The Mandiant Threat Intelligence connector enables seamless integration of Mandiant's rich threat intelligence data into security workflows, providing timely and relevant information about emerging threats.

Mandiant Threat Intelligence provides comprehensive cyber threat intelligence that empowers security teams to understand the tactics, techniques, and procedures of adversaries. This connector enables seamless integration with Swimlane Turbine, allowing users to automate the retrieval of threat actor indicators, malware indicators, and detailed threat intelligence reports. By leveraging Mandiant's rich intelligence data, organizations can enhance their threat detection and response capabilities, ensuring a proactive security posture within the Swimlane ecosystem.

To effectively utilize the Mandiant Threat Intelligence connector within Swimlane Turbine, ensure you have the following prerequisites:

The Mandiant Threat Intelligence connector integrates with Swimlane Turbine to retrieve the indicators, threat actors, malware and report indicators.

This connector provides the following capabilities:

This connector uses oAuth Authentication and requires the below parameters :

Steps to generate keys for personal use (development and testing) from your Mandiant Advantage user account:

Mandiant Threat Intelligence API Documentation

Authenticates Mandiant Threat Intelligence using oauth 2.0 client credentials

Retrieve a list of indicators for a specified Threat Actor from Mandiant Threat Intelligence, including associated UNC groups.

{"path_parameters":{"id_or_name":"threat-actor--0ac5c1db-8ad6-54b8-b4b9-c32fc738c54a"}}

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"threat-actor--0ac5c1db-8ad6-54b8-b4b9-c32fc738c54a","indicator_count":{"total":83,"hash":0,"url":0,"fqdn":14,"ipv4":69,"email":0},"name":"APT1","indicators":[{}]}}

Retrieve a paginated list of indicators from Mandiant Threat Intelligence using defined parameters, including the start epoch.

{"parameters":{"limit":25,"offset":0,"gte_mscore":80,"exclude_osint":true,"include_reports":true,"report_limit":1,"include_campaigns":true,"start_epoch":1700823637,"only_recent_days":15,"end_epoch":1653426342,"next":"","sort_by":"publish_date","sort_order":"desc"}}

{"indicators":[{"associated_hashes":[],"attributed_associations":[],"first_seen":"string","id":"12345678-1234-1234-1234-123456789abc","is_exclusive":true,"is_publishable":true,"last_seen":"string","last_updated":"string","misp":{},"mscore":123,"reports":[],"campaigns":[],"sources":[],"type":"string","value":"string"}],"next":"string"}

Retrieve a specific indicator object from Mandiant Threat Intelligence using its type and value.

{"path_parameters":{"indicator_type":"ipv4","indicator_value":"39.52.41.194"}}

{"status_code":200,"response_headers":{"Date":"Thu, 20 Jun 2024 10:18:11 GMT","Content-Type":"application/json; charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","vary":"Origin","x-envoy-upstream-service-time":"12","via":"1.1 google","CF-Cache-Status":"DYNAMIC","Server":"cloudflare","CF-RAY":"896b03695ee6445d-BOM","Content-Encoding":"gzip"},"reason":"OK","json_body":{"id":"ipv4--ad58d6ad-381e-5b21-9f31-36ef8404ea6f","mscore":50,"type":"ipv4","value":"39.52.41.194","is_publis...

Retrieve a list of indicators associated with a specified malware from Mandiant Threat Intelligence using either its ID or name.

{"path_parameters":{"id_or_name":"malware--81f821d1-4ec9-534d-8dc7-53da47e5074a"}}

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"malware--81f821d1-4ec9-534d-8dc7-53da47e5074a","indicator_count":{"total":4,"hash":0,"url":0,"fqdn":4,"ipv4":0,"email":0},"name":"008S","indicators":[{}]}}

Retrieve indicator objects and associated reports from Mandiant Threat Intelligence using the provided ID.

{"path_parameters":{"id":"ipv4--98019aaa-43af-5869-b530-591a9a9d9fb3"}}

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"ipv4--98019aaa-43af-5869-b530-591a9a9d9fb3","mscore":100,"type":"ipv4","value":"190.31.53.131","first_seen":"2020-08-05T21:31:41Z","last_seen":"2021-01-10T06:52:11Z","is_customer_releasable":true,"reports":[{}],"next":"FGluY2x1ZGVfY29udGV4dF91dWlkDnF1ZXJ5V..."}}