Name: Live Demo | Battle of the Intelligence Workflows
Uploaded: 2025-12-03T16:30:54.114Z
Duration: 57 min 28 s
Description: Live Demo | Battle of the Intelligence Workflows

Transcript for "Live Demo | Battle of the Intelligence Workflows": Years. Two of those years in technical marketing, five of those years in sales engineering or solution engineering where I've had the chance to give demos of Recorded Future and all the different integrations you all will see today for companies across The United States and Canada. Now a few housekeeping items to start. This webinar is being recorded. All registrants will receive this recording via email after the live session has concluded. Throughout the webinar, if you have any questions for myself or our two guests who I will introduce here shortly, please use the q and a on the left hand or input input them on the right hand side of your screen. In the doc section as well, you'll see some other resources, which I'll highlight throughout, whether it's a free trial offering, our browser extension, our sandbox, or signing up for our capture the flag. Now I'm extremely excited to be joined by two of my colleagues, Mandy and Rob, who are gonna share their expertise on how Recorded Future serves as the intelligence backbone across different security operation platforms from Splunk, Azure Sentinel, and XR. So I'll have each of them introduce themselves. Let's first start with Mandy, and then let's go with Rob. Hi, everybody. My name is Mandy Abercrombie. I am a senior sales engineer here at Recorded Future. I work specifically with The US public sector, in the civilian space. I've been with Recorded Future about three years now, and I am a former analyst. I'm excited to, show you guys what we have to offer today. Great. Thanks, Mandy. And, Rob, it'd be great to have you introduce yourself as well. Yeah. Hi, everybody. Thanks for joining the webinar today. I think you'll find it really interesting. I'm an SC at Recorded Future. I've been here for just about three years now, and I've been in, cyber since 2003. And, the attackers are still keeping us very busy. That's for sure. Anyway, nice to see everybody. Yes. Keeping all of us busy definitely definitely true. So in terms of what we are going to cover today, both myself not both. All three of us, myself, Mandy, and Rob are going to cover briefly what Recorded Future does from an intelligence perspective for both your tactical and strategic types of use cases from triaging indicators to compromise to using our threat map to prioritize threat actors who are targeting your company or targeting your tech stack. But to start off before, as I said, with recording your demo, and then we'll go into some of our of our different use cases from ILC enrichment, how that works for our integrations we own, maintain, and engineer for both Splunk and Azure Sentinel. Then we'll go into some threat hunting use cases where we'll walk through how you're able to threat hunt using your recorded features data in both Splunk and XR. We'll wrap up our workflows with more of a stolen credential workflow, talking about how recorded features can be Infostealer malware and how that connects into really your whole stock ecosystem. We'll have q and a throughout, but I'll have some dedicated time at the end. And then I did just wanna mention in the docs tab that there is a capture the flag sign up. We're doing a capture the flag virtually next week. So if you're interested, please sign up there. But before we dive into the demo itself, I want to start off with a few poll questions, get some audience participation. So I'll open up this first one. First question is, you know, what is your primary role? Just would love to see what variety of different roles we have for those who are on this webinar today. I'm seeing a few security analysts or engineers, incident responders, have a CISO or some other security leadership, Some other I'd be curious actually to other. There's other role they definitely could have included in this in this call. Awesome. So about half so far of what people have been inputting are well, almost half. Security analysts or engineers probably working and architecting out of many different types of integrations, which is great. Awesome. I'll close that. Oh, I'm seeing a few intelligence analysts, which is great as well. Awesome. So definitely a pretty wide variety of different individuals on the call, which is awesome. For the second poll question, Let's go ahead and see what are some of the main platforms that you all are using primarily or security operations. It is multi selection, so you can choose many different ones. Seeing a few Splunk. That's good because we did mention Splunk in the webinar description. So if we didn't show Splunk, I would want my money back. Using CrowdStrike. Awesome. We won't be showing how we integrate directly to CrowdStrike, except when I do talk about our integration center, we are able to bring CrowdStrike ADR data into recorded future, which we'll definitely talk about. So text one users, Microsoft Defender, a a few other similar platforms. Yeah. Definitely, it didn't include, say, Exabeam or Sumo Logic, also integration that we do offer here at Recorded Future. Awesome. Last poll question. I will go ahead and close this one out and stop sharing. It is just curious to hear. Are there any current or former recorded feature users who are on the call? This will also probably help if there's questions that are moved both from more of a new user perspective versus those who maybe are more familiar with how we operate. Awesome. See a slight split above for yes, whether current or former user. Awesome. Well, glad to see we have a mix of those who are either current or former users as well as those who have never used us before. So welcome to all of you. So as I mentioned in my let me stop sharing this poll here. Close. Awesome. So with that, let's go ahead before we dive directly into the different integrations. I did want to walk through, especially for those of you who are not as familiar with Recorded Future and what we offer, let's walk through a demo of some of the top use cases that we have, specifically for indicators and compromise, how we visualize all that data, and most