Okay, so I’m coming at this from a project management and collaboration tool background—I live in Asana and Slack for coordinating my team. I was really excited when my company got Mandiant Threat Intel because, you know, staying ahead of threats is part of the job now, especially with remote work.
But I have to say, the mobile app feels like it was built just to check a box. I was hoping to get quick, actionable alerts I could triage on the go, maybe share a relevant IOC with our security channel in Slack from my phone. Instead, it feels like a read-only portal. The navigation is clunky, searching for anything specific is painful, and trying to correlate data feels impossible. It’s like they just shoved the desktop dashboard onto a small screen.
Am I missing something? How do you all use it for actual operational work? I can’t imagine trying to use this during an incident response if I’m away from my desk. It just doesn’t seem built for that. I’d love to know if there’s a trick to it, or if everyone just uses the web version.
Thx!
Yeah, you've nailed the "read-only portal" feeling. It's a common issue with mobile ports of complex tools.
I tried using it for the same reason - quick triage from a tablet when I was out. The search is what kills it for me. On desktop I can craft a decent query to filter noise, but on mobile it feels like you're just browsing pre-canned feeds. Makes it useless for actually investigating something specific that pops up in a Slack alert.
Have you found any workaround for sharing? I ended up just screenshotting and cropping, which is... not ideal. Curious if others have a better flow.
Data is the new oil - but it's usually crude.
You're expecting it to be an ops tool. It's not.
These mobile apps are usually just compliance theater. The real work happens on a laptop with a proper browser and a keyboard. I've never seen a security tool's mobile version that you'd actually want to use during a real incident.
Your instinct is right. If you're on-call, you need the full web UI or API access. Trying to "triage" from a phone screen is a good way to miss something critical.
Keep it simple
You're hitting on a fundamental product design challenge: the difference between a notification platform and an investigation tool.
The expectation for "quick, actionable alerts I could triage on the go" is correct. That's what a good mobile app for this domain should be. What you're describing, a read-only portal of the desktop UI, is a failed adaptation. It suggests they didn't do the job mapping user stories for mobile-specific use cases, like receiving a push notification about a critical IOC and having a one-tap path to share it to Slack.
Your project management analogy is apt. In Asana, you can complete a task or comment from mobile without needing the full desktop context. That's because they designed the mobile interaction around specific actions. Mandiant's app, as you describe it, seems to lack those defined action pathways. It's serving data, not enabling decisions.
I'd be curious if their analytics show any meaningful engagement beyond initial login. My bet would be on a steep drop-off after the first few sessions, precisely because it doesn't support the operational intent you outlined.
p-value < 0.05 or bust
Totally agree about the difference between a notification platform and an investigation tool. The "serving data, not enabling decisions" line really sums it up.
That makes me wonder, would it even be possible to design a mobile app that's good for *real* investigation work? Or is that use case just too complex for a small screen?
I'm newer to this, but analytics showing a drop-off after login makes sense. If it doesn't help you *do* something, why open it again?
Ask me in a year
You've correctly identified the core issue. It's not that you're missing a trick, it's that the app is serving data instead of enabling decisions. The expectation for on-the-go triage is valid, but the architecture is wrong.
Think of it as an API and presentation layer problem. The backend intelligence is there, but the mobile front-end is a direct port, not a purpose-built interface. A proper mobile experience would expose a curated subset of actions, like one-tap sharing to Slack or approving a predefined containment workflow. What you have is the full data model squeezed into a small viewport.
Your comment about incident response is key. For a real mobile operational tool, the design would start with the "I'm away from my desk" scenario, mapping specific, high-value user journeys. This app skipped that step. Until they treat mobile as a first-class platform with its own interaction model, you're correct to rely on the web version for anything substantive.
That expectation for a quick, actionable mobile triage experience is totally valid. From a project management background, you're used to tools designed for doing, not just viewing.
It sounds like you haven't found a trick because there isn't one. The app was built for consumption, not action. A well-designed mobile tool for this would give you those one-tap actions - like your Slack-sharing idea - right from the alert itself, not just a miniaturized data viewer.
Has anyone on your team tried pushing this feedback through an account manager? Sometimes highlighting how it breaks a real on-call workflow gets more traction than generic "the UI is bad" comments.
Oh, the account manager idea is interesting. We haven't tried that yet. My team is small, so our feedback usually just goes into the general support channel.
But you mentioning "generic 'the UI is bad' comments" makes me think maybe we need to frame it better. Like, when I hit this problem last week, I couldn't quickly pull a piece of intel into our Slack channel during a team call. That's a concrete workflow break, right? Not just a vague complaint.
Do you know what kind of feedback actually gets traction in these cases? I'm worried it'll just get logged as "user wants improved mobile UX" and that's it.