Deprecate Recorded Future Fileset

[jamiehynds]

As we work through a longer term plan to fully support Recorded Future TI, we need to mark the RF fileset, within the TI module as experimental. Our current approach is not supported by Recorded Future and want to make it clear to our mutual customers that the current integration is not supported and mileage may vary.

Please add the experimental flag to the RF fileset in our docs: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html#recordedfuture

// @shimonmodi @P1llus @adriansr

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[jamiehynds]

@shimonmodi can you provide the text you want to display for the RF deprecation notice?

FYI @adriansr

[shimonmodi]

Something along the lines of "This threat intelligence module is configured to use the search API for RecordedFuture, which does not provide the best analyst experience. We recommend using the RecordedFuture Integration Package (link here) for the most optimal experience."

[mbarretta]

@jamiehynds is there a plan to update our integration to the RF supported method?

[jamiehynds]

@mbarretta this issue should have been closed. We shipped a new Recorded Future integration based on their recommended approach to ingest their TI data. Here's the PR: elastic/integrations#2757

Are you running into difficulties with the current integration? There's some known issues around our inability to handle IoC expiry, which we're currently working on across all TI integrations.

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!