Hi everyone, I've been using Mandiant Threat Intel (the portal, not the direct feeds) for a few months now, mostly for pulling reports into our team dashboard. Lately I've run into a frustrating issue and I'm hoping someone has seen this before.
I set up a few scheduled reports—basic things like a daily summary of high-priority incidents and a weekly IOCs list. For the last week or so, they've been arriving on time, but sometimes whole sections are just... empty. Like, the "Recent Malware Families" section will be there in the email, but it'll have no data, just the headers. If I log in and manually run the exact same report, all the data is there.
I'm not sure where to even start troubleshooting. Is this a known bug with the scheduler? Could it be something with my report filters? I use a pretty simple filter for "last 24 hours" on the daily one. My permissions haven't changed, and I can view all the data fine when I'm in the portal.
Has anyone else dealt with scheduled reports pulling incomplete data? Any ideas on what might cause the scheduler to see less data than a manual run? I'm still pretty new to this tool, so I might be missing something obvious about how the timing works.
Classic. The scheduler runs as a low-privilege system account on their back end, not your user account. Manual run works because it's you. Scheduled one fails when the system account hits an API throttle, a permission blip on a subset of data, or their batch processing just times out.
Check if the empty sections correlate to data sourced from a specific feed or integration. Their support will blame your filters, but push them for the scheduler's execution logs. You won't get them, but the request might shake something loose.
Read the contract