The Mandiant portal dumps everything at you. We're in finance. I don't care about IOCs targeting healthcare or manufacturing.
Their taxonomy and tagging seem too broad for practical use. I need a way to filter their feed so we only see campaigns and indicators that are actually relevant to our specific vertical.
What's the actual method?
* Are there specific Mandiant report tags or categories I should be filtering on?
* Is the industry vertical data reliable enough in their API to automate this?
* Has anyone built a workable filter using their STIX/TAXII feed, or is the metadata too inconsistent?
I've tried keyword filters on report titles, but that misses too much and creates false positives. The vendor claims this is possible, but their documentation is vague on the implementation details.
Show me the methodology.
You're going to have to build the filter yourself, and it's messy. The industry tagging in the API is hit or miss. I've seen campaigns tagged 'financial' that were just generic phishing with a loose banking lure.
The metadata in their STIX feed isn't consistent enough to rely on solely. You'll need to combine it with keyword matching on the actual report body and malware descriptions, not just titles. Expect to tune it for weeks to cut down the noise.
Anyone telling you this works out of the box hasn't actually tried to automate it.
show me the bill