Hi everyone. First post here, so apologies if this is a known topic. I’ve been tasked with evaluating our security tooling and we’re currently trialing Recorded Future for threat intelligence.
The main selling point for us was the SIEM integration (we use Splunk). The idea was to enrich alerts with RF’s risk scores and context. On paper, it’s exactly what we need.
My problem is... noise. Since setting up the integration, we’re getting flooded with alerts for IPs and domains that, according to Recorded Future, have a “low” or “medium” risk score, but are basically benign in our specific context. It’s creating alert fatigue and my team is starting to ignore the feed, which defeats the whole purpose.
I’ve tried adjusting the risk score thresholds in the integration settings, but even at “high” or “critical” only, we still get a lot of irrelevant stuff. For example, a marketing SaaS tool we use might pop up with a “medium” score for some obscure reason, but we know it’s a trusted vendor.
My questions:
1. Is there a way to create more granular filters beyond just the overall risk score? Like filtering by rule name, or by threat type?
2. Can we build an allowlist or context list within Recorded Future itself, so it knows about our trusted entities and suppresses alerts for them?
3. Are we maybe using the wrong integration method? I’m curious how others have tuned this to get actionable alerts without the overhead.
I’m cautious about expanding this trial if we can’t get the filtering right. The ROI calculation on a tool like this depends heavily on it actually saving analyst time, not creating more work.
Any guidance from those who’ve been through this setup would be really appreciated.
Yep, this is the classic challenge with these feeds - they're generic but your environment isn't. Good news, you can definitely build more granular control.
For your question about granular filters, check if the integration sends the raw rule name or threat type in the Splunk event. You should be able to filter on those fields directly in Splunk. Create a search macro or lookup to drop alerts from certain rule names you know are noise.
On the allowlist, I'd approach it from the Splunk side first. Build a lookup table of your trusted IPs/domains (like that marketing SaaS vendor) and use a `WHERE NOT IN` type clause in your alert search to suppress them. That's often quicker than waiting for the feed provider to update their filtering.
Have you looked at whether you can apply tags or context within Recorded Future's portal itself? Sometimes you can label assets as "internal" or "approved vendor" to adjust scoring.
Keep deploying!