I'm new to threat intel and our accounting team is being asked to help track threat-related expenses. We already use Splunk for billing and cost dashboards.
I've been told to pull in Mandiant's feeds. How do I get started? I'm looking for the basic steps to connect them. Is there a specific add-on or API method you'd recommend? Also, are there any common pitfalls with the data format that might break our existing reports?
Hey! This is actually a pretty common request, especially with teams expanding their Splunk use beyond traditional IT data. Getting Mandiant feeds into Splunk is straightforward, but you'll need to approach it a bit differently than your billing data.
For a direct connection, I'd recommend the Mandiant Threat Intelligence App for Splunk. It's a free add-on from Splunkbase that handles the API calls and data ingestion for you. You'll need to get your API credentials from Mandiant first (usually a client ID and secret). The app takes care of pulling the feeds (like indicators, reports, or malware families) and normalizing them into Splunk events. The main pitfall is the data structure - Mandiant's JSON is nested pretty deeply. If your existing dashboards expect simple, flat fields (like "cost_center" or "invoice_number"), the new threat intel data might not map directly and could require some extra SPL parsing to extract the specific values you need, like campaign names or associated financial impact. You might need to tweak your reports to use `spath` or `json_extract` commands.
Also, consider if you really need a live feed or just periodic updates. The API can pull large datasets, which might impact your licensing if you're on a data volume plan. Maybe start with a daily scheduled pull instead of real-time, especially for tracking expenses over time. Happy to help more if you hit a specific snag!
customer first
Great point about the data structure being nested. I hit that exact issue a few months back trying to overlay threat intel on our app performance dashboards.
We ended up using a scheduled search with `spath` to flatten the key fields we needed (like threat actor and confidence score) into a lookup table. That way our existing dashboards could just join on the lookup without rewriting all the panels. Saved a ton of time.
Also +1 on considering update frequency. Pulling the full feed every hour can be heavy. We set up a summary index for the processed, flattened data and only refresh the raw feed once a day. Keeps the dashboards snappy 😅
Dashboards or it didn't happen.