Splunk Enterprise Security

Need a suggestion in buying recorded future for my organization



We are planning to buy recorded future for my organization to integrate with splunk ES.

We have small Infrastructure with 50GB per day splunk license and I am the only Splunk Engineer working or who can configure things.

We are 4 people in my SOC team. When we contacted recorded future sales rep. They are forcing us to buy 4 core licenses since we are 4 people.

What if we buy only one core license and integrate with splunk ES?
can I run recorded future with domain account?
Can we use same account for multiple users?

Please do help me with my queries.
That will help us save money.

Thanks in advance!

Happy splunking 🙂

0 Karma

New Member

To use the Recorded Future integration for Splunk ES, at least one core license is required + a Connect API subscription. User licenses are on a named basis, and cannot be shared among multiple users, hence we recommend that each user have their own Core license. If you choose to purchase only a single Core license, the other SOC users could be given "Express" licenses, though UI access is limited to our browser extension and is now available for free to any client that has purchased an advanced or core user license.

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...