Incoming feed - Recorded Future PlayBook Alert Feed

	Specifications
Transport types	Recorded Future PlayBook Alert Feed
Content type	Recorded Future PlayBook Alert Feed
Ingested data	Intelligence contained in Recorded Future PlayBook Alerts
Processed data	Identity Novel Exposure category: Incident entities. Domain Abuse category: Incident entities with related Indicator entities. Cyber Vulnerability category: Incident entities with related Exploit Target entities.
Description	Retrieves intelligence captured in Recorded Future PlayBook alerts and ingests it as Indicator entities with their related Observables.

Requirements

• An API key with access to the Recorded Future feed.

Configure the incoming feed

Note

This article describes how to configure incoming feeds for a particular feed source. To see how to configure incoming feeds in general, see Create and configure incoming feeds.

1. Create or edit an Incoming feed.

2. From the Transport type drop-down menu, select Recorded Future PlayBook Alert Feed.

3. From the Content type drop-down menu, select Recorded Future PlayBook Alert Feed or Recorded Future Classic Alert Feed.

4. In the API key field, enter your API key with access to the Recorded Future Alerts feed.

5. Select the Start ingesting from field, and use the drop-down calendar to select an initial date and, where available, an initial time to fetch content from the intelligence provider/data source starting from a specific date in the past.
   The hours and minutes fields aren’t actually taken into account. Ingestion will always start from 00:00 on the day you choose.

6. Optional Uncheck the SSL verification checkbox.

7. If you kept the SSL vefifitcation box checked, enter the path to your PEM file in the Path to SSL certificate field.

8. In the Categories field, select the Recorded Future alert categories you would like to ingest with this feed. The available categories are:

   • Domain abuse

   • Cyber Vulnerability

   • Identity novel exposures
     If you select no categories, the feed will ingest all three available categories.

9. To store your changes, select Save.

Change date when adding categories

When adding a category to the Categories field, you have to change the date in the Start ingesting from field for that change to take effect.