importantly, as you'll see, how do we bring this data into the variety of different different security tools? So at the heart of any security incident response or security analyst, you're going to be trying to triage and prioritize, indicators to compromise, and most importantly, especially for those security analysts in the call, how does this fit more operationally into, okay, this one indicator compromise we see, how does this fit into larger campaigns for targeting our company? Recorded feature organizes all this information into what we call intelligence cards. Sometimes we refer to this as a baseball card. As a New York Mets fan who is still very sad about how our season ended, I probably shouldn't use the baseball analogy, but, alas, it still fits pretty well, where this really is a dynamic summary of, in this case, an actively communicating c two server. The last confirms this activity via our network intelligence yesterday over this specific port, and we're tying it to a few different malware families. Now AI insights will summarize the findings, whether it's for an indicator of compromise, intelligence card, or the threat map as we'll go through. Again, identifying some of the malware families we've associated this IP address with and any other analysis that we've been seeing. Interestingly enough, this IP address is also on a custom list that I had created for a specific threat activity enabler autonomous system as well, which is interesting. But it's always it's really easy to pivot into other types of related intelligence. So if I know that this IP address was an alarm in, let's say, a logarithm or something in my SIM, I can easily pivot into okay. Well, how what is async RAT? If we've never heard of async RAT, although probably most of you have, async RAT is one of the most prolific remote access trojans and has been around for a while. We'll see AI insights summarize exactly what async RAT is, what are some of the ways that disguises itself when it's targeting different, different systems, or some of the most common IP addresses associated. And most importantly, for all the intelligence we have, it's really important to build action intelligence, which we'll see as we go through the integrations and the threat hunting capabilities, which does include our insights group providing detection rules or rules, sort rules, and YAR rules. We can see all those detection rules in the detection rule tab. We are automatically porting these rules into a few different integrations, including Splunk, so you don't have to worry about redownloading them from here. But for those of you depending on which integration you're using, we also do offer a detection rule API endpoint. So if you wanna programmatically grab any new Sigma rule so in this case, Insect created a new rule since we look for toggle defender, which we've associated with a few different types of malware families. All of these here including async route, which is why we're able to view this intelligence card. So all the information on exactly how this specific or the specific behavior is and then being able to look at that YAR role from here or Sabre role from here. Now in terms of how this all fits in, so during this demo today, we're really gonna be focusing on our integrations with Splunk, Azure Sentinel, and XOR. While those are not the only integrations that Recorded Future offers, for any of our current or former users in our integration center, it's extremely easy to set up the different integrations that we offer and to see which integrations we have based on specific use case. So whether I want to see or some integrations Recorded Future has that I can set up should know all integrations are included with, our, like, newer pricing and packaging. So you don't have to worry about paying for each individual integration. We could easily click into any of the integrations we care about. And wanted to know we do integrate and own or integrate into Google SecOps, Amazon GuardDuty, and a lot of other you know, I saw a central one person on the call. So if you haven't already set that up or don't have that in your licensing, you can click set up from here. I'll next be handing it over to Mandy to talk about Splunk. But within the integration center, we'll have an overview of all the top use cases, a lot of which you'll be seeing in the demo today, including more of the threat detection use cases and threat hunting, all of the resources you need to get started. Obviously, our team that would be more than happy to help you action and get started with your integration and then any other integration instructions as well. So with that, I'll bring Mandy back on to the virtual stage where we'll start going through more ILC enrichment and correlation types of use cases, in this case, using Splunk. Awesome. Thank you, Kathleen. Thank you so much. Let me go ahead and share my screen. There we go. So I'm gonna start with a quick walk through of how Recorded Future Intelligence appears directly inside of Splunk. After that, we'll dive into a couple of examples. But right now, what we're looking at is the home screen of the recorded future app inside of Splunk. Now we also integrate with, Splunk ES and Splunk store. So those are all, other integrations we do with Splunk. But this dashboard here that you're looking at gives you an immediate high level view of correlated indicators, recent threat activity, and trending alerts across your environment. So you can very quickly see what's going on in your environment today. You can think of this kind of Azure intelligence dashboard. It highlights the highest risk indicator types in your logs, and summarizes any enrichment activity that's hap that's been happening, helps you quickly understand where to focus your investigation. So speaking of which, I'm gonna go ahead and I'm going to look at the IP address correlations. So all I have to do to get there is just click on this bar here, and it will open up in a new tab. This page automatically correlates IP addresses with, found in your logs with recorded future intelligence. So, which IPs have the highest risk score, you can see that right here. You can also see what the, most, the top triggered risk rules are, the top IOCs that you're seeing in your