Recorded Future - Threat Actor Search

Template playbook to initiate an Automated Threat Hunt based on the Threat Map in Recorded Future. The Playbook fetches links related to the Threat Actors part of the Threat Map from Recorded Future and launches a hunt in the SIEM for any detections within the environment.

Recorded Future Intelligence · 16 tasks · 1 input · 0 outputs

Inputs

  • threat_actor — The threat actor to enrich & hunt indicators for.

Commands used

extractIndicators recordedfuture-detection-rules recordedfuture-threat-links recordedfuture-threat-map

Flowchart

yes yes qradar splunk Start Start Threat Actor Map Search - recordedfuture-threat-map Threat Actor Map Search recordedfuture-threat-map Threat Actor Links Search - recordedfuture-threat-links Threat Actor Links Search recordedfuture-threat-links Detection Rules Returned? Detection Rules Returned? IoCs Returned? IoCs Returned? Download Detection Rules Manually Download Detection Rules ... Done Done Is SIEM enabled? Is SIEM enabled? Splunk Indicator Hunting - Splunk Indicator Hunting Splunk Indicator Hunting Splunk Indicator Hunting Detection Rules Search - recordedfuture-detection-rules Detection Rules Search recordedfuture-detection-rules Enrich Threat Actor Enrich Threat Actor Look For Detection Rules Look For Detection Rules Hunt Related IoCs Hunt Related IoCs Hunt Indicators Manually Hunt Indicators Manually Extract Links - extractIndicators Extract Links extractIndicators QRadar Indicator Hunting V2 - QRadar Indicator Hunting V2 QRadar Indicator Hunting V2 QRadar Indicator Hunting V2