Guide: Setting up automated IOC ingestion from Mandiant to our EDR

We've been evaluating Mandiant Threat Intelligence for automated IOC ingestion into our CrowdStrike EDR. The goal was to move beyond manual CSV uploads and establish a pipeline that refreshes indicators every six hours with minimal operational overhead.

The initial challenge was the lack of a native CrowdStrike connector. This required building a lightweight integration using Mandiant's `ti-indicator` API endpoint and the CrowdStrike Falcon API. The core architecture is a Python script orchestrated by Apache Airflow, performing these steps:

1. Authenticate to the Mandiant API using the provided client key and secret.
2. Fetch IOCs filtered by a specific threat actor or malware family relevant to our vertical.
3. Transform the JSON response into the CrowdStrike IOC format, mapping fields like `value`, `type`, `policy`, and `source`.
4. Authenticate to the CrowdStrike OAuth2 API.
5. Perform an upsert operation, updating existing IOCs and creating new ones.

Here is the key transformation logic for the IOC payload:

```python
# Example mapping for a SHA256 hash
mandiant_ioc = {
"type": "sha256",
"value": "a1b2c3...",
"mscore": 85,
"last_updated": "2023-10-26T15:00:00Z"
}

crowdstrike_payload = {
"type": "sha256",
"value": mandiant_ioc["value"],
"policy": "detect", # or "none" for monitoring
"source": "Mandiant Threat Intelligence",
"description": f"Mandiant mscore: {mandiant_ioc['mscore']}",
"platforms": ["linux", "mac", "windows"]
}
```

Performance benchmarks for our daily pull of approximately 1,200 indicators show an average execution time of 42 seconds. The primary latency is in the CrowdStrike batch upload. We've encountered two main pitfalls:

* **API Rate Limiting:** Mandiant's API has well-documented limits. Implementing exponential backoff in the fetch logic was necessary.
* **Indicator Duplication:** Without a robust `updated_after` filter, the script can re-ingest unchanged IOCs. We now track the last successful run timestamp in a small metadata table to fetch only new or modified indicators.

The setup has reduced our mean time to ingest (MTTI) for relevant IOCs from several hours to under five minutes. For teams using a different EDR, the pattern remains similar: fetch from Mandiant, transform to your EDR's schema, and upsert via API. The critical success factor is maintaining the idempotency of the upload process.