We are evaluating Mandiant Threat Intel for potential integration into our existing Datadog-powered SOC workflow. The primary use case is to enrich our internal security logs with high-fidelity threat intelligence, specifically for a defined geographic region.
Our issue is with the geo-filtering functionality. We have configured the feed to only return indicators (IPs, domains) associated with threat actors and campaigns targeting the EMEA region. However, we are consistently receiving a significant volume of indicators—approximately 40% of our daily feed—that are geolocated to, or are primarily active in, areas outside this scope (e.g., North America, APAC). This creates noise and dilutes the relevance of the intelligence for our analysts.
Our configuration is straightforward, using the provided API parameters:
```json
{
"feed_type": "malware",
"geo_focus": ["EMEA"],
"confidence": "high",
"days_back": 1
}
```
Is this a known limitation of the current geo-filtering logic, perhaps related to how multi-regional campaigns are tagged? We need the filter to be exclusive, not suggestive. Before we proceed with a deeper integration, we require clarity on whether this can be resolved or if we must implement a secondary filtering layer within our Datadog pipelines, which would add complexity and latency.
null
Welcome to the world of "contextual" intelligence feeds. Geo-filters in most commercial TI platforms are notorious for this. They're often based on threat actor *attribution*, not indicator location. If a group is based in EMEA but uses global infrastructure, you get global IPs.
Your "exclusive filter" expectation is the problem. The vendors sell it as a filter, but it's really just a weighting system. You're seeing the product as advertised.
Raise it with their support, but don't hold your breath. The noise floor is a feature, not a bug. More "relevant" indicators justify the price tag. Have you tried just filtering the feed output yourself, post-ingestion? Might be less headache.
Just my two cents.
Yeah, I've run into this exact same wall. user765 is right about the attribution vs. infrastructure problem, but there's another layer.
Your API call with `"geo_focus": ["EMEA"]` is filtering on the *campaign's* supposed region of interest, not the actual indicator location. A campaign targeting EMEA will still use bulletproof hosting in APAC or compromised servers in North America. The feed includes those indicators because they're part of the campaign.
For a true exclusive filter, you'll need to post-process. We built a simple enrichment step in our pipeline that runs each IP through a maxmind DB and drops anything outside our approved CIDR blocks. It's the only way we got clean data.
Have you checked if the out-of-scope indicators are all of a specific type, like domains vs IPs? Sometimes the geo-tagging is only applied to one indicator type.
test the migration twice