Switched our SOC over to Mandiant Threat Intel last quarter. The intel quality is superior, no argument. The feeds are clean, and the context provided is excellent for our threat hunters.
But the operational gap is huge compared to ThreatConnect.
* No built-in playbooks or case management.
* Can't easily enrich our internal alerts with their data without writing a bunch of glue code.
* The API is powerful, but we now have to build and maintain our own workflow tooling to actually *use* the intel in our pipelines.
Example: In ThreatConnect, we had a simple workflow that auto-added IOCs from a specific actor campaign to our WAF blocklist. Now, I'm maintaining a script that polls Mandiant's API, transforms the data, and pushes it. It's more code, more points of failure.
```python
# This is the extra layer I now have to maintain.
def get_mandiant_iocs(campaign_id):
# API call, error handling, pagination...
pass
def transform_to_waf_format(iocs):
# Mandiant format -> our vendor's format...
pass
# etc.
```
Anyone else running into this? What are you using to bridge the workflow gap? Custom integrations? A separate SOAR?
Benchmarks or bust.
I'm a security procurement lead at a mid-sized fintech. We run Mandiant for strategic intel but kept ThreatConnect as our orchestration layer because of exactly this gap. My stack is Mandiant, Splunk, and TC in production.
Here's a concrete breakdown from the procurement and ops side:
1. **Total cost of ownership:** Mandiant's intel platform is a straight annual subscription (roughly $70-120k for our tier). ThreatConnect's operational platform is another $45-65k. You swapped one for the other but kept the operational need, so now you're paying for a separate SOAR or writing code, which is engineering time you didn't budget. That's at least one FTE quarter per year in maintenance.
2. **Integration effort:** Mandiant's API is RESTful and well-documented, but it's a data feed, not a workflow engine. Building that pipeline you described takes about 2-3 dev weeks initially, plus ongoing maintenance. ThreatConnect had those connectors and playbooks built-in, so the initial setup was under a week.
3. **Vendor lock-in risk:** With ThreatConnect, your playbooks and automations live in their proprietary system. With your custom scripts, you own the code, but you're now locked to Mandiant's specific data schema. A format change on their end breaks your transform functions. We had to build a normalization layer to future-proof it.
4. **Target audience fit:** Mandiant is built for threat hunters and analysts who need deep context. ThreatConnect is built for SOC analysts and engineers who need to operationalize that context. They're different tools for different jobs, and the industry push to "consolidate" ignores that.
My recommendation: you need a separate orchestration layer. We kept ThreatConnect. If I were starting today, I'd look at Tines or Shuffling for lighter weight, or Splunk SOAR if you're already in that ecosystem. Tell us your SOC headcount and whether you're cloud-native, and the choice gets clearer.
Trust but verify.