Recorded Future Intelligence Platform

My main use case for Recorded Future  is IOC enrichment, dark web monitoring, brand protection, and sandboxing for malware. For investment monitoring, privacy protection, or sandboxing in my day-to-day work, I have our SIEM  use cases. Whenever a new alert or SIEM  use case is triggered, we automatically take any IOCs, any IPs, any hashes, any domains, any URLs, and feed them into Recorded Future  APIs to get IOC enrichment and provide them to the analyst.

The best features Recorded Future offers are their unlimited IOC enrichment, their sandbox, their brand protection, and their dark web monitoring, which is really good.

Recorded Future has positively impacted my organization by allowing our analysts to work less on doing IOC enrichments. They don't need to do subscriptions for different providers for sandboxes. We have our own brand protection right now, and we can monitor any leaks that happen proactively. The analyst doesn't need to copy-paste each IOC and URL and domain anymore to their abuse database or VirusTotal ; it's automatically provided to them.

Recorded Future can be improved in terms of their APIs and their integration. Mainly their integration is very difficult, especially with their dark web monitoring notifications and brand protection with anything, as they only support sending emails, which we don't know for sure if they are one hundred percent accurate. If it were possible to do something other than sending email, that would be really helpful, so we can do more automations with it.

Regarding improvements needed for Recorded Future, more metrics and monitoring of their notifications would be helpful. The learning curve when getting started with Recorded Future is a bit tricky because you don't know what features they have, and their documentation, particularly their API documentation, is not the best. The result you get is not what you see in the UI. You can't connect what you have in the API with what you have in the UI, and there are not many resources about that, so it's a bit tricky and you have to figure it out yourself.

Recorded Future really integrates poorly with other tools or platforms I use because we have to rely on the email being sent and do the automation based on receiving that email.

I have been using Recorded Future for a year so far.

Recorded Future is stable.

Recorded Future's scalability is normal, and we don't have limitations with that; it functions strongly.

The customer support of Recorded Future is good.

We did not use a different solution before Recorded Future.

Regarding the value for money I get from Recorded Future, we don't have numbers for that, but it's useful.

Before choosing Recorded Future, we asked our business partners for the best out there, and they recommended Recorded Future.

If it were possible to do something other than sending email, that would be really helpful, so we can do more automations with it.

The quality of threat intelligence data provided by Recorded Future is good, but sometimes it's very aggressive; we get some false positives for IOCs, but generally it's good. The user experience and interface of Recorded Future is easy to navigate and use. I am not so satisfied with the frequency and quality of updates or new features from Recorded Future; I would say it's average and normal.

The documentation and support resources provided by Recorded Future are bad. My advice to others looking into using Recorded Future is to make sure you are ready for that; they don't provide very supportive information, and you will have to figure out your own workarounds. Apart from that, their dark web monitoring and brand protection are good. If you don't need them, then maybe you should look for something else if all you need is just IOC enrichment. I would rate this review an eight out of ten.

When I was in the SOC team responsible for security operations, I also worked for threat intelligence, and Recorded Future  is primarily used as part of threat intelligence and vulnerability prioritization tool in a specific project.

In our SOC team, the main activity is to gather all logs and detect potential threats. Once we started using Recorded Future , it provided us with an overall summary of all threats, including potential threats specific to our organization by providing detailed information on threats specific to the BFSI and healthcare domains as well as worldwide active threats, exploits, vulnerabilities, and IOCs, which helps us in threat hunting during our SOC activities.

In our workflow, there was previously manual effort involved in detecting and hunting threats. Using Recorded Future, we now get a clear view of threat behavior and activities, which helps us gather all necessary details to easily create log queries to hunt threats quickly.

In threat actor intelligence, our focus is to check several key aspects before hunting a threat, such as the nature of the threat, associated IPs, IOCs, and threat actor behavior, allowing us to gain visibility into threat actor activities, campaigns, and tactics. This provides valuable context to the overall threat landscape and aids in developing queries with our SIEM  engineering team.

Recorded Future is deployed on an on-premises server in our organization, with multiple cloud connectors and environments integrated to check available threat feeds.

