Watch List Management

Use Case Summary

Use Recorded Future Watch Lists to maintain curated, high-priority entities (companies, domains, IPs, vulnerabilities, executives, suppliers) so alerts and intelligence focus on what matters most to the Security Operations Center (SOC).

For further information on Watch lists click here.

Issue

Threat environments and business priorities change constantly. Without actively maintained Watch Lists, alerts and intelligence may be too broad, making it harder for analysts to focus quickly on what matters most.

Solution

Create and maintain Watch Lists directly in PS Banshee using banshee list commands. Upload CSVs for bulk changes, add entities individually, or request curation for new ones. Map Watch Lists to Intelligence Goals so only relevant alerts are triggered. Review and refresh the lists regularly (brands, domains, executives, suppliers, vulnerabilities, locations, etc.) to ensure coverage reflects your evolving risk landscape.