Threat intelligence has grown into a necessary part of nearly every enterprise security team. According to the SANS 2017 CTI Survey, security teams are finding more value than ever in using threat intelligence for security operations and response, with 60 percent of teams already using threat intelligence, and another 25 percent who are planning to. However, anywhere from 20 percent to 47 percent of organizations are using disparate intelligence feeds rather than an integrated user interface, indicating a continued need for improvements in integrated visualization and workflow. Plagued by inefficiencies of manual collection and analysis, inconsistent and delayed availability, and difficulties effectively integrating intelligence into everyday security processes, a unifying platform is needed.
Powered by machine learning, Fusion customers can centralize and customize proprietary and internal threat data with external threat intelligence. Fusion provides unprecedented analysis of the broadest and most comprehensive set of open and closed feeds (such as indicator data from FS-ISAC, ReversingLabs, and Farsight Security), internal risk lists, and internally generated analyst notes — all in one view. The result includes the following benefits:
? Centralization. In many security organizations, analyst notes and investigation outcomes are not centralized and consolidated with other relevant intelligence, leading to duplicative work, inefficiency, and missed opportunities to reduce risk. Additionally, managing multiple threat intelligence software tools (providers and platforms) from several vendors limits overall value, flexibility, and effectiveness. Recorded Future customers can store, access, and manage all of their threat intelligence from a single pane of glass for increased efficiency and added value.
? Customization. Every use case for threat intelligence has unique requirements. The wrong data integrated in monitoring and alerting solutions can inundate teams with false positives and noise that lead them to miss important information. Organizations can seamlessly integrate valuable, proprietary intelligence and internal analysis with best-in-class intelligence. The ability to then tailor the data stream for their specific needs and use cases enables organizations to have the threat intelligence they need where they need it.
? Collaboration. The data that threat intelligence teams gather is invaluable across the organization, but it often sits siloed within one security team. The new functionality enables consistent collaboration across teams within the organization. Everyone has access to the same consolidated internal and external intelligence.