environment. And then down below that, I'm gonna see those actual IP addresses, the detections, and then why they are risky. So all of this is right at your fingertips without having to, dive back into the recorded feature platform. I can also see all of these, risk rules that were triggered. I can see the scores just like we saw on the intelligence card in recorded feature. This is designed to give analysts a really fast way to spot malicious or suspicious IPs that may otherwise blend into the noise. So let's take one of these IP addresses as an example, and I'm going to click into one of these wrist scrolls here, and it is going to pop up in a kind of similar, scenario as is in the platform. We're gonna give you a an intelligence card inside of Splunk. So you can see everything that you see, within the Recorded Future Intelligence card inside the platform, But here, you're also going to get your infrastructure detections. So right off the bat, we see that the risk score is a 99. We are going to see the, the the details that we saw also in the intelligence card. We're gonna see those technical links as well. So we're gonna see the victims and exploit targets. We're going to see what actors and TTPs, MITRE attack, MITRE attack identifiers, and any malware that's associated with the, IP address. And then we do get the Recorded Future AI Insights here as well. Now you can dive into those top triggered risk rules. This one was actively communicating as a validated c two server. You can go down to the CIDR details and which threat list these appear on and then, of course, the references. So just like you would see in recorded feature without having to pivot out. So I am going to go ahead, and I'm going to pass it over to Rob to show you how this works in Cigna. Awesome. Thanks so much, Mandy, for walking through some of the IP enrichment use cases and how it's all nicely displayed within Splunk. Since, as we mentioned before, Splunk is an integration, obviously, we built with Splunk, but then we own the integration itself between as we add new capabilities into the report feature platform, Splunk is able to replicate most of those because we own some of that building pieces. But with that, yeah, I'll pass it over to Rob to walk through how does the indicator enrichment and correlation pieces work within Azure as well. Great. Thank you so much. Just, getting over to the correct, tab here. Okay. Here we go. Alright. So what I'm showing you, within Microsoft Sentinel workbooks, I'm gonna take a couple steps back and just, mention that the foundation of our integration, our collection of logic apps, that are available on the Azure GitHub repository. These workbooks that I'm showing you here now are essentially Azure correlation dashboards. They're called workbooks, but essentially they're a set of correlation rules. And you see here that we're correlating domains, hashes, IPs, threat actors, URLs. So what I'll do is I'll go over to the IP correlation one just to show you what that looks like. And, conceptually, it's pretty similar to what Mandy was showing with the Splunk integration, and, it's just set up a little bit differently. So, what's nice about this particular the way this was done is that it's going to show how do you specify how far back do you want to go in terms of logs, where what are you correlating with. In this particular case, there are the NetScreen firewall logs. What fields are we paying attention to. In this particular case, we're looking at the destination IP because we want to understand, whether or not any of the what destination IPs are actually actively communicating command and control servers. And that was shown to you earlier in the in the presentation. So, what do we have here? So we have a nice histogram. And if I were to go down and just happen to select one of these, you'll notice that all of these, have a risk score of 99. And that's, 99 is the highest possible risk score. Our risk scores go from one to 99. Highest severity are 90 and above. So these are all the ones that you see here are actively communicating validated command and control servers. And I all I have to do is just select one of these and scroll down a little bit and you'll see the evidence details right here. You'll see that this particular IP address is an actively communicating validated command and control server and that's why it has a risk score of 99. It's showing again that the source data is from the NetScreen firewall and, it's also showing, that this action was permitted. And that's important because if it wasn't for this correlation, more than likely this would be a blind spot to this particular organization because you, endpoints would have been communicating to this, one thirty six dot one fifteen dot one zero two dot two twenty five, which is the validated command and control server. And right here, we see the source. So this particular source, 10Dot1Dot210Dot60, that would need to be addressed because that's been communicating to a command and control server. Again, without our intelligence, this would have been totally a blind spot. And that is, you know, part of the demo that I wanted to show you. So let me do this. Let me go back and, stop sharing so that way I can bring, the presentation back to Kathleen. Thanks so much, Rob. Yeah. It's great to see. Again, as mentioned, we also maintain and engineer ourselves the Azure Sentinel and Defender integrations that we have, obviously, working with our partners over at Microsoft. Very similar to Splunk being able to have those correlation rules, the custom types of, you know, if you wanna bring in, like, a phishing list, for example. Actually, there was one question did wanna answer. I was just seeing it in the chat. And the question was more on what types of can we basically customize the intelligence that we're actually bringing into these different integrations? And I did wanna say the answer is yes. And one way I can briefly show or talk about that would actually be using the Connect API. So for those of you who are current or former Profuture users, you've probably seen our Connect API before. But well, how the API works is, as Robin mentioned, we have all the different risk rules across multiple different types, indicators compromised, whether