A tool every SOC should have
Rating: 10 out of 10
May 12, 2021
Vetted Review
Verified User
1 year of experience
Recorded Future is being utilized by SOC analysts as a threat intel. Since our company offers SOC services among our clients, Recorded Future has been advantageous to us in processing artifacts and identifying possible threats in a short period of time.
- Gives latest threat reports regarding an artifact (IP, domain or hash).
- Browser extension provides a real-time information about an artifact.
- Accurate in identifying malicious domains and IPs.
Cons
- For the Browser extension, since the main purpose is to present information with regards to the IP, I think it's best to give us an idea of where the IP originated/some additional information about the organization it belongs to.
- Web page display of the IP/domain reputation
- Queries for pwned domains of our clients
- Recorded Future crashes my web browser in cases I have to open a web page containing hundreds of IPs. A quick disable feature for a particular tab would be beneficial for someone like me.
To be honest I use Recorded Future together with VirusTotal to fully understand the possible threats on our network. However, Recorded Future has a better threat intelligence feed that I prefer to use as a reference in finalizing my investigations.