{
  "Name": "Recorded Future Identity",
  "Author": "Recorded Future Premier Integrations - support@recordedfuture.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/RecordedFuture.svg\" width=\"75px\" height=\"75px\">",
  "Description": "[Recorded Future](https://www.recordedfuture.com/) Identity Intelligence enables security and IT teams to detect identity compromises, for both employees and customers. To do this, Recorded Future automates the collection, analysis, and production of identity intelligence from a vast range of sources. Organizations can incorporate identity intelligence into automated workflows that regularly monitor for compromised credentials and take immediate action with applications such as Entra ID and Microsoft Sentinel.\nThere are many ways organizations can utilize Recorded Future Identity Intelligence; the playbooks in this Solution are just a quick introduction to some of those ways. In particular, these playbooks include several actions that can be coordinated, or used separately. They include:\n1. searches for compromised workforce or external customer users\n2. looking up existing users and saving the compromised user data to a Log file\n3. confirming high risk Entra ID users\n4. adding a compromised user to an Entra ID security group\n5. Updating Recorded Future Playbook Alerts\n\nFor more information, see the [Documentation for this Solution](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Recorded%20Future%20Identity/Playbooks).\n\nThe playbooks have internal dependencies where you have to install: \n- RFI-CustomConnector-0-2-0 \n\nBefore: \n- RFI-Playbook-Alert-Importer \n- RFI-Playbook-Alert-Importer-LAW\n\nThis solution depends on underlying Microsoft technologies. Some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:\n* [Log Analytics](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design)\n* [Logic apps](https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-pricing)\n",
  "PlaybooksBladeDescription": "This solution will install playbooks that import users with leaked credentials from Recorded Future and set them as RiskyUsers in Entra ID.",
  "Data Connectors": [
    "Data Connectors/RFI_AlertImporter_ConnectorDefinition.json"
  ],
  "Playbooks": [
    "Playbooks/Connectors/RFI-CustomConnector-0-2-0/azuredeploy.json",
    "Playbooks/RFI-Playbook-Alert-Importer/azuredeploy.json",
    "Playbooks/RFI-Playbook-Alert-Importer-LAW/azuredeploy.json",
    "Playbooks/RFI-Playbook-Alert-Importer-LAW-Sentinel/azuredeploy.json"
  ],
  "Analytic Rules": [
    "Analytic Rules/IncidentCreation/RecordedFutureIdentityExposure.yaml"
  ],
  "BasePath": "Users\\emangsten\\git\\github\\Azure-Sentinel\\Solutions\\Recorded Future Identity\\",
  "Version": "3.2.0",
  "Metadata": "SolutionMetadata.json",
  "TemplateSpec": true,
  "Is1PConnector": false
}