it's from URLs to vulnerabilities, to IP addresses, as well as malware, domains, etcetera. So by default, you can all the risk lists, so any intelligence that has or indicators of compromise risk score of 65 and above by default is enabled in those different integrations. But you also can customize those based on, let's say, specific risk rule. You know, very common as Mandy walked through, we have dashboards pre created based on specific risk rules. So if I want my dashboard based on accuracy two servers, all of that is available to pull directly from our API or, again, we have that prebuilt into the integration so that you can customize. You know, maybe I want to only pull have a dashboard for IP addresses with a risk score of 90 and above. Or, as mentioned, being able to use programmatically all the different risk rules on the back end so you can really customize those pieces. This will be really important too from or the store use case perspective, especially for hunting, which we're going to walk through. Awesome. Before we dive into the next section, we're focused on threat hunting. I have one last poll question for everyone here. Always intrigued to hear and see how often for those of you on the call that do threat hunt or work with your team that does threat hunt, whether they're on your team or you have a separate threat hunting team, depending on the size of how often your team does perform a threat hunt. And I didn't actually specify exactly what I mean by threat hunt here, but I do mean outside of the normal. I'm triaging alerts. I'm programmatically saying, hey. I wanna hunt for all async rat and the gears are compromised in my environment if I want to make that simple. Okay. But can you even split between weekly, quarterly, or less, or ad hoc? And as well, I probably should've split up the last question, but either we don't currently for a hunt or maybe it's outsourced, which obviously, if you have smaller team and you need to do something more ad hoc, it's great to be able to rely on some of maybe your MSP or partners to do that. No one's doing daily threat hunts, which does make sense. That would usually take up a lot of bandwidth. So, yeah, weekly or quarterly ad hoc, that all makes sense to me, and it's pretty common with the different customers that we work with. I'll stop sharing this poll. And before we go through both the try heading use cases in Splunk and XOR, let's quickly walk through what this looks like within the recorded feature platform. We just walked through the connect API for a little bit. From a threat hunting perspective, any successful threat hunting capability really is gonna be driven by having the correct priorities of what you should be threat hunting. Right? And depending on the bandwidth of your team, it's not as though one you should or you're gonna be threat hunting every day. You could maybe depending on how you built out those priorities. And one thing we'll talk about at the end is what the core feature is building to really help with the threat hunting, even more operationalizing your threat hunting capabilities. A lot of the ways the core feature helps prioritize what you should be threat hunting is based on the threat intelligence provider and threat intelligence module physically on our threat maps and our malware maps. How these work is it helps you understand what are the top five threat actors or malware families that have had the biggest change in, let's say, the last thirty days, again, based on your own environment. So in this case, we're seeing pin seven and also a few other newer threat actors to my threat actor map, Blacklock, Bangor, and Decoder. These may be make me think, oh, interesting. I'm not familiar with these threat actors. Maybe we can go ahead and run threat heads to to these threat actors. All these are compiled into our threat actor map, which, as we mentioned, is personalized for your organization, not just based on industry and geography, which is important. We absolutely do that. But having it be based on your brands. Are there hacktivist groups who are referencing your brand, maybe different dark web sources or trying to drum up interest in, say, targeting your organization from a hacktivist perspective? What about threat actors who have been known to target the technologies that you're currently using? I'm able to easily filter for those threat actors. I can see all the evidence for why the threat actors on this threat map are currently there. Unimportantly, I can always filter on the specific threat actor of interest and understand why this threat actor has this placement on my threat map. Importantly, any hunting packages to actually help you, not just hunt IOCs, but also hunt behaviors are going to be prepopulated for you, whether it's Yara rules or Sigma rules. As I mentioned from our index group team, I didn't mention this at the top, but insect is a Swedish word for insight. They are a threat research team who does strategic research as well as more tactical types of intelligence as well. AI insights is summarizing again why Dragonforce Group has a moderate severity on my own threat map based on some of the organizations they've targeted in the past, some of the vulnerabilities that they've been known to abuse, as well as other types of technologies. It's really easy for me to export all this intelligence directly from here. I can also click export from here, or I can export my entire tracking table, the evidence itself, or the threat map as a PDF as well. Now what we'll be showing within Splunk is how we're actually able to replicate this intelligence. So I'll actually bring back up Mandy to show you how the threat map and how we're able to within Splunk itself. Awesome. Thanks, Kathleen. I'm gonna pick right back up where I left off. I'll go ahead and share my screen. Alright. So, when I was on stage earlier, we were looking at this suspicious, actually malicious, IP address. So now I want to show you how easy it is to pivot deeper into the intelligence. So right here, we can see that this is, associated with Cobalt Strike Beacon, and all I need to do to bring that up is go ahead and click on it here. I have it pulled up over here, and you will see, all of the technical indicators that are