Hey everyone! 👋 I've been deep in Recorded Future this week, pushing its alerting system beyond the usual CVE or data leak notifications. I wanted to share a practical workflow I built for our security ops team: creating a custom alert for mentions of our company executives on dark web and clear web forums.
The goal was straightforward: get a near-real-time notification if any of our C-suite names pop up in discussions, especially in potentially threatening contexts. Here's how I pieced it together:
**First, defining the logic in Recorded Future:**
* Created a new Alert Rule from the Intelligence -> Alerts section.
* Under "Rule Conditions," I used the `Mentions` filter, not just generic entity matches. This cuts down on noise.
* Combined this with the `Topic` filter, setting it to "Cyber Crime" and "Violent Crime" to flag higher-risk contexts.
* Added our executives' full names and common abbreviations as specific entities to track.
**The integration piece:**
* I didn't just rely on the platform's email alerts. I used the **Webhook** action within the alert rule.
* The webhook payload gets sent to a dedicated Slack channel via a simple incoming webhook, giving the team instant visibility.
* We also pipe it to a low-code automation platform (Zapier) to log the event details into a Google Sheet for tracking and ROI analysis – it helps us justify the subscription cost by showing tangible "threats monitored."
**A few pitfalls I ran into:**
* Initial setup had too many false positives from legitimate news articles. Fine-tuning the `Topic` and adding negative keyword filters (like "-linkedin" "-press release") was crucial.
* Remember to regularly review and update the list of executive names and their variants. People change roles, and new execs join.
The result? A proactive alert system that's more tailored and actionable than generic brand monitoring. It's been running for a month and has already flagged two concerning threads we were able to address early.
Has anyone else built similar executive or high-value asset monitoring workflows? I'm curious about your approaches to tuning the signal-to-noise ratio.
Keep automating!
Keep automating!
Interesting approach, but have you quantified the alert volume versus the actual investigation workload it generates? I've seen teams set up similar "executive mention" alerts and drown in false positives from financial news articles, LinkedIn reposts, and completely benign forum chatter.
That `Topic` filter for "Cyber Crime" is a good start, but Recorded Future's taxonomy is still broad. You're likely pulling in dozens of non-actionable mentions for every legit threat. The math never works out in favor of 24/7 monitoring without some serious post-filtering. What's your signal-to-noise ratio looking like, and what's the hourly cost of a security analyst sifting through those Slack notifications?
Might be cheaper to run a batch query twice a day and spare your team the context-switching overhead.
pay for what you use, not what you reserve