↳ GitHub sourceConnector

Recorded Future Identity - Credential Exposure Importer

Description

Imports Recorded Future Identity credential exposure data into Microsoft Sentinel. Writes malware log exposures to `RFI_MalwareLogs_V2_CL`, credential dump exposures to `RFI_CredentialDumps_V2_CL`, and user lookup results to `RFI_UsersLookupResults_V2_CL`. For full installation details, see the [readme](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Recorded%20Future%20Identity/Playbooks/v3.0/readme.md).

Declared status: 1
Declared author / publisher: Recorded Future

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

RFI_MalwareLogs_V2_CL RFI_CredentialDumps_V2_CL RFI_UsersLookupResults_V2_CL

Declared permissions

Read and write permissions are required.

Workspace

Workspace

Azure Subscription

Monitoring Contributor and Log Analytics Contributor permissions required to deploy the Data Connectors infrastructure. Owner or Role Based Access Control Administrator required to deploy playbooks with automatic role assignment.

Recorded Future API Token

A Recorded Future Identity API token is required to authorize the RFI Custom Connector used by the playbooks.

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

Step 1 — Deploy Data Connectors infrastructure

Deploys the shared Data Collection Endpoint (DCE), Data Collection Rules (DCRs), Log Analytics tables (`RFI_MalwareLogs_V2_CL`, `RFI_CredentialDumps_V2_CL`, `RFI_UsersLookupResults_V2_CL`), and this connector definition tile. Deploy this into the same resource group as your Log Analytics Workspace. [![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Recorded%2520Future%2520Identity/Data%2520Connectors/azuredeploy-v3.json)

Step 2 — Deploy RFI-CustomConnector

The custom connector handles authentication towards the Recorded Future API. Deploy it once — it is shared by the playbooks. [![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Recorded%2520Future%2520Identity/Playbooks/v3.0/RFI-CustomConnector-0-1-0/azuredeploy.json)

Step 3 — Deploy playbooks

Deploy one or more of the search/lookup playbooks depending on your use case. See the [readme](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Recorded%20Future%20Identity/Playbooks/v3.0/readme.md) for full deployment instructions, parameters, and post-deployment configuration.

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Recorded Future Identity/Data Connectors/azuredeploy-v3.json ↗
Commit: 629d1d3 ↗
Source identifier: RecordedFutureIdentityV3

Additional source files 1

Solutions/Recorded Future Identity/Data Connectors/azuredeploy-v3.jsonsource ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.