associated with Cobalt Strike. And this is important because you can pivot into any one of these pieces of intelligence and dive deeper into it. So if you wanted to go and look at the intelligence card inside of Splunk for this hash or for this URL or see if you have any indicators related to those, you could dive into those individually. So it's automatically connecting all of these indicators that we know, are related to COBOL Strike Beacon. So now we're gonna get the full description of the TTPs. We're going to get all of the analyst notes from the Insit group, any validated intelligence events. And, of course, if we go all the way down to the bottom, we will see the references and AI insights. So going back up to the top here, this is great information to have. Right? It's great that we can click into each individual indicator and get more information. However, what if I want to see all of the indicators that might be in my environment that are related to this particular piece of malware? So what I can do very, very quickly as an analyst here is click on create a threat hunt. Now this is going to create an IOC sweep hunt across your environment. You are going to give it a name, and then you can choose. So we know that your logs may be in different indexes, indexes. So but depending on where you're gonna look for it, you'll choose the indicators that are appropriate, and then you'll choose the index or data model and where you want it to look. Lastly, you're going to tell it how far back you want it to go. Depending on your Splunk instance, you may want to be careful with that number a little bit, and then you can schedule the search to run on a regular basis. Once you click save, it is going to save this threat hunt and go ahead and run it. So where do we see that? Let's go ahead and pop over to the threat hunts page, which is right here at the top. This will pop us into the, the threat hunt screen, which is gonna show and, of course, my screen is not loading, but this is going to show the threat map just like you saw in, the recorded feature platform. So while that loads, we'll just talk a little bit about the threat hunts here. So the threat hunts that are run, those IOC sweeps that you saw before, they're all going to show up here along the bottom of the page. So you can see when the last run was, the status of that run, and, the next scheduled time for that run. So if I click on one of these threat hunts, we're going to see all the times that it was run. So this particular Cobalt strike threat hunt has, been run twenty twenty two times. The latest time that it ran was back in November. So we can pop this open, and we can see what the indicators were that were found in this particular IOC sweep. Now this one was configured just to look at IP addresses. So this is looking in the firewall source, and it is finding different, sources of the events. So you can dive down into it. You can really get into the details of where it was found, when it was found, whether it was blocked or allowed, so all of the things that you want to know about that particular, instance of this IP address. You could also click through here and get to the intelligence card for this particular IP as well. Let's pop over here and see if this loaded. So it did not load, unfortunately. I'm gonna go ahead and reload that page so we can come back to that. So at the another thing that I wanted to point out when we're talking about threat hunts is the ability to use those hunting packages. As Kathleen mentioned, that our instinct group, writes for you, and they are sent over immediately from the platform into Splunk as they are updated as they are created. So the way that you would see that is to go to the alert center and go to the SIGMA detections. And to see those SIGMA rules, we're gonna click over here to rules, and these are all of the rules that were sent over from the platform. These are rules that are written and maintained by the NSIK group, so whenever there's new information, these will be updated and reloaded for you. Now there are a couple of filters up here at the top that you can use to look for specific Sigma rules. So you can target a specific platform, you can target a specific MITRE T code that you're looking for, and then you can see the ones that are active versus, not configured. So, obviously, when you have activated them, they're going to show up under active. So we can see all the ones that we are actually running. Now let's take a look at one of these, Sigma rules here. So we're going to look down here at the bottom at this detect, t chopper lateral movement, and we can see what it's actually looking for. Now if I want to see those detections, I can pop over to the detections and see all of the ones that we found. So this one finds a lot. This one's, this one's pretty active. So when I see that there has been, one that was triggered, this was triggered a couple of days ago, I can just click into that and I can see the details of that detection. So what this helps you do is to very quickly and succinctly find things in your environment that might be potential issues. So this is a very quick way to threat hunt Even if you are not currently doing any threat hunting, if you are, you know, you don't feel like you're mature enough or you're not not quite there with your program yet, this is just kind of the easy button. Doesn't require you to write any detection rules, and can help you find those events in your environment very quickly. So I will pass it back to Kathleen now. Awesome. Thanks, Mandy. As Mandy mentioned, the ability to easily launch threat hunts, especially for TTPs. Obviously, looking for behaviors is definitely more difficult indicators to compromise and usually slightly higher shouldn't say fidelity because the indicators themselves are usually high fidelity, but being able to look more at the behavior piece is really important. So having those signal rules preloaded and translated into Splunk query language into Splunk is an extreme value adder. With that and the bring Rob back up onto the virtual stage. He's gonna walk through for hunting use cases and how this works in both Azure Sentinel as well as XOR. Great. Thank you, Kathleen. So we are back to the workbooks, and you'll notice