How does one retrieve the latest version of the SOAR integration?
Based on the official documentation for the Recorded Future for Google Security Operations (SecOps) SOAR integration, the deployment methodology has transitioned away from standalone .zip file packages for manual installation.
The latest version is no longer downloaded as a separate file; instead, it is directly integrated and maintained natively within the Google ecosystem:
- Google SecOps Marketplace: The integration is managed and updated directly through the in-app marketplace. To access the most up-to-date features and support, navigate to Settings ➔ SOAR Settings ➔ Marketplace inside your Google SecOps instance.
- Community Edition Package: Search the store for the package explicitly named "RecordedFutureIntelligence". It is listed as a "Community" edition integration.
- Important Installation Note: The installation guide notes that you should install the Community edition ("RecordedFutureIntelligence") to ensure you are pulling the latest actively maintained feature set, and you should not install the certified legacy package labeled "Recorded Future".
Is the legacy Recorded Future SOAR app on Google marketplace still supported?
The “certified” Google SecOps marketplace integration “RecordedFuture” is considered deprecated and should not be used. Instead, use the “Community” integration “RecordedFutureIntelligence.”
Is the legacy 3rd party Recorded Future API feed in Google SecOps SIEM still supported?
The Google SecOps third-party API feed “Recorded Future” is considered deprecated and should not be used. Instead, use the ingestion script located in GitHub.
What data does Collective Insights ingest from Google Security Operations SOAR?
- IoCs enriched by Recorded Future
- The type (IP Address, Domain, etc.) of the IoC enriched by Recorded Future
- The case name the IoC is attached to
- The case ID the IoC is attached to
- The timestamp of the case the IoC is attached to