Palo Alto Networks AutoFocus vs. Recorded Future Intelligence Cloud

Threat intelligence is the best approach for this tool, recommended if you have Palo alto firewalls on your perimeter as well or if you are familiar with Palo alto products, If you are looking for something more actionable and with more integrations options you might want to search for something else.

Incentivized

Recorded Future is mainly beneficial to the SOC. As part of the Monitoring team, Recorded Future makes the investigation of the alarms a lot easier for me. It can show the reputation of the IP/domain or even hashes which helps me redirect my focus to potentially malicious network activities.

Incentivized

• The ability to have quick access to the Palo Alto Networks threat intelligence repository is a big value add
• Each threat is enriched with a lot of contextual information
• Guidance on TI use cases

Incentivized

• Searching across multiple sources at the same time
• Indexing information in real time
• Dashboards, statistics and heatmaps about a certain topic

Incentivized

• Views are cumbersome, you should know what to search and use the input
• It's solely to PaloAlto environment I can't integrate other vendors natively
• Application integrations is limited, you should have your own SOAR to automaion
• Concerns related to privacy, I can't hash some values or variables on the cloud
• Sharing option of the datas with cloud has limited configuration
• It's aimed for strata, I don't see data coming/analyzed or integration for the prisma cloud side.

Incentivized

• For the Browser extension, since the main purpose is to present information with regards to the IP, I think it's best to give us an idea of where the IP originated/some additional information about the organization it belongs to.

Incentivized

I've had an issue with their browser-plugin which didn't want to authenticate correctly. RF's support could arrange for a session with me and identify and solve the issue. I was very pleased how serious they took my problems and also how knowledgeable they are.

If I have more general questions they quickly reply and most likely also have a solution at hand.

Incentivized

If you have Palo Alto, autofocus is the selected choice. If you have Checkpoint than the threat cloud. Price of autofocus is much cheaper. Unit42 is the real differentiator. Minemeld is unique to PAN and working perfectly. Search outputs and are detailed and gives lots of data. Integration with SOAR is much easier with autofocus. Indicator list is huge. Tagging works magnificent.

Incentivized

It is the most complete solution of these three, as the others are focused in specific areas and having really detailed analysis about threat actors, APT groups, etc. Recorded Future is not having this level of knowledge in really specific areas but doing a really good work covering thousands of sources and the most relevant forums.

Incentivized

• new attacks mitigation
• less need to hire personal to analyse data
• increase security level

Incentivized

• We've been able to identify leaked credentials and close those accounts off.
• We've also been able to identify malware being distributed or spam being sent out by customers using our infrastructure. Again we could shut off those accounts.
• Their domain-monitoring allows us to identify typo-squats and issue domain-takedowns for those (or at least add them to our monitoring / detection)

Incentivized