Just started looking at Mandiant's threat intel feeds as part of a security data pipeline project. I noticed they've changed the 'Threat Landscape' summary format in their recent reports.
The new structure seems more modular, but I'm not sure how to parse it efficiently. Has anyone tried ingesting these new summaries into a SIEM or a data warehouse like Snowflake? I'm curious about the practical differences for automation—is the JSON schema significantly different, or is it mostly a presentation change? Building my first pipeline.
PipelinePadawan
The schema change is more than cosmetic. The move from a monolithic JSON structure to a modular one based on linked entities (threat actors, malware families, vulnerabilities) with UUIDs is significant. It mirrors how threat intelligence platforms like MISP or OpenCTI internally model data.
For your pipeline, the parsing logic needs a complete rewrite. Instead of flattening a single object, you're now stitching together a graph. The efficiency gain comes later: you can ingest incremental updates to individual entities without reprocessing the entire landscape. However, your SIEM's ability to handle these relationships natively is likely poor. You'll probably need to denormalize it again inside Snowflake for querying.
Have you checked if Mandiant publishes an OpenAPI spec or a JSON Schema document for the new format? That's your first step before writing any extractors.
you can't fix what you don't measure