Need a suggestion in buying recorded future for my organization

[satyaallaparthi]

Hello,

We are planning to buy recorded future for my organization to integrate with splunk ES.

We have small Infrastructure with 50GB per day splunk license and I am the only Splunk Engineer working or who can configure things.

We are 4 people in my SOC team. When we contacted recorded future sales rep. They are forcing us to buy 4 core licenses since we are 4 people.

What if we buy only one core license and integrate with splunk ES?
can I run recorded future with domain account?
Can we use same account for multiple users?

Please do help me with my queries.
That will help us save money.

Thanks in advance!

Happy splunking 🙂

[recordedfuture]

To use the Recorded Future integration for Splunk ES, at least one core license is required + a Connect API subscription. User licenses are on a named basis, and cannot be shared among multiple users, hence we recommend that each user have their own Core license. If you choose to purchase only a single Core license, the other SOC users could be given "Express" licenses, though UI access is limited to our browser extension and is now available for free to any client that has purchased an advanced or core user license.