Hi everyone, new to the forum and to using Mandiant's threat intel platform. I've been exploring the API to help with some security automation for our sales team, basically trying to flag risky customer domains.
I'm trying to understand how to get historical data on a specific threat actor. I can pull current indicators and reports just fine, but I need to see what they were doing, say, six months ago. Is that possible through the API?
I've looked through the API docs on the portal, but I'm a bit lost on the endpoints for historical searches. Do I use the "actors" endpoint with a specific parameter, or is there a separate "reports" query I should use with a date range? A small example of the request structure would be super helpful 😊
Also, does pulling historical data count differently against the API rate limits compared to current data queries? I want to make sure I don't hit a limit unexpectedly while testing. Thanks in advance for any pointers!
Oh yeah, I've been wrestling with the date range thing too! I think the `/v4/reports` endpoint is what you want, not the actors one. You can filter by `actor` and use the `start_date` and `end_date` params. It's a bit tricky to get the format right.
For a date six months ago, I had to use a timestamp like `2023-09-01T00:00:00.000Z`. The docs weren't super clear on that. Does that match what you found?
And good call on the rate limits, I'm worried about that myself.
user107 is on the right track with the `/v4/reports` endpoint, but let me share a little scar tissue from a client migration I did last year. They wanted to pull six months of actor activity to build a domain risk model for their sales team, exactly like your use case. We hammered the API with the actors endpoint first, thinking "actor" would give us history. Nope. That endpoint returns current profile metadata, not historical activity. You need reports with the `actor` and `start_date` filters.
One thing that bit us: pagination. If the actor was very active over six months, you might get hundreds of pages. The API rate limits (I think it's 1000 requests per hour for standard tier) will eat your lunch if you don't pace yourself. I learned that the hard way and ended up writing a simple backoff retry that also pre-fetched in batches during off-peak hours.
Also, regarding your rate limit question - historical queries count the same as current ones. No special treatment. But there's often a daily soft cap too, not just hourly. So if you're pulling a big backfill, I'd spread it out over a few days or use a cached local store so you're not re-querying old data every time.
One more gotcha with the date format: make sure your timestamps are UTC ISO 8601. The docs example uses `2023-09-01T00:00:00.000Z` but I've seen some endpoints accept `2023-09-01` without time. Reports seemed to need the full timestamp. If you get a 400, check that first.
Curious - when you say "flag risky customer domains," are you matching domain IOCs from those reports, or something else? That part can get messy fast if you're dealing with fuzzy domain reputation.
Implementation is 80% process, 20% tool.