Recorded Future Identity - Playbook Alert Importer
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | RecordedFutureIdentityAlertImporter |
| Publisher | Recorded Future |
| Used in Solutions | Recorded Future Identity |
| Collection Method | CCF |
| Connector Definition Files | RFI_AlertImporter_ConnectorDefinition.json |
Imports Recorded Future Identity Playbook Alerts into Microsoft Sentinel. Enables incident creation via Analytic Rules on the RFI_PlaybookAlertResults_V2_CL table. For full installation details, see the readme.
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
RFI_PlaybookAlertResults_V2_CL |
? | ✓ | ? |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): Read and write permissions are required.
Custom Permissions:
- Azure Subscription: Step 1 (Data Connectors infrastructure) requires Monitoring Contributor and Log Analytics Contributor on the resource group. Step 3 (playbook) requires Owner or Role Based Access Control Administrator when deploying with automatic role assignment (
create_role_assignment=true), otherwise Contributor suffices. - Recorded Future API Token: A Recorded Future Identity API token is required to authorize the RFI Custom Connector used by the playbook.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Step 1 — Deploy Data Connectors infrastructure
Deploys the shared Data Collection Endpoint (DCE), Data Collection Rule (DCR), Log Analytics table (RFI_PlaybookAlertResults_V2_CL), and this connector definition tile.
2. Step 2 — Deploy RFI-CustomConnector
The custom connector handles authentication towards the Recorded Future API. Deploy it once — it is shared by the playbook.
3. Step 3 — Deploy RFI-Playbook-Alert-Importer-LAW
Deploys the Logic App that imports Recorded Future Identity Playbook Alerts and writes them to the Log Analytics table using Managed Identity. Set create_role_assignment=false if your organization requires manual role assignment (see permissions above). After deployment, authorize the connectors and enable the Logic App.
4. Step 4 — Deploy Analytics Rule
Creates Microsoft Sentinel incidents from the RFI_PlaybookAlertResults_V2_CL table. The rule is also available under Microsoft Sentinel → Configuration → Analytics → Rule Templates.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