- Introduction to Context Management
- Onboarding a Context Table
- Custom Context Tables
- Active Directory Context Tables
- Anomali Context Tables
- CrowdStrike Context Tables
- Microsoft Entra ID Context Tables
- Okta Context Tables
- Recorded Future Context Tables
- Prerequisites to Onboard a Recorded Future Context Table
- Create a Recorded Future Context Table
- View and Interact with a Recorded Future Context Table
- View the Details Panel for a Recorded Future Context Table
- Edit the Configuration of a Recorded Future Context Table
- Default IP Attribute Mapping for Recorded Future
- Default Domain Attribute Mapping for Recorded Future
- STIX/TAXII Context Tables
- Add Data to an Existing Context Table
- Using Context Data in Downstream Applications
- Pre-Built Context Tables
- Context Management APIs
- Troubleshooting Context Management
Edit the Configuration of a Recorded Future Context Table
To edit the configuration of a Recorded Future context table:
On the Overview tab, click the Options icon (
) to the right of a specific Recorded Future table and select Edit. The Configuration panel opens on the right.
On the Definition tab, you can modify the following information:
Context Table Name – Enter a new name for the context table.
Note
Changing context table names is currently prohibited in order to avoid breaking functionality in downstream applications.
Recorded Future Collector – Select a different Recorded Future context cloud collector as the source of the context table.
Click on the Review Attributes tab to modify the attribute mapping for the context table.
The attribute mapping table has the following columns:
– Shows whether a specific attribute is visible as a column in the context table. Use the icon next to each attribute to toggle the display on or off.
Source Attribute – Shows a default set of attributes available from your Recorded Future source. Some source attributes are listed simply as Calculated attribute. These are attributes that are calculated, either in format or in value. To view a description of an attribute and its calculation, hover over the Calculated attribute tag in the Source Attribute column.
Target Attribute – The Target Attributes column shows the Exabeam common information model attributes that are mapped to the Recorded Future attributes in your context table. For an easy-to-read table of the default attribute mapping, see one of the following:
– Indicates that an attribute is designated as the key attribute for the context table. The designated key and its mapping cannot be changed.
– Indicates that an attribute and its mapping cannot be changed.
The only modification you can make to the attribute mapping is to decide whether or not an attribute should be visible as a column when the context table is displayed. Use the visibility icon (
) to toggle the display on or off for a specific attribute.
When you are satisfied with the configuration edits, click Update to save the changes.