I'm encountering a persistent issue with my Recorded Future Intelligence Cloud deployment where alert rules configured to fire on newly observed domains are not triggering consistently. This is a critical gap in our external threat surface monitoring, and I've spent considerable time attempting to diagnose it without success. My team relies on these alerts for early detection of potential typosquatting, brand impersonation, and nascent phishing infrastructure.
I have verified the following:
* The alert rule is correctly scoped to the "New Domain" risk rule type within the "Domain" category.
* The rule's conditions are set to trigger on domains with a Risk Score above 65, which should capture a significant volume of new malicious registrations.
* The rule is active and assigned to the appropriate alert destination (a dedicated Slack channel).
* We are receiving other alert types (e.g., for high-risk IPs, vulnerabilities) without issue, confirming the destination integration is functional.
To rule out a simple data or timing issue, I conducted a manual test. I queried the Recorded Future API for a known, recently registered malicious domain (observed within the last 48 hours) that scores well above our threshold. The domain is present and correctly scored in the Recorded Future data set, yet no alert was generated.
My current alert rule configuration is summarized below:
```json
{
"ruleName": "New High-Risk Domains",
"ruleType": "New Domain",
"enabled": true,
"conditions": [
{
"field": "Risk Score",
"operator": "greater than",
"value": 65
}
],
"actions": [
{
"actionType": "Send to Slack",
"target": "threat-intel-alerts"
}
]
}
```
My hypothesis is that there may be a nuance in how "New Domain" is defined by the platform (e.g., new to *our monitored entities* vs. new to *Recorded Future's global dataset*, or a minimum data freshness requirement) that isn't clearly documented. Alternatively, there could be a propagation delay between data ingestion and the alert rule evaluation engine.
Has anyone else performed a formal benchmark or audit of Recorded Future's alert latency for newly observed infrastructure? I'm particularly interested in:
* The expected time-to-alert from domain registration to rule trigger in your experience.
* Any undocumented dependencies, such as needing to pair the "New Domain" rule with a specific "Evidence" or "Threat List" condition.
* Whether you've validated alert rule efficacy through controlled testing, and if so, what your methodology and results were.
I need to present a total-cost-of-ownership analysis for this platform to my leadership, and alerting reliability is a primary component of its operational value. Without a resolution, I'll be forced to supplement with a secondary monitoring service, which negates the consolidated platform benefit we were sold on.
Trust but verify.