Recorded Future, the world's largest threat intelligence company, offers a comprehensive Intelligence Cloud platform. It provides end-to-end intelligence, ranging from adversaries and infrastructure to targets. The tool indexes the internet, including open and dark web as well as technical sources, offering real-time visibility into an expanding attack surface and threat landscape. This helps enterprises reduce risk and drive their business securely with speed and confidence. Though headquartered in Boston, Recorded Future has its offices and employees spread globally. It assists a vast range of businesses and governmental organizations with real-time, unbiased and actionable intelligence.
Do You Manage Peer Insights at Recorded Future?
Access Vendor Portal to update and manage your profile.
As it relates to the threat intelligence module within the Recorded Future platform, we really like the graphical representations of threats to our organization, the ability to alert upon those threat actors or entities, and the ability to conduct deep web searches within Recorded Future's platform. We also really like the malware and ransomware intelligence additions.
Lots of information available on entities along with detection rules.
Risk based actionable TI: provides clear risk scores and supporting evidence helps quickly whether IOC, Vuln or threat is relevant to requires action. Broad Intelligence coverage: Brings together intelligence on IPs, domains, malwares, CVEs and TA in one place eliminating need to manually consult multiple external sources. Strong support for SOC workflows: RF integrated well with SIEM investigation processes, enabling faster alert triage, TH and informed decision making in high volume SOC environment.
We do have a few items that we do not like about the threat intelligence module and those are that it is very hard to communicate to leadership why an entity is being tracked as a threat to our organization, the administrative burden to feed the watchlists that help to populate accurate threat data, and the lack of repudiation on the reported threat list.
It can be a bit complicated to learn all the behind the scenes reasons for how they evaluate the risk of entities.
Information overload: provides very deep intelligence but the volume data and references can be overwhelming at times. Alert noise: alerting is powerful, it can generate noise if not carefully tuned. maybe adaptive suppression would help. Operationlization still requires manual effort: Although integration exist tuning intelligence into automated actions across SIEM SOAR and EDR ofthen requires addtional tuning scripting.