To use the Recorded Future integration for Splunk ES, at least one core license is required + a Connect API subscription. User licenses are on a named basis, and cannot be shared among multiple users, hence we recommend that each user have their own Core license. If you choose to purchase only a single Core license, the other SOC users could be given "Express" licenses, though UI access is limited to our browser extension and is now available for free to any client that has purchased an advanced or core user license.
... View more