Splunk Enterprise Security

Need a suggestion in buying recorded future for my organization

Path Finder


We are planning to buy recorded future for my organization to integrate with splunk ES.

We have small Infrastructure with 50GB per day splunk license and I am the only Splunk Engineer working or who can configure things.

We are 4 people in my SOC team. When we contacted recorded future sales rep. They are forcing us to buy 4 core licenses since we are 4 people.

What if we buy only one core license and integrate with splunk ES?
can I run recorded future with domain account?
Can we use same account for multiple users?

Please do help me with my queries.
That will help us save money.

Thanks in advance!

Happy splunking 🙂

0 Karma

New Member

To use the Recorded Future integration for Splunk ES, at least one core license is required + a Connect API subscription. User licenses are on a named basis, and cannot be shared among multiple users, hence we recommend that each user have their own Core license. If you choose to purchase only a single Core license, the other SOC users could be given "Express" licenses, though UI access is limited to our browser extension and is now available for free to any client that has purchased an advanced or core user license.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...