Guide: Creating custom watchlists for our specific tech stack

Effective threat intelligence requires precision. Generic feeds from Mandiant Threat Intelligence, while comprehensive, generate significant noise for security teams managing specialized technology environments. This guide details a methodology for creating custom watchlists focused on your specific tech stack, transforming raw intelligence into actionable alerts.

The core principle is to map your external attack surface to Mandiant's intelligence using their object types and filters. This is best achieved via the Mandiant Advantage Threat Intelligence API. The following Python snippet demonstrates the initial setup and a query for vulnerabilities (`vulnerability` object type) targeting specific vendors and products in our stack.

```python
import requests

# Configure with your API credentials
API_KEY = "your_api_key"
API_SECRET = "your_api_secret"
BASE_URL = "https://api.intelligence.mandiant.com/v4"

# Define your tech stack mapping
TECH_STACK = {
"vendor": ["Apache", "nginx", "F5"],
"product": ["Apache HTTP Server", "nginx", "BIG-IP"]
}

# Construct a query for vulnerabilities
query = {
"requests": [{
"object": "vulnerability",
"filter": {
"operator": "and",
"operands": [
{"field": "vendor", "operator": "in", "value": TECH_STACK["vendor"]},
{"field": "product", "operator": "in", "value": TECH_STACK["product"]},
{"field": "last_observed", "operator": "gte", "value": "2024-01-01"}
]
},
"fields": ["id", "name", "risk_rating", "published_date", "cves"]
}]
}

headers = {
"X-RapidAPI-Key": API_KEY,
"X-RapidAPI-Host": "api.intelligence.mandiant.com"
}
response = requests.post(f"{BASE_URL}/object/list", json=query, headers=headers)
vulnerability_data = response.json()
```

Key steps for operationalizing this approach:

* **Define Your Stack:** Inventory critical vendors, product names, software versions, and internal codenames for proprietary applications.
* **Select Relevant Object Types:** Primarily `vulnerability`, `malware`, and `threat-actor`. Use `indicator` for fine-grained IOC monitoring, but apply strict context filters.
* **Implement Context Filters:** Beyond vendor/product, filter by high `confidence` and recent `last_observed` dates. For threat actors, filter by `motivations` (e.g., "Espionage") and `targeted_industries`.
* **Automate and Integrate:** Schedule scripts to run daily, outputting results to your SIEM or SOAR platform. Deduplicate findings using Mandiant's internal IDs.

The result is a tailored feed that highlights vulnerabilities in your F5 BIG-IP systems or malware campaigns targeting nginx, rather than every emerging threat. This reduces alert fatigue and focuses analyst effort on relevant, high-fidelity intelligence.

Benchmarks > marketing.