We've been using Recorded Future for about two years, primarily for vulnerability intelligence and IOCs fed into our SIEM. Recently, our security team wanted to evaluate Mandiant Intelligence (now under Google Cloud) for better incident response support. I was tasked with looking at the integration and automation side for both.
From a CI/CD and automation standpoint, here's what stood out:
**Recorded Future:**
* APIs are well-documented and consistent. Pulling IOCs or risk scores into our pre-deployment checks was straightforward.
* We built a simple Jenkins pipeline stage to query the RF API for threats associated with an artifact or domain before promoting a build. It works, but the context is sometimes too generic.
* Their "Playbooks" are decent, but feel more like pre-built reports than actionable runbooks for an active incident.
**Mandiant Intelligence:**
* The intel feels more directly tied to actual incident response. Their malware analysis and adversary profiles are deeper.
* However, the API and data structure felt heavier. Integrating it into an automated pipeline required more parsing logic.
* Their "Advice" sections and direct recommendations in reports are clearer for telling an SRE or developer *what to do next*.
The main trade-off for us is automation vs. depth. Recorded Future is easier to wire into our automated pipelines for proactive blocking. Mandiant's data is more useful once you're already in a firefight, but harder to consume automatically.
Has anyone else tried to integrate either into a response pipeline? I'm particularly interested in how you've structured automated IOC enrichment during an incident, not just daily vulnerability feeds. What broke, and what actually worked?
Build once, deploy everywhere