Incoming feed - Recorded Future Classic Alert Feed

	Specifications
Transport types	Recorded Future Alert Feed
Content type	Recorded Future Alert Feed
Ingested data	Intelligence contained in Recorded Future Classic Alerts
Processed data	Incident entities with related Observables.
Description	Retrieves intelligence captured in Recorded Future alerts and ingests it as Incident entities with their related Observables.

Requirements

• An API key with access to the Recorded Future feed.

Configure the incoming feed

Note

This article describes how to configure incoming feeds for a particular feed source. To see how to configure incoming feeds in general, see Create and configure incoming feeds.

1. Create or edit an Incoming feed.

2. From the Transport type drop-down menu, select Recorded Future Alert Feed.

3. From the Content type drop-down menu, select Recorded Future PlayBook Alert Feed.

4. In the API key field, enter your API key with access to the Recorded Future Alerts feed.

5. Select the Start ingesting from field, and use the drop-down calendar to select an initial date and, where available, an initial time to fetch content from the intelligence provider/data source starting from a specific date in the past.

6. Optional Uncheck the SSL verification checkbox.

7. If you kept the SSL vefifitcation box checked, enter the path to your PEM file in the Path to SSL certificate field.

8. In the Alert Ids to look for specific Alerts field, enter Alert IDs of the
   alerts you’d like to ingest with this feed. You can enter multiple IDs separated by commas and any alert that matches at least one of the IDs will be ingested.

9. To store your changes, select Save.