Hey everyone! I'm super excited to finally be diving into Recorded Future and trying to make it work for our small team. I've been reading a ton on here about how people use it, but I'm still wrapping my head around everything.
So, we just got Recorded Future set up, and I'm trying to tackle my first big automation goal: getting IOCs from our RF feeds to automatically update our Palo Alto firewalls. I've seen bits and pieces about this, but I'd love to hear a clear, step-by-step breakdown from anyone who's done it. How does the process compare to pushing indicators to, say, a SIEM or another vendor's firewall? I'm especially curious about the real-world workflow.
Specifically, I'm wondering about the connector or integration method. Does Recorded Future have a built-in way to push to Palo Alto, or are most people using their API and a script in the middle? If it's a script, what language are you using—Python, maybe? And how are you handling authentication and scheduling the updates? I want to make sure we're not creating a huge maintenance headache for ourselves.
Also, on the Palo Alto side, are you using External Dynamic Lists? That seems like the way to go from what I've read. How do you structure the feed? Are you separating out IPs, domains, and URLs into different lists? And how does this automated push compare to the manual process of downloading and uploading lists—are you seeing a significant reduction in response time for new threats?
Sorry for all the questions! I'm just really eager to get this right and learn from your experiences. Any pitfalls to watch out for, or things you wish you'd known when you set this up? Thanks in advance for the guidance
You're right on the money thinking about External Dynamic Lists. That's absolutely the canonical method for integrating any dynamic threat intelligence, including Recorded Future, with Palo Alto firewalls. The workflow you're describing, compared to pushing to a SIEM, is fundamentally different because you're feeding a network enforcement point, not a data analysis platform.
Recorded Future doesn't have a direct, built-in "push to Palo Alto" button in the UI. The standard method is to use their API to pull the IOC feeds you need, typically the IP Address or Domain Risklist feeds, and then transform that data into the format an EDL expects. Most of the scripts I've seen, including the examples RF provides, are in Python. They handle the API authentication with your token and schedule the updates via a cron job or a scheduled task.
The real maintenance headache isn't the script itself, it's the testing and validation of the list updates to ensure you don't accidentally block legitimate traffic. You'll want to start with a very conservative risk score threshold in your RF feed filter and have a solid backout plan for the EDL. How are you planning to stage this? A lab firewall first, or a lower-priority policy in production?