--- title: Mandiant Threat Intelligence slug: connectors/mandiant-threat-intelligence docTags: createdAt: 2026-06-09T16:29:48.099Z --- The Mandiant Threat Intelligence connector enables seamless integration of Mandiant's rich threat intelligence data into security workflows, providing timely and relevant information about emerging threats. Mandiant Threat Intelligence provides comprehensive cyber threat intelligence that empowers security teams to understand the tactics, techniques, and procedures of adversaries. This connector enables seamless integration with Swimlane Turbine, allowing users to automate the retrieval of threat actor indicators, malware indicators, and detailed threat intelligence reports. By leveraging Mandiant's rich intelligence data, organizations can enhance their threat detection and response capabilities, ensuring a proactive security posture within the Swimlane ecosystem. ## Prerequisites To effectively utilize the Mandiant Threat Intelligence connector within Swimlane Turbine, ensure you have the following prerequisites: - OAuth 2.0 client credentials for authentication with the following parameters: - URL: Endpoint for the Mandiant Threat Intelligence API. - API Key: Your unique identifier to authenticate with the Mandiant API. - API Secret: A secret key paired with your API Key for enhanced security. The Mandiant Threat Intelligence connector integrates with Swimlane Turbine to retrieve the indicators, threat actors, malware and report indicators. ## Capabilities This connector provides the following capabilities: - Get Actor Indicators - Get Indicator - Get Indicator by Value and Type - Get Malware Indicators - Get Report Indicators ## Asset Setup This connector uses oAuth Authentication and requires the below parameters : - Key ID - Key Secret Steps to generate keys for personal use (development and testing) from your Mandiant Advantage user account: - Login in to Mandiant Advantage - [https://advantage.mandiant.com](https://advantage.mandiant.com) - Click the Settings menu - From the APIv4 Access and Key section, click the Get Key ID and Secret button - The Key ID and Key Secret are displayed, copy and paste these to a safe location ## Notes [Mandiant Threat Intelligence API Documentation](https://docs.mandiant.com/home/mati-threat-intelligence-api-v4) # Configurations ## Mandiant Oauth 2.0 Client Credentials Authenticates Mandiant Threat Intelligence using oauth 2.0 client credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | client\_id | API Key | string | Required | | client\_secret | API Secret. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get Actor Indicators Retrieve a list of indicators for a specified Threat Actor from Mandiant Threat Intelligence, including associated UNC groups. ### Endpoint - **URL:** `/v4/actor/{{id_or_name}}/indicators` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | --------------------------------------------- | | `path_parameters.id_or_name` | string | Required | The id or name of the Threat Actor to return. | ### Input Example `{"path_parameters":{"id_or_name":"threat-actor--0ac5c1db-8ad6-54b8-b4b9-c32fc738c54a"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------- | -------- | ------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `indicator_count` | object | Count value | | `indicator_count.total` | number | Output field: indicator\_count.total | | `indicator_count.hash` | number | Output field: indicator\_count.hash | | `indicator_count.url` | number | URL endpoint for the request | | `indicator_count.fqdn` | number | Output field: indicator\_count.fqdn | | `indicator_count.ipv4` | number | Output field: indicator\_count.ipv4 | | `indicator_count.email` | number | Output field: indicator\_count.email | | `name` | string | Name of the resource | | `indicators` | array | Output field: indicators | | `indicators.first_seen` | string | Output field: indicators.first\_seen | | `indicators.last_seen` | string | Output field: indicators.last\_seen | | `indicators.mscore` | number | Score value | | `indicators.attributed_associations` | array | Output field: indicators.attributed\_associations | | `indicators.attributed_associations.name` | string | Name of the resource | | `indicators.attributed_associations.id` | string | Unique identifier | | `indicators.attributed_associations.type` | string | Type of the resource | | `indicators.id` | string | Unique identifier | | `indicators.type` | string | Type of the resource | | `indicators.value` | string | Value for the parameter | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"threat-actor--0ac5c1db-8ad6-54b8-b4b9-c32fc738c54a","indicator_count":{"total":83,"hash":0,"url":0,"fqdn":14,"ipv4":69,"email":0},"name":"APT1","indicators":[{}]}}` ## Get Indicator Retrieve a paginated list of indicators from Mandiant Threat Intelligence using defined parameters, including the start epoch. ### Endpoint - **URL:** `/v4/indicator` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.limit` | number | Optional | Defines the maximum number of results to return. Default 25 and maximum allowed 1000 | | `parameters.offset` | number | Optional | The number of items to skip before starting to collect the result set. If not specified, defaults to ZERO (0). The maximum amount of items that can be fetched using an offset and limit is 10,000. (The offset + limit must be \<= 10,000) | | `parameters.gte_mscore` | number | Optional | Defines the minimum Indicator Confidence Score to return. | | `parameters.exclude_osint` | boolean | Optional | Defines if open source indicators should be returned. | | `parameters.include_reports` | boolean | Optional | Used to include related reports. | | `parameters.report_limit` | number | Optional | Defines the maximum number of reports in list. Default 25 and Maximum allowed 1000. | | `parameters.include_campaigns` | boolean | Optional | Used to include related campaigns | | `parameters.start_epoch` | number | Required | Defines the start time of the data to load in epoch format, based on an indicators last\_updated value. The window must be less than 90 days. | | `parameters.only_recent_days` | number | Optional | Optionally defines the number of days of data to load relative to the specified start\_epoch value and the indicators last\_seen value. The default of 30 is recommended and will yield relevant indicators for most use cases. Minimum allowed 0 (last\_seen will not be considered when setting to 0). Maximum allowed 365. | | `parameters.end_epoch` | number | Optional | Defines the end time of the data to load in epoch format, based on an indicators last\_updated value. | | `parameters.next` | string | Optional | Used to get the next page of results. When using next no other parameters should be included in the request. NOTE:- The token returned is valid for 10 minutes. | | `parameters.sort_by` | string | Optional | The field on which sort needs to be performed. It can also be extended to support sort order by appending a ':' and sort order | | `parameters.sort_order` | string | Optional | Specify sort order - asc or desc | ### Input Example `{"parameters":{"limit":25,"offset":0,"gte_mscore":80,"exclude_osint":true,"include_reports":true,"report_limit":1,"include_campaigns":true,"start_epoch":1700823637,"only_recent_days":15,"end_epoch":1653426342,"next":"","sort_by":"publish_date","sort_order":"desc"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------- | -------- | -------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `indicators` | array | Output field: indicators | | `indicators.associated_hashes` | array | Output field: indicators.associated\_hashes | | `indicators.associated_hashes.id` | string | Unique identifier | | `indicators.associated_hashes.type` | string | Type of the resource | | `indicators.associated_hashes.value` | string | Value for the parameter | | `indicators.attributed_associations` | array | Output field: indicators.attributed\_associations | | `indicators.attributed_associations.id` | string | Unique identifier | | `indicators.attributed_associations.name` | string | Name of the resource | | `indicators.attributed_associations.type` | string | Type of the resource | | `indicators.first_seen` | string | Output field: indicators.first\_seen | | `indicators.id` | string | Unique identifier | | `indicators.is_exclusive` | boolean | Output field: indicators.is\_exclusive | | `indicators.is_publishable` | boolean | Output field: indicators.is\_publishable | | `indicators.last_seen` | string | Output field: indicators.last\_seen | | `indicators.last_updated` | string | Output