Recorded Future has many features, but we have primarily used the threat intelligence features, which provide us with a wealth of information on threat activities, IOCs, components, subcomponents, nature of the threat, and threat actor intelligence that helps us gather information about potential threats proactively.

After implementing Recorded Future, I can point out two positive impacts: first, the tool helps our SOC team save 30 to 40 percent of effort due to the reduction of manual threat detection and false positives, and second, the quality of our threat hunting has improved considerably, leading to a better understanding of the threat landscape.

This 30 to 40 percent effort reduction can be measured monthly, as we publish monthly status reports, and we have noticed fewer tickets and more detailed prioritization of tickets based on threat severity, improving our implementation of the incident response plan.

A possible improvement for Recorded Future would be better filtering options, particularly when dealing with large datasets.

The user interface is very good, and I would add that an automation feature for remediation workflows would be beneficial, helping not only with threat detection but also with threat hunting activities.

If AI capabilities are added, it will assist users in prioritizing threats more effectively, although I have not used those features yet to comment on their accuracy or reliability.

I have been using Recorded Future for more than two years.

Recorded Future is stable, and I have not experienced any downtime or reliability issues.

In our organization, Recorded Future can handle a large volume of data accurately without issues, accommodating our needs effectively.

During the deployment of Recorded Future, their team provided technical support and assistance, which I found to be very helpful.

I have not used any threat intelligence tool before Recorded Future.

I have mentioned a metric indicating a 30 to 40 percent reduction in time and effort from the SOC team, which reflects our return on investment.

I evaluated Rapid7 before choosing Recorded Future, but opted for Recorded Future due to our client's comfort with that tool.

I have only used the threat intelligence features, which I have already described in detail.

I have provided improvement areas earlier, and aside from that, Recorded Future is very useful and impactful regarding threat intelligence and threat landscape.

If you are involved in threat intelligence or SOC threat hunting and want to improve your accuracy in detecting threats, I recommend using Recorded Future as a threat intelligence tool.

I have shared everything regarding my experience with Recorded Future. I have given this review a rating of eight out of ten.

My main use case for Recorded Future  is as a threat and vulnerability feed. In relation to my use case with Recorded Future , it is the go-to tool when it comes to checking for third-party issues, and it is a great place to have news and updates.

The best features Recorded Future offers is the feed; the actual feed has loads of news, and that is the strongest point as they have a lot of information in there that I use daily.

The feed helps me in my daily work by providing information around product vulnerabilities, and for example, I didn't find any vulnerability in the product but actually discovered that the provider had a breach, which didn't show up in any CVE or anything else because it was not a vulnerability, it was literally they got breached, so that was the most useful case that I have found.

Recorded Future has positively impacted my organization by providing the news, and it has actually made a huge impact; instead of having to rely on open source intelligence, I have a place to go where all the information is, so it saves a ton of time.

I cannot think of a way that Recorded Future can be improved. I don't have anything to add about the needed improvements, even small things such as interface tweaks or integrations.

I have been using Recorded Future for a couple of years.

Recorded Future is absolutely stable.

I don't think Recorded Future needs to be scaled; it works perfectly well the way it is.

Recorded Future's customer support is excellent. Personally, I cannot tell you how I would rate the customer support on a scale of one to ten, but from what I've heard, it is well above average, an eight or nine, I would say, and really helpful, especially with the setup, but that is not first-hand information.

I didn't previously use a different solution; I basically started using Recorded Future a couple of years ago and I am really happy with it.

I wasn't involved in that part regarding pricing, setup cost, and licensing. I wasn't involved in the RFP process before choosing Recorded Future.

I have seen a return on investment as I explained earlier, it reduces the investigation time from days to minutes, and that is the biggest ROI; on a team of ten people that use it, one request can take you from three days to minutes.

Estimating how much time Recorded Future saves my team would be hard, but it basically reduces the investigation time for anything from days to less than an hour; on a team of ten people, you do the math—say you get fifty requests in a week, out of those fifty, you will be able to spend basically one person dedicated to that for one week, and the job will be done, rather than having a ton of people doing research independently.

My advice to others looking into using Recorded Future is that if you can spend the money, go for it. I have rated this review as a nine out of ten.