Mandiant Managed Defense vs. WhoisXML API Enterprise API and Data Feed Packages

Rapid identification & Neutralization : The Madiant Rapid Response team will get work right away often within hours to identify and eject the adversary . Others Vendor takes days. Post Incidents Threat Summary: Mandiant provide formal summary of its investigation, detailing the actions it took & discovery it made as well as recommending long term guidance on how to mitigate the recurrence of similar threats in future . Also provide ongoing detection & response.

Incentivized

In general, the enterprise APIs are relevant for organizations that need access to various and compatible sources of domain and IP intelligence for a large number of queries. That is opposed to using each product in the packages separately, which is also possible but less advantageous when scaling up use. Similarly, the enterprise feed packages are useful for users who want access to various types of domain and IP data but prefer to avoid API calls. Users who only need access to one type of said data, however, may prefer not to use the package.

• Excellent across all major tenant of incident response (detection, containment, eradication, etc.)
• Has a strong backend support system to perform advanced incident response activities (reverse malware engineering, etc.)
• Very scalable - no matter how small or large the incident, Managed Defense can tackle it, or escalate to Mandiant IR if the incident is complex and/or large enough.

• The products allow us to validate the information from our own data-gathering efforts.
• Packages are customizable. Available credits can be used on any of the APIs. The databases come in a series of tiers for domain WHOIS data or IP data only or all-inclusive.
• The APIs and data feeds both enrich our data and help us protect our own network.
• Because the APIs give results in JSON and XML, we were able to make them work with our existing systems without hassle. The same is true for the data feeds as they are available in both JSON and CSV formats, which are suitable for pretty much any general or specialized software.

• Due to split from FireEye Mandiant no longer can provide its own End Point Protection as part of MDR for customers that want to transition after incident is complete .
• Single remediation response with no-ongoing monitoring

Incentivized

• It took us a bit of time to understand which APIs and feeds were the most relevant to us at first. Fortunately, documentation is available and someone from WhoisXML API helped us understand each service better.

We are a quiet shop with few incidents, however, MD's response to questions and access to our assigned MD consultant is excellent.

Incentivized

There is not much to say here. The support team is accessible by email and phone. Upon purchasing the packages, the databases were promptly delivered to us and we didn't see the need to interact much with the support team.

Honestly, Mandiant seems to be the best all around. Even with being a smaller business, it’s help tremendously and keeps us feeling safe and protected

Incentivized

• IT/SOC time saved by monitoring alerts
• Improved time to remediation due to 24/7 eyes on glass
• Hopefully less impact from security incidents due to early detection and containment

Incentivized

• A better understanding of the high-level domain and IP spaces
• Detection and avoidance of dangerous threat actors