field: indicators.last\_updated | | `indicators.misp` | object | Output field: indicators.misp | | `indicators.misp.akamai` | boolean | Output field: indicators.misp.akamai | | `indicators.misp.alexa` | boolean | Output field: indicators.misp.alexa | | `indicators.misp.alexa_1M` | boolean | Output field: indicators.misp.alexa\_1M | | `indicators.misp.amazon-aws` | boolean | Output field: indicators.misp.amazon-aws | | `indicators.misp.apple` | boolean | Output field: indicators.misp.apple | | `indicators.misp.automated-malware-analysis` | boolean | Output field: indicators.misp.automated-malware-analysis | | `indicators.misp.bank-website` | boolean | Output field: indicators.misp.bank-website | ### Output Example `{"indicators":[{"associated_hashes":[],"attributed_associations":[],"first_seen":"string","id":"12345678-1234-1234-1234-123456789abc","is_exclusive":true,"is_publishable":true,"last_seen":"string","last_updated":"string","misp":{},"mscore":123,"reports":[],"campaigns":[],"sources":[],"type":"string","value":"string"}],"next":"string"}` ## Get Indicator by value and Type Retrieve a specific indicator object from Mandiant Threat Intelligence using its type and value. ### Endpoint - **URL:** `/v4/indicator/{{indicator_type}}/{{indicator_value}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------- | -------- | ------------ | --------------------------------------------------------- | | `path_parameters.indicator_type` | string | Required | Parameters for the Get Indicator by value and Type action | | `path_parameters.indicator_value` | string | Required | Parameters for the Get Indicator by value and Type action | ### Input Example `{"path_parameters":{"indicator_type":"ipv4","indicator_value":"39.52.41.194"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------- | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `mscore` | number | Score value | | `type` | string | Type of the resource | | `value` | string | Value for the parameter | | `is_publishable` | boolean | Output field: is\_publishable | | `sources` | array | Output field: sources | | `sources.first_seen` | string | Output field: sources.first\_seen | | `sources.last_seen` | string | Output field: sources.last\_seen | | `sources.osint` | boolean | Output field: sources.osint | | `sources.category` | array | Output field: sources.category | | `sources.category.file_name` | string | Name of the resource | | `sources.category.file` | string | Output field: sources.category.file | | `sources.source_name` | string | Name of the resource | | `misp` | object | Output field: misp | | `misp.akamai` | boolean | Output field: misp.akamai | | `misp.alexa` | boolean | Output field: misp.alexa | | `misp.amazon-aws` | boolean | Output field: misp.amazon-aws | | `misp.apple` | boolean | Output field: misp.apple | | `misp.automated-malware-analysis` | boolean | Output field: misp.automated-malware-analysis | | `misp.bank-website` | boolean | Output field: misp.bank-website | | `misp.captive-portals` | boolean | Output field: misp.captive-portals | | `misp.censys-scanning` | boolean | Output field: misp.censys-scanning | | `misp.check-host-net` | boolean | Output field: misp.check-host-net | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 20 Jun 2024 10:18:11 GMT","Content-Type":"application/json; charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","vary":"Origin","x-envoy-upstream-service-time":"12","via":"1.1 google","CF-Cache-Status":"DYNAMIC","Server":"cloudflare","CF-RAY":"896b03695ee6445d-BOM","Content-Encoding":"gzip"},"reason":"OK","json_body":{"id":"ipv4--ad58d6ad-381e-5b21-9f31-36ef8404ea6f","mscore":50,"type":"ipv4","value":"39.52.41.194","is_publis...