Recorded Future - Threat Actor Search

Template playbook to initiate an Automated Threat Hunt based on the Threat Map in Recorded Future. The Playbook fetches links related to the Threat Actors part of the Threat Map from Recorded Future and launches a hunt in the SIEM for any detections within the environment.

Pack

RecordedFuture

Tasks

16

Inputs

• threat_actor — The threat actor to enrich & hunt indicators for.

Commands used

• extractIndicators
• recordedfuture-detection-rules
• recordedfuture-threat-links
• recordedfuture-threat-map