that I have one workbook that says threat actor hunting, and we're going to go ahead and dive into that. And, when we look at this particular schema, once it loads up, you'll see it looks very, very much like what Kathleen was showing you earlier in terms of the threat map, and it even provides you a nice, tutorial on, what we mean by intent and what we actually mean by opportunity. Well, so what are we gonna do with this information? What we're gonna do is we're we actually have a logic app that's going to, threat, fetch this threat actor information, and it's going to update it on a daily basis. And we can set a threshold, for certain threat actor scores. So for example, we see here that the intent of the Acura ransomware group for this particular organization is a 99, the same thing with, Quinlan. So we're probably want gonna want to, create some sort of analytical rule that's going to check for correlations between the threat actors and, the internal telemetry data that you're collecting within, Microsoft Sentinel. So what is this actually going to look like? When the a correlation match actually occurs, what's going to happen is that an incident is going to be generated. And so for example, we see here that there's a recorded future threat on threat actor for incident for a p t 35 because there were some hashes that were actually matched. And, of course, I could look into the full details, and if I go ahead and do that, there's certainly some workflows that can occur here. So for example, I can investigate in Microsoft Defender XDR. I could take these three hashes, make sure we push those down to Microsoft Defender XDR, and do a blocking on those hashes automatically. And it should be noted that, if you want to be extra proactive, we actually have a couple of Microsoft logic apps for Defender where you can bring in our high fidelity riskless and do blockings on domains and IPs as well. So So I did did wanna mention that. So that's, an overview of what we do for Microsoft Sentinel. Before I leave, I do wanna mention, and you may have noticed this, that we do have the ability to bring in recorded future, both playbook alerts and classic alerts, and you see some of those here as well. And by the way, we can do the same thing within Splunk. So let me do this. Let me go ahead and transition over to, XOR while I'm here and we're talking about threat hunting. And really the the crust of oh, no. I apologize, but it looks like I'm going to have to log in here. I just got timed out. So give me a second here. And, thank thank thank goodness for, having Keeper to keep the password safe. And when I do log out, it it actually, brings me back in, which is which is great. So, we'll go over to the playbooks. Once they come up, let me go ahead and do a little bit of a refresh here. Okay. Here we go. Alright. So, if we see here that there there are a couple here for identity exposure, we're going to actually cover that in a little bit, when we go through an identity workflow. But you'll see here that, we have a threat actor search. This is where we could, enrich a threat actor. You know, take a look at the threat actor map, grab the links associated with the threat actor, and see whether or not there are IOCs returned. And let me do let me put this in a mode where you can actually see this a little bit better. And if there are IOCs returned, what you actually can do is you can if you do have a SIEM, you could kick off a threat hunt, just like Mandy was showing within Splunk. And, of course, you have QRadar or, you know, some other SIM you could include that within the playbook as well. And you could also look for detection rules within the portal just like Kathleen was showing you earlier, and, you could download those manually and run those manually if you like. So you have the choices of doing as much automation as you'd like or doing some of the work manually as well. Let me go back to this. So, you know, part part of what we're looking for you know, I noticed that we did a threat actor link search. So, if we go down here, we'll see here that, for example, if we're looking at, let's say, IOC reputation, just as an example. See those these are some of the building blocks for that threat actor map playbook and that I was showing that was just showing you. So, we can look at IP reputation, domain reputation, CVE reputation, URL reputation. And, you'll see here that, for example, we have a recorded future IP reputation. There's a separate playbook just for that. And, and how do we actually get that information? Well, the building blocks, all start with the commands that you can actually do within XOR. So let's actually just stay with this particular one here. And let's, go down and actually we could just run any commands here that we like. And I'll go ahead and focus on the recorded future ones. So just as example, if we wanted to do, let's say, recorded future, let's say, for example, we could go in and we could take a look at, for example, the future recorded future intelligence and run it on a particular entity, let's say, one dot fifteen dot twenty five dot one forty eight. This is, enrichment that we can actually perform within within XOR. And the entity type is gonna be IP, and then we're going to go ahead and say that we want to put in the analyst notes as well. So I'll go ahead and run that, execute that within the play playground, and that's going to come back and provide us with some really good, information, once it once it finishes executing here. And, so, again, we can go ahead and we can enrich, the threat actors. We can enrich the IPs, and, and that's pretty much what I wanted to show you. I also wanted to show you that there is a marketplace, within Xor, that you could actually they're having a very good luck with, this. So let's go over here and do the marketplace as well, and this will, show you what we actually have for recorded future. And you'll see here that we have various, content packs for the XOR as well. If we go back to the where we were before with the playground, let's just see, where how we're doing with that. And, you'll see here that we were able to get the information that we were looking for. So let me go ahead and stop sharing. And, Rob, for walking