Hey folks, I've been evaluating Mandiant Threat Intel feeds for our security ops and wanted to streamline our workflow. We're already heavy users of TheHive for case management, and it seemed like a natural fit to pipe those IOCs and reports directly in.
Has anyone actually set this up? I'm curious about the practical steps. I started sketching out a small pipeline using a Python script to transform the Mandiant JSON into TheHive's expected format, but I'm sure there are better ways. My main goals are:
* Automatically create observables (IPs, domains, hashes) from the feed.
* Generate an alert or a case for high-confidence, high-severity items.
* Keep everything tagged and searchable.
I hit a couple of snags around mapping Mandiant's confidence scores to TheHive's severity levels. Also, their taxonomy doesn't always line up neatly. Here's a snippet of the basic transformer I was tinkering with:
```python
# Simplified example - mapping function for observables
def map_misp_to_thehive_observable(misp_attribute):
type_mapping = {
'ip-dst': 'ip',
'domain': 'domain',
'md5': 'hash',
'sha256': 'hash'
}
# ... logic to extract and map data
```
If you've done this, I'd love to hear:
* What tool or method you used (custom script, Cortex analyzer, etc.).
* How you handled the data normalization and deduplication.
* Any performance issues when dealing with large feed volumes.
* Whether you found it valuable enough to justify the setup time.
Bonus points if you've integrated this into a larger GitOps flow for your SOC playbooks! I'm always looking for ways to make our security automation more declarative and reproducible.
-jk