CrowdStrike Falcon
CrowdStrike · Endpoint
Endpoint threat prevention, detection, investigation and containment
Mandiant Threat Intelligence and Incident Response
Mandiant (Google Cloud) · Security Operations and Monitoring
Frontline incident response, threat intelligence and managed defence from Google Cloud's Mandiant.
Draft summary. This page summarises what the vendor's product family is generally known for. Each claim is pending confirmation against vendor documentation.
Overview
Mandiant is known for investigating major breaches around the world. That experience feeds its threat intelligence, which describes the attackers, tools and techniques active against organisations like yours, and its incident response and managed defence services.
Customers use Mandiant to prepare for incidents, bring in experts during a breach and add intelligence to their detection. Ten Forward is a Mandiant partner and has delivered a cyber centre project using Mandiant products and services.
- Primary capability
- Incident response, threat intelligence and managed defence
- Deployment models
- SaaSPending vendor confirmation
- Management effort
- ModeratePending vendor confirmation
Customer challenges and business value
No one to call during a breach
Most teams have never run a major investigation, and the first hours decide how much damage is done.
Intelligence that is not actionable
Generic feeds list indicators without saying who is targeting your sector or what to do about it.
Untested response plans
Plans written on paper often fail under real pressure.
What this helps you achieve
- Expert help available when an incident happens
- Intelligence about attackers relevant to your industry
- Practised, tested incident response
Key capabilities
- Incident response and breach investigationPending vendor confirmation
- Cyber threat intelligence on attackers, malware and campaignsPending vendor confirmation
- Managed defence and threat hunting servicePending vendor confirmation
- Attack surface managementPending vendor confirmation
- Security validation of controlsPending vendor confirmation
- Readiness assessments, tabletop exercises and consultingPending vendor confirmation
Technical architecture and deployment
Where the product sits in a typical security architecture, and what it connects to.
Data sources
- Security telemetry
- Threat research and investigations
This product
Mandiant intelligence and services
Outputs and actions
- Intelligence reports
- Incident response
- Detection content
Integration ecosystem
Categories of systems this type of product commonly connects to. Specific connectors and versions are confirmed with the vendor.
- SIEM and SOAR platformsPending vendor confirmation
- Endpoint detection and responsePending vendor confirmation
- Google Security OperationsPending vendor confirmation
- Ticketing and case managementPending vendor confirmation
Common use cases
- Retainer for incident response
- Adding threat intelligence to the security operations centre
- Running a tabletop exercise with leadership
- Building a national or enterprise cyber centre
Frequently asked questions
Is Mandiant a product or a service?
Both. It offers intelligence and attack surface products as well as incident response and managed services. We scope the mix with you.
Where does the information on this page come from?
This page is a draft summary of what the vendor's product family is generally known for. Capabilities, deployment models and integrations are marked as pending until they are checked against vendor documentation. Ask us for a confirmed scope for your environment.
Related products
Palo Alto Networks Cortex
Palo Alto Networks · Monitoring
Cross-domain detection, investigation and automated response
Stellar Cyber Open XDR Platform
Stellar Cyber · Monitoring
Open XDR: data collection, correlation and automated response
Talk to an expert about Mandiant Threat Intelligence and Incident Response
Share your environment and requirements. We will confirm product details with the vendor and help you decide.
Request a consultation