Recorded Future

Analysts are expected to rapidly investigate incidents, without compromising the process. For many, this means manually cross-referencing and copying hashes and other data. Over a year in a SOC, this means hundreds of hours per analyst plus some degree of human error. D3 can automatically query Recorded Future for IOC reputations, MITRE ATT&CK techniques, analyst notes, related IOCs, and other relevant data for new alerts, enabling instant analysis without changing interfaces.

When a potential phishing email is escalated to D3, either through an email protection system or manually by the recipient, D3 extracts the sender’s domain, the URL of any links in the message, and any attached files. D3 can then look up those entities in Recorded Future and reveal any associated malicious activity and analysis. Based on the result, D3 will then trigger an automated response playbook to block the IP, blacklist the sender, scan endpoints for the malicious file, and orchestrate any other appropriate actions.