APP DEVELOPER TECH TALKS

Automating Threat Operations and Threat Hunting with Recorded Future

Security teams are buried in alerts and still need time for real threat hunting.

The Recorded Future app for Splunk supports Autonomous Threat Operations: you can start repeatable, intelligence-driven hunts from IOCs, TTPs, and packaged templates, with filters for things like risk score so only relevant intel is used.

Hunts can run on a schedule and refresh with new intelligence; Splunk results flow back into Recorded Future for review, and Splunk Enterprise Security users can optionally turn hunt hits into notables. The idea is less purely manual hunting, faster detection (including MTTD), and stronger coverage when telemetry (DNS, proxy, EDR, firewall, email, etc.) is in place. This talk summarizes how that workflow fits together and what to configure first in Splunk and ES.

Our Speakers

Partner

Recorded Future is the world's largest intelligence company. Recorded Future's Intelligence Cloud provides complete coverage across adversaries, infrastructure, and targets. By combining persistent and pervasive automated data collection and analytics with human analysis, Recorded Future provides real-time visibility into the vast digital landscape. It empowers countries and organizations to take proactive action to disrupt adversaries and keep their people, systems, and infrastructure safe. Headquartered in Boston with offices and employees around the world, Recorded Future works with more than 1,500 businesses and government organizations across more than 60 countries. Learn more at recordedfuture.com