EclecticIQ Platform vs. Recorded Future Intelligence Cloud

ElecticIQ has an architecture where it usually needs decent computing power within the organisation. The central console along with the ELK servers and PostgreSQL sever needs their own space in a distributed setup. This could be a little too expensive for small-scale organisations. But for the organizations having mid to large-scale networks. EIQ is a decent solution to serve the purpose.

Incentivized

If you want a platform that is covering thousands of sources, and that includes deep, dark web, clear web forums, blogs, newspapers, social media networks, etc. Recorded Future is the most complete solution that I have seen. On the other hand, if you are looking for a really advanced platform with lot of human added value, research papers, advanced investigations, etc. Recorded Future might not be the ideal solution.

Incentivized

• Effective correlation of IOCs
• Averaging out the Confidence Score based on different intel sources.
• Serves as an excellent liaison points between the Intels and SIEM/SOAR stack.

Incentivized

• Gives latest threat reports regarding an artifact (IP, domain or hash).
• Browser extension provides a real-time information about an artifact.
• Accurate in identifying malicious domains and IPs.

Incentivized

• Misses on a global search bar which can directly gives out the result like VirusTotal.
• The GUI could be more friendlier. Too many filters and graphs may overwhlem the user sometimes.
• The ElasticSearch(searching for IOC in the in-house EIQ database) is a little slow compared to its counterparts.

Incentivized

• E-Mail reports can show unrelated content, especially sometimes you'll see alerts popping up for articles which have been published years ago but for some reason were just recently discovered by RF.
• Yara rules from their insikt blog sometimes are not syntactically correct and need to be manually edited to actually work. There's some proper QA missing.
• Their global and 3rd party risk reports could be more tailored towards the industries of their client. There is entries for totally unrelated security incidents. Of course a global list aims to find incidents on a global view, but it doesn't add much value at that point.

Incentivized

I've had an issue with their browser-plugin which didn't want to authenticate correctly. RF's support could arrange for a session with me and identify and solve the issue. I was very pleased how serious they took my problems and also how knowledgeable they are.

If I have more general questions they quickly reply and most likely also have a solution at hand.

Incentivized

The most important feature of EclecticIQ which gives it an edge compared to other TIPs is that it performs segregation of IOCs based on the relevance of it and the links that IOCs might have which other adversaries. The graphical format mapping where the user can easily figure out how the IOCs have connections to different binaries is another advantage. One can set the half-life time for an IOC which will reduce the confidence score as per one's need.

Incentivized

It is the most complete solution of these three, as the others are focused in specific areas and having really detailed analysis about threat actors, APT groups, etc. Recorded Future is not having this level of knowledge in really specific areas but doing a really good work covering thousands of sources and the most relevant forums.

Incentivized

• Positive: Effective usage of all the premium Intels in a uniform fashion. No need to log in to each tool time and again.
• Positive: SOC Analysts spends lesser time on the internet and the analysis for the IOCs with graphical format is fulfilled by EclecticIQ.
• Negative: Higher costs over the resource utilization in the initial setup.

Incentivized

• Recorded Future crashes my web browser in cases I have to open a web page containing hundreds of IPs. A quick disable feature for a particular tab would be beneficial for someone like me.

Incentivized