` ## Get Malware Indicators Retrieve a list of indicators associated with a specified malware from Mandiant Threat Intelligence using either its ID or name. ### Endpoint - **URL:** `/v4/malware/{{id_or_name}}/indicators` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ----------------------------------------------- | | `path_parameters.id_or_name` | string | Required | The id or name of the Malware Family to return. | ### Input Example `{"path_parameters":{"id_or_name":"malware--81f821d1-4ec9-534d-8dc7-53da47e5074a"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------- | -------- | ------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `indicator_count` | object | Count value | | `indicator_count.total` | number | Output field: indicator\_count.total | | `indicator_count.hash` | number | Output field: indicator\_count.hash | | `indicator_count.url` | number | URL endpoint for the request | | `indicator_count.fqdn` | number | Output field: indicator\_count.fqdn | | `indicator_count.ipv4` | number | Output field: indicator\_count.ipv4 | | `indicator_count.email` | number | Output field: indicator\_count.email | | `name` | string | Name of the resource | | `indicators` | array | Output field: indicators | | `indicators.first_seen` | string | Output field: indicators.first\_seen | | `indicators.last_seen` | string | Output field: indicators.last\_seen | | `indicators.mscore` | number | Score value | | `indicators.attributed_associations` | array | Output field: indicators.attributed\_associations | | `indicators.attributed_associations.name` | string | Name of the resource | | `indicators.attributed_associations.id` | string | Unique identifier | | `indicators.attributed_associations.type` | string | Type of the resource | | `indicators.id` | string | Unique identifier | | `indicators.type` | string | Type of the resource | | `indicators.value` | string | Value for the parameter | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"malware--81f821d1-4ec9-534d-8dc7-53da47e5074a","indicator_count":{"total":4,"hash":0,"url":0,"fqdn":4,"ipv4":0,"email":0},"name":"008S","indicators":[{}]}}` ## Get Report Indicators Retrieve indicator objects and associated reports from Mandiant Threat Intelligence using the provided ID. ### Endpoint - **URL:** `/v4/indicator/{{id}}/reports` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------- | | `path_parameters.id` | string | Required | The id of the object to return. | ### Input Example `{"path_parameters":{"id":"ipv4--98019aaa-43af-5869-b530-591a9a9d9fb3"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | -------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `mscore` | number | Score value | | `type` | string | Type of the resource | | `value` | string | Value for the parameter | | `first_seen` | string | Output field: first\_seen | | `last_seen` | string | Output field: last\_seen | | `is_customer_releasable` | boolean | Output field: is\_customer\_releasable | | `reports` | array | Output field: reports | | `reports.id` | string | Unique identifier | | `reports.report_id` | string | Unique identifier | | `reports.type` | string | Type of the resource | | `reports.title` | string | Output field: reports.title | | `reports.published_date` | string | Date value | | `reports.audience` | array | Output field: reports.audience | | `next` | string | Output field: next | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"ipv4--98019aaa-43af-5869-b530-591a9a9d9fb3","mscore":100,"type":"ipv4","value":"190.31.53.131","first_seen":"2020-08-05T21:31:41Z","last_seen":"2021-01-10T06:52:11Z","is_customer_releasable":true,"reports":[{}],"next":"FGluY2x1ZGVfY29udGV4dF91dWlkDnF1ZXJ5V..."}}` # Response Headers | **Header** | **Description** | **Example** | | ----------------------------- | -------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | CF-Cache-Status | HTTP response header: CF-Cache-Status | DYNAMIC | | CF-RAY | HTTP response header: CF-RAY | 84a85266a8349a8a-NAG | | Connection | HTTP response header: Connection | keep-alive | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT | | Server | Information about the software used by the origin server | cloudflare | | Set-Cookie | HTTP response header: Set-Cookie | \_\_cf\_bm=P5a9ERUKxqeSpUvakTfq2HEXEcyPzWcsIJmiLpYXsw4-1706099785-1-AcmmiM+V5EgsQBVdLpkOjCvYrFQnMgTrKNyM+4FpMV1SKdQZLlVd3KymzHAg6q1EZoYqq6X3x5b1QxlQNbynMQc=; path=/; expires=Wed, 24-Jan-24 13:06:25 GMT; domain=.mandiant.com; HttpOnly; Secure; SameSite=None | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=15724800; includeSubDomains | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | vary | HTTP response header: vary | Origin | | via | HTTP response header: via | 1.1 google | | x-amzn-trace-id | HTTP response header: x-amzn-trace-id | 8706bdd97032bce4c21759f54ecfad69 | | x-envoy-upstream-service-time | HTTP response header: x-envoy-upstream-service-time | 12 |