Smart SOAR Integration

With cyberattacks and the skills gap getting worse, SOCs can no longer afford to have analysts manually coordinate contextual data. D3’s integration with Recorded Future enables automated enrichment of Smart SOAR incidents with precision SecOps intelligence for rapid assessment of threats.

Recorded Future Integration

Integration features

Enrich Smart SOAR incidents with IP, URL, and file reputations
Download risk lists from Recorded Future
Get vulnerabilities and vulnerability risk lists
Automatically ingest associated analyst notes, correlated IOCs, and ATT&CK TTPs

Key Use Cases


Automated Enrichment

Analysts are expected to rapidly investigate incidents, without compromising the process. For many, this means manually cross-referencing and copying hashes and other data. Over a year in a SOC, this means hundreds of hours per analyst plus some degree of human error. Smart SOAR can automatically query Recorded Future for IOC reputations, MITRE ATT&CK techniques, analyst notes, related IOCs, and other relevant data for new alerts, enabling instant analysis without changing interfaces.

Potential Phishing Analysis

When a potential phishing email is escalated to Smart SOAR, either through an email protection system or manually by the recipient, Smart SOAR extracts the sender’s domain, the URL of any links in the message, and any attached files. Smart SOAR can then look up those entities in Recorded Future and reveal any associated malicious activity and analysis. Based on the result, Smart SOAR will then trigger an automated response playbook to block the IP, blacklist the sender, scan endpoints for the malicious file, and orchestrate any other appropriate actions.

Meet Our Friends

Our Connected SOAR Security Alliance brings hundreds of vendors together, allowing customers to benefit from our deep industry relationships and fully vendor-agnostic, independent SOAR platform.

X Recorded Future Integration

Get Started with D3 Security

One platform to stop alert overwhelm. Transform how your security team works, by focusing its resources on real threats.