Autonomous Threat Operations offre plus

What is Autonomous Threat Operations?

Autonomous Threat Operations est une nouvelle capacité visant à réduire les opérations cyber manuelles grâce à une chasse continue assistée par l’IA et à la corrélation multisource au sein de l’Intelligence Graph®. Autonomous Threat Operations propose les principales fonctionnalités suivantes :

• Autonomous Threat Hunting to track IoCs, malware, and threat actors across your technology stack
• Unified threat protection across all controls to block, detect, and prevent threats across all your tools
• Ingestion et corrélation multisources via l’Intelligence Graph® : vous pouvez ingérer des sources personnalisées et les données seront enrichies et priorisées en fonction des Recorded Future Risk Scores et des menaces associées
• AI Reporting, which quickly provides clear, actionable insights into threat hunting, prevention, and detection findings that are specific to your organization

What problem does Autonomous Threat Operations solve?

Organizations are finding it difficult to operationalize threat intelligence across the business. They’re spending too much time and tying up resources on manual cyber operations, and that limits the effectiveness and value of their threat intelligence.

What’s the difference between "autonomous" and "automated"?

• Automated systems follow pre-programmed rules and workflows.
• Autonomous solutions work independently using AI. They can adapt, learn from new intelligence, and make decisions with minimal human intervention—all while providing guardrails that give you full control over the way you operationalize intelligence.

Can Autonomous Threat Operations integrate with our existing security tools?

Yes, it’s designed to seamlessly integrate with your existing security ecosystem, including SIEMs, SOARs, firewalls, and endpoint protection solutions. This ensures that the threat intelligence you receive is actionable and can be used to strengthen your overall security posture.

Integrations supported by Autonomous Threat Operations include:

• Microsoft Defender XDR
• Microsoft Sentinel
• Splunk (en anglais seulement)
• Crowdstrike XDR et NGSIEM
• Google SecOps
• Sentinel One
• Zscaler (en anglais seulement)
• Palo Alto NGFW

We’ll continue adding integrations over time to enable connectivity with other tools.

See the latest supported integrations and sources for Autonomous Threat Operations

How does Autonomous Threat Operations enhance Recorded Future’s existing integrations?

The purpose of our integrations into SIEM, SOAR, and other platforms is to prioritize alerts and entities within those platforms. With Autonomous Threat Operations, you can now initiate a threat hunt directly within Recorded Future and view those results across multiple connected tools, from SIEMs to EDRs.

Other enhanced capabilities allow you to:

• Enable custom sourcing, such as ISAC sources, outside threat intelligence, or customer sources.
• Bring together external intelligence, beyond just Recorded Future’s.
• Manage those indicators.
• Better connect data from different sources through Recorded Future and into other security platforms.

How is Autonomous Threat Operations threat hunting different from the pre-built threat hunting capability available within Recorded Future’s Splunk integration?

Recorded Future’s Splunk integration is one of the few where customers can launch a threat hunt using Recorded Future data within Splunk. However, the Autonomous Threat Operations capabilities allow for the following:

• Dynamic threat hunts—When a threat actor is added to or removed from the Threat Map, Autonomous Threat Operations automatically updates the hunts to reflect the change.
• External intelligence enrichment—Autonomous Threat Operations merges external threat feeds, including Recorded Future’s, into threat hunts, adding insights that may not be available in Splunk.