through. Yeah. Awesome. Actually, Rob, since you'll be talking and kind of closing us out with the collective insights, thank you. Welcome to stay on. But as Rob just walked. through, being able to go and do throttling capabilities as Mandy walked through in Splunk, being able to do those in Azure Sentinel and XOR using that DBOT enrichment, building up those playbooks. You can build all your own custom ones, whereas Rob showed, there's lots of different prebuilt playbooks that you can use. So to wrap up our integration focused demo, we really wanna just start or end. Not start. That would be kinda late into the game to start the demo. To end talking about triaging and alerts specific to an info sealer malware, but most importantly, how we're tying that into our SecOps dashboard. Because as we mentioned, there's a lot of different tools that you can send into Recorded Future, including CrowdStrike, since I saw there's a few CrowdStrike users here. So I'll hand it back over to you, Rob. You didn't have to leave the stage, because I'm just gonna hand it back over to you to walk us through how you can look at collective insights, specific that info stealer malware as an alert starter. So I'll hand it back over. to you. Sounds good, Kathleen. I'll go ahead and do that right now. Alright. So, for those of you who may have identity and even for those who don't currently have our identity intelligence, What I've done here is, I we have the ability to distinguish between workforce credentials, which we call employee credentials, and, any users of your authorization platforms, I. E. Maybe customers logging into your portals. Right now, we're focusing on employee or workforce credentials. I've, gone in and actually, we're collecting, information around malware sealers for about 35 to 40 malware stealer families. The number keeps growing all the time. What I've done is I focused on the Vidar malware family, and you'll see here that we've over the past ninety days, for this particular enterprise, there have been a number of detections. This particular one at the top is to it looks like a WordPress admin, so we'd probably want to go in and take a look at that. And, what this is providing information with is what, when was the when was the information exfiltrated, I. E. When when is the system infected with Vidar malware? And you'll see here that it was a Windows 11 home system. It has the username, the file path location of the the malware, the name of the machine, and of course the name of the malware family. And this is a high priority because it's web content management, WordPress. And, again, the system has been infected with malware stealers. You'll also notice that there is, an incident report. And just to note up here that over 421 of this particular, system's credentials were compromised, during this malwarecellular infection. So one of the things that we may want to take a look at, in additioning to obviously resetting the password and possibly using, XOR or even Microsoft IntraID to automate the resetting of the passwords, because we do have an API and we do have out of the box integrations for both XOR and Microsoft IntraID, we might want to do is take a closer look at Vidar, and take a look at that intelligence card. And what we're gonna do is we're gonna go right to the full intelligence card and you'll see here that we have some detection rules. We have Sigma rules that you could use within Splunk, store rules that you can leverage within your IDS or IPS, and then of course, your rules which you can leverage within your EDR. So the for those of you who are interested in threat hunting or you're already doing threat hunting, we have the threat hunting packages right here at your fingertips. How does this solve? And, of course, you have the, recorded future AI insights telling you all about Vidar, how it's an info stealer that appeared back in 2018 on Russian underground forearms and a whole bunch of other information here as well that certainly could be useful to you. So where does this fit in with what we call collective insights? Well, collective insights is actually going in and telling you about the detections. In this particular case, it's through the Splunk NetScreen firewall logs where we're actually seeing these IOCs. In this particular case, these are, fairly high risk scores. Basically, anything 65 and higher is considered a high risk score. And, we'll also notice notice noticing the changes as well. So for example, the ones that are in the nineties right now, what you probably want to do is make sure that, you have those added to your block list just as example. And, again, what's what's nice about this is that this is taking us right into the collective insights explorer so that way you could see how prevalent is the Vitra malware within your environment. So let me go ahead and stop sharing and bring this back to, Kathleen. Great. Thanks, Rob. As Rob had just walked through, collective insights or the SecOps types of use cases are really interwoven into also as the walk through the info sealer malware credential. So, again, for those of you who are current customers or using our SecOps module, connecting your different tools to collective insights is definitely something I highly recommend. We are working in getting FedRAMP certified. I mentioned this because, obviously, Mandy, working with public sector. So to wrap things up, let me super quickly you know, so they've mentioned collective insights. I did also want to quickly showcase, like, when you do decide or if you do decide to bring in different data points into collective insights. Where else you would see that within the platform? So for those of you who have collective insights turned on, again, that is baked into a variety of different integrations. So if you're using Slunk, you can just turn that on, and it will start feeding valid detections to recorded feature. See that in SecOps module where we'll have our malware comparison. So what are the malware families we're seeing at detections in in your environment? And importantly, how does that compare to other organizations? And for example, Exworm, fairly common. 