Mandiant TI: To keep your organization's Security Posture rock solid!
Use Cases and Deployment Scope
Threat Intel is the core of any SOC to function properly. Our analysts have been using Mandiant TI by various means.
The feeds are integrated to the SIEM and reference sets have been built around it. Additionally it's SaaS based portal is being used for IOC lookups, advisories and latest on-going threats.
Pros
- Accuracy of the IOCs
- UI for the SaaS based portal is quite friendly
- API integration is quite easy
Cons
- Tweaking the feeds as per threat profiling
- Number of advisories being pushed
- Brand List and Watch List Addition
Likelihood to Recommend
Usually SOC leverages Intel from mutiple sources. The scenarios are:
1.Suitable: In large scale SOC where more than 5000 devices are being monitored and the tech stack is wide, Mandiant will play an excellent role in that scenario.
2.Not Suitable: In small scale SOCs wherein limited devices belonging to the same tech stack is being used then the analysts can rely on OSINT and it is not useful to buy the solution.