHub

Les valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.

Fichier: Solutions/Recorded Future Identity/Data Connectors/azuredeploy-v3.json ↗
Commit: 629d1d3 ↗
Identifiant source: RecordedFutureIdentityV3

Autres fichiers source 1

Solutions/Recorded Future Identity/Data Connectors/azuredeploy-v3.jsonsource ↗

GSTEP / SUIVI DU CATALOGUE

Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC

Dates de synchronisation GSTEP, distinctes des dates de publication du contenu source.