25% of recorded feature customers have also seen Xworm in their environment. But maybe I just wanna filter by oh, interesting. I'm seeing some other malware families that recorded feature customers maybe aren't seeing as much in their environment. And then if I click into details, I'll see exactly where those detections are and any detection rules as well. So, like, rules, Yara rules, we've said all these rules, many never died. So did wanna highlight there's multiple different ways, again, when you do decide it is included. So any integration that you want to bring into recorded feature from a content insights perspective, you'll see all of your status of what's turned on and what is currently still talking to recorded feature. And then you'll also be able to see any of your sandbox analysis since the sandbox is included with our SecOps and threat intelligence licenses. So being able to use that behavioral analysis to submit those samples whether programmatically using a playbook or maybe use Sysco One, Our integration with our sandbox works there as well. So many different ways. And what I'll end on too is all this data will be tied to the MITRE ATT and CK matrix, where I can easily compare what are we seeing changes on in the last, let's say, thirty days or the last seven days that maybe I want to take a little bit more of a look at, or are we seeing a great decrease in specific TTPs as well? This can help drive by threat hunting use cases. So what particular types of minor t codes do I wanna be hunting in the different tools as well? So before we officially wrap up, for those of you on the call, I did want to mention some exciting news about what we are launching next month in January. So we are launching what is called autonomous threat operations. This is gonna be an add on layer for either our SecOps or threat intelligence modules, whichever one you own. And high level from a threat hunting perspective, you'll be able to do a lot of different things. Let's say, for example, I wanted to only look at my financially motivated threat actors. So, again, threat actors, financially motivated, who are specifically targeting different entities in my watch list. I'll be able to create a threat hunt where all of the indicators of compromise as well as the sigma rules, they're not seeing that here, but that will be included, will be preloaded. I can bring in different sources and try and cross correlate, and then I'll be able to run those hunts across different connected endpoints from pen from Microsoft to Splunk to Google to CrowdStrike, etcetera. And I'll be able to see all those findings right here from my threat. So what are some of those top threat actors we're seeing from our threat actor, HUDs that we've been running, the malware families, as well as the TTPs? So I said this is coming in January. We'll have an official launch webinar as well scheduled to be determined, but really excited for this new launch. And, really, it's gonna build on all the capabilities that we just walked through today. So officially wrap things up. Let's see what questions we have. Awesome. So one question seeing is more on, like, the integration pricing and what's included. So yeah. So for those, especially current or, you know, former recorded with your customers, we do offer unlimited integrations with either our foundational or essentials packages. So what that means is in the integration center, you can easily turn on and off different integrations as well as bring some of those data points into collective insights. So whether you're a product or EDR user and you want to visualize some of those detections across your other tools in recorded feature, that's possible. See. One other question. We're on the services side. So what is included like that, which is a great point. So we try to have as much support documentation in the integration center as possible, but that does include integration support. And if you need additional support, so you maybe need much more hands on, like, we wanna build a lot of custom workflows or playbooks, you do have the option to add on more professional services credits for that, again, tied to those different integrations. The last few minutes we have, for those of you who are either new or former or maybe not reported to your customers, one reason love working at Recorded Futures, we are really trusted by so many different organizations across government as well as private sector to really help drive their threat intelligence programs. And this leads into being able to help, especially for those who are security analysts or SOC analysts, not chasing down as many false positives, saving time with your incident response, being able to more proactively threat hunt based on your threat map, all of which helps us be top rated by leading analyst firms as well as number one on Gartner Pure Insights. So to wrap things up, for those of you who are not recorded future customers, we are hosting a virtual capture flag next Wednesday, which you can sign up using QR code. I promise it's not malware. If you are a current recorded feature customer, we are running a capture flag on December 11. If you're interested in that, please reach out to your support team so you can get signed up. And if you are able to make this one, we're gonna be running quarterly virtual capture flags for both our customers as well as those who maybe aren't customers yet. And with that, I wanna say a huge thank you to Mandy and Rob for walking through in great detail how our different integrations work, especially from the IOC enrichment, correlation use cases, the threat hunting use cases, and then summing it all up with how we're able to visualize some of those detections back into recorded feature. As I mentioned in the docs tab, lots of great things that you could sign up for, for the capture flag, to our state of threat intelligence webinar happening next week, as well as a few other free tools from our browser extension, which I did not walk through, but you are able to use our free browser extension, free sandbox, and then some other free tools as well. So, again, thank you all for the time. If you have any questions, feel free to reach out to any of us, honestly, on LinkedIn, or you can reach out after. As I mentioned, this recording will be sent once we wrap up here in the next, you know, little bit. So thanks again, everyone.