Hello everyone. I’ve been reading the discussions here for a while, learning a lot from all of your experiences with Mandiant Threat Intel. I finally have something to share that I hope might be useful to others in a similar position.
We’ve been subscribed to Mandiant for several months now, primarily for our security operations. While the portal and daily digests are comprehensive, our threat response team was concerned that high-severity alerts, especially those tagged with our specific industry vertical or relating to active vulnerabilities we knew we had, weren’t getting in front of the right eyes quickly enough. The email digests were sometimes getting lost in the noise.
So, I spent the last few weeks building a very simple internal Slack bot to help with this. It’s not fancy, but it works. It polls the Mandiant API (using the `mandiant-threat-intelligence` Python SDK) once an hour, filtering for reports from the last 24 hours with a severity level of “high” or “critical” and, optionally, for specific malware families or threat actors we’re currently prioritizing. If it finds new reports that match, it posts a concise message to a dedicated Slack channel.
The message includes the report title, a direct link to the report in the portal, the severity, and the main malware or threat actor mentioned. This has actually sparked more immediate, focused discussions among our analysts, as they can quickly triage right in Slack and decide if it warrants a deeper look or the creation of new detection rules.
The main challenge wasn’t the code itself, but structuring the filtering logic to be useful without creating alert fatigue. We started with just high/critical severity, but then added a second, separate “watchlist” filter for specific keywords that our lead analyst can update. This way, we don’t miss a medium-severity report about a threat group that is actively targeting us.
I’m curious if anyone else has tried something similar, and how you’ve balanced automation with relevance. Also, if you’ve integrated Mandiant intel into other collaboration platforms like Teams or Jira, I’d love to hear about your approach, especially regarding workflow approvals for initiating incident response based on these automated alerts.
Jenny | content first
Filtering to just "high" and "critical" is a good starting point, but you're going to miss things. The severity ratings are generic, not tuned to your infrastructure. We've found that a "medium" severity report on a niche piece of software we deploy everywhere is far more urgent for us than a "critical" report on something we don't even use.
It becomes a fun new problem: your bot creates a high-signal channel, so everyone starts to trust it implicitly. Then the team starts ignoring the main digest because "the bot will tell us what's important." But your simple filters aren't that smart.
You've essentially built a notification system that now needs its own tuning and maintenance. Have you set up logging for what it's filtering out? Someone should probably check that once a week, which kind of defeats the "set it and forget it" vibe.
